diff --git a/.beads/cc-task-map.json b/.beads/cc-task-map.json
new file mode 100644
index 00000000..17c7217e
--- /dev/null
+++ b/.beads/cc-task-map.json
@@ -0,0 +1,33 @@
+{
+  "version": 1,
+  "entries": [
+    {
+      "bd_id": "foreman-4jbc",
+      "cc_task_id": null,
+      "title": "Sidebar reads as out-of-place grey/black slab with hard divider",
+      "created_at": "2026-06-20T19:26:24.249Z",
+      "updated_at": "2026-06-20T19:26:24.249Z"
+    },
+    {
+      "bd_id": "foreman-qhbp",
+      "cc_task_id": null,
+      "title": "Migrations cleanup + identity/tenancy unification onto NextBase model",
+      "created_at": "2026-06-25T19:14:53.805Z",
+      "updated_at": "2026-06-25T19:14:53.805Z"
+    },
+    {
+      "bd_id": null,
+      "cc_task_id": "1",
+      "title": "RLS policies via is_workspace_member() — defense-in-depth for the workspace_id",
+      "created_at": "2026-06-27T17:15:53.406Z",
+      "updated_at": "2026-06-27T17:28:51.271Z"
+    },
+    {
+      "bd_id": null,
+      "cc_task_id": "2",
+      "title": "Public (logged-out) chat share link — conversation_share token table,",
+      "created_at": "2026-06-27T18:02:40.593Z",
+      "updated_at": "2026-06-27T18:22:37.486Z"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/.beads/export-state.json b/.beads/export-state.json
index 3905e1ce..ae572d4f 100644
--- a/.beads/export-state.json
+++ b/.beads/export-state.json
@@ -1 +1 @@
-{"last_dolt_commit":"o8vu7a0cluhbge8dvgcci6eteo0vknre","timestamp":"2026-06-16T10:04:37.662891-07:00","issues":256,"memories":0}
\ No newline at end of file
+{"last_dolt_commit":"3p94daefk053r8a406sg6o8l98j7249f","timestamp":"2026-07-04T19:54:25.7388155-07:00","issues":418,"memories":0}
\ No newline at end of file
diff --git a/.beads/issues.jsonl b/.beads/issues.jsonl
index e76f425f..b1d7f318 100644
--- a/.beads/issues.jsonl
+++ b/.beads/issues.jsonl
@@ -1,12 +1,51 @@
 {"_type":"issue","id":"foreman-dm3","title":"Use Mastra Memory APIs properly across the stack","description":"Replace custom message serialization with recall(), enable generateTitle, use Memory's native thread/message management instead of rolling our own. Fixes: GET /conversations/:id flattening messages, custom title generation in /chat endpoint, frontend proxy mangling message format.","status":"closed","priority":0,"issue_type":"bug","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-21T00:12:08Z","created_by":"HamChowderr","updated_at":"2026-04-21T00:17:31Z","closed_at":"2026-04-21T00:17:31Z","close_reason":"Implemented proper Mastra Memory patterns: generateTitle on agent config, recall() with raw messages in GET route, removed custom title gen from both /chat and /:id/messages endpoints, frontend proxy converts MastraDBMessage to UIMessage parts correctly, empty messages filtered","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-4m1","title":"EPIC: Zapier SDK MCP integration + tool architecture refactor","description":"Replace custom Zapier tools with SDK's built-in MCP server. Refactor agent tool architecture for reliability. Save SDK docs to repo.","status":"closed","priority":0,"issue_type":"epic","owner":"admin@otakusolutions.io","created_at":"2026-04-18T22:53:39Z","created_by":"HamChowderr","updated_at":"2026-04-19T00:48:03Z","closed_at":"2026-04-19T00:48:03Z","close_reason":"Epic complete. MCP server integrated (33 tools), 8 custom tools removed, 3 kept. Added: toModelOutput, requireApproval, ToolSearchProcessor, strict mode, savePerStep, prepareStep, dynamic credentials, lifecycle hooks, tool streaming, prompt rewrite. SDK docs saved to repo.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-ltn","title":"Fix generate endpoint: threadId required by observational memory","description":"POST /api/agents/foreman/generate fails with 'ObservationalMemory requires a threadId'. The Mastra built-in generate route doesn't auto-create threads. Either fix the request format or make observational memory lazy.","status":"closed","priority":0,"issue_type":"bug","owner":"admin@otakusolutions.io","created_at":"2026-04-18T04:14:36Z","created_by":"HamChowderr","updated_at":"2026-04-18T05:18:13Z","closed_at":"2026-04-18T05:18:13Z","close_reason":"Fixed earlier: title generate passes memory context (thread + resource). Verified in server test.","dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-2xdk","title":"[bump] Behavior-change verification checklist (approvalMode, auth, normalizeError, pagination, zod)","description":"Gate for the 0.48-\u003e0.69 bump (foreman-8ujc). Verify against real code: (1) 0.50 approvalMode collapse, no back-compat — Foreman leaves approvalMode unset so responses throw ZapierApprovalError; confirm handleSdkError in zapier-sdk-tools.ts still works. (2) 0.51 client-credentials auth default — CONFIRMED WORKING via probe (getProfile OK 2026-06-11); re-verify per-user PKCE path in lib/zapier/sdk.ts. (3) 0.67 normalizeError no longer wraps Error subclasses — check instanceof reliance in handleSdkError. (4) 0.69.1 pagination consume-once — check seed.ts/discovery.ts. (5) zod: SDK wants 4.3.6, repo overrides 4.4.3; npm run check:deps must pass.","acceptance_criteria":"All 5 checks verified; npm install + check:deps + build + test (mocked) + test:sdk green. Blocks foreman-8ujc.","notes":"DONE 2026-06-11. All 5 behavior checks PASS (static + 0.69.3 .d.ts inspection + a reverted trial install of 0.69.3). Full detail lives in docs/zapier-sdk-capability-map.md (Bump-verification checklist + Install mechanics). Summary: (1) approvalMode unset-\u003eserver default 'throw'-\u003eZapierApprovalError caught by handleSdkError catch-all (ZapierApprovalError extends ZapierError); follow-up filed for unsurfaced approval URL. (2) string credentials still valid (per-user PKCE path OK). (3) instanceof error handling intact; all 11 Zapier*Error classes present. (4) listApps {data,nextCursor} unchanged; zero .items() calls; consume-once-immune. (5) zod collapses to single 4.4.3 ONLY on a full clean reinstall, not incremental. Trial also discovered: a clean reinstall drifts @mastra (memory 1.17.5-\u003e1.20.2, pg 1.10.0-\u003e1.12.1) incompatible w/ pinned core@1.32.1 -\u003e 5 mocked-test failures unrelated to Zapier. Working tree restored to committed state (SDK 0.48.0, single zod, check:deps PASS, prev-failing tests 7/7 green). build+test+test:sdk-green AT 0.69.3 folded into 8ujc (can't be green without committing the bump + pinning @mastra).","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:30:12Z","created_by":"HamChowderr","updated_at":"2026-06-11T15:11:13Z","started_at":"2026-06-11T14:45:57Z","closed_at":"2026-06-11T15:11:13Z","close_reason":"All 5 behavior changes verified safe (static + 0.69.3 .d.ts + reverted trial install). check:deps proven green via clean reinstall. Install mechanics (zod clean-reinstall requirement + @mastra drift) + remaining gate-suite-green folded into foreman-8ujc; UX follow-up filed. Full record in docs/zapier-sdk-capability-map.md.","dependencies":[{"issue_id":"foreman-2xdk","depends_on_id":"foreman-8ujc","type":"discovered-from","created_at":"2026-06-11T01:30:12Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"foreman-k8iy","title":"Fix Infisical secret collision: Foreman Supabase service-key/URL resolve to BrokerBoard under --recursive","description":"In Infisical otaku-internal (e56e0da5), 'infisical run --recursive' (what Foreman's deploy + tooling use) flattens all product folders; SUPABASE_SERVICE_ROLE_KEY + NEXT_PUBLIC_SUPABASE_URL collide and resolve to BrokerBoard (ref zgplwimkoicfaiwnjigt, a different org) instead of Foreman (ihhdqzljgdnatuwzrlfm). SUPABASE_DB_PASSWORD happens to resolve to Foreman's. Verified by decoding the service-role JWT ref. Risk: if deployed Foreman reads those two keys from Infisical (not Coolify overrides), prod supabase-js service-role calls hit BrokerBoard. Fix: put Foreman's remote Supabase secrets (SERVICE_ROLE_KEY, NEXT_PUBLIC_SUPABASE_URL, SUPABASE_DB_PASSWORD) in a dedicated /foreman folder (currently only has the LOCAL 127.0.0.1 url) and inject via --path=/foreman, or namespace per-product. Discovered while seeding the remote app_catalog (foreman-5xih).","notes":"FIXED + VERIFIED 2026-06-28. Wrote Foreman's correct remote Supabase values into the /foreman Infisical folder (SUPABASE_SERVICE_ROLE_KEY pulled from supabase CLI for ref ihhdqzljgdnatuwzrlfm + verified ref before write; NEXT_PUBLIC_SUPABASE_URL + SUPABASE_URL = https://ihhdqzljgdnatuwzrlfm.supabase.co). Now BOTH 'infisical run --path=/foreman' AND 'infisical run --recursive' (what the deploy uses) resolve service_role ref=ihhdqzljgdnatuwzrlfm — /foreman wins the recursive collision over the BrokerBoard duplicates. Local dev unaffected (.env.local still overrides with local 127.0.0.1). RESIDUAL (optional hardening, not urgent): the BrokerBoard SUPABASE_* duplicates still exist elsewhere in otaku-internal and are merely out-voted by /foreman — removing/namespacing them would make it collision-proof rather than precedence-dependent. Prod still unverified (Coolify was down) — once up, confirm the container actually injects via infisical (now correct) vs a stale Coolify override.","status":"open","priority":1,"issue_type":"bug","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-28T19:37:54Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:53Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-f8jb","title":"Docs created in a workspace not visible after going into that workspace","description":"User report: 'when we go into workspaces, I cannot see the docs I created in that workspace.' Docs are stored in the per-tenant workspace filesystem keyed by workspace_id; the /documents list resolves the workspace from the auth token via resolveActiveWorkspace (default_workspace_id). Suspected root cause: switching/going-into a workspace in the UI does not update public.user.default_workspace_id on the server, so the agent server keeps reading the OLD workspace's docs (or vice-versa: docs saved under a different active workspace than the one being viewed). Recon agent dispatched to confirm the causal chain before fixing.","acceptance_criteria":"After a user goes into / switches to a workspace, the docs they created in that workspace are listed; switching workspaces changes which workspace's docs are shown.","status":"closed","priority":1,"issue_type":"bug","owner":"admin@otakusolutions.io","created_at":"2026-06-27T19:22:49Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-06-27T20:30:51Z","close_reason":"Diagnosed: NOT a backend bug — GET /documents correctly lists a workspace's docs (verified live: preview-test ws sees its 3 docs). Real issue: docs were only surfaced in the chat Knowledge side panel; the Workspaces page only DESCRIBED documents in copy, never listed them — so a user 'going into a workspace' saw nothing. Also admin's own local workspace genuinely has 0 docs (the on-disk docs belong to the preview-test test user). Fix: added a Documents card to the Workspaces page (workspaces-manager.tsx) listing the active workspace's docs (shared+private badge) with a viewer dialog (getDocument→MessageResponse); re-lists on workspace switch; shown for every active workspace. Commit pending push. web tsc + biome green.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-28cz","title":"Visibility (private|workspace|public) on chats/automations/dashboards + share-with-teammates UI","description":"Add a visibility enum (private | workspace | public) + workspace_id scoping to chats, automations, and dashboards so teammates in the same workspace can see items shared to the workspace. Replace the binary private/public VisibilitySelector with private/workspace/public. Today: chats are private-or-public-link only, automations are not teammate-visible, dashboards share only via anonymous public token.","notes":"SCOPING FINDING (post-swfe): automations + apps(artifact) are ALREADY workspace_id-scoped (automations: listForUser→resolveActiveWorkspace→listAutomations(workspaceId); apps: getArtifactWithData(workspaceId,id)). With multi-member workspaces now real (swfe), those are ALREADY teammate-visible — same as documents (5e4f). So 28cz's acceptance (teammate sees shared chat/doc/automation/dashboard) is ALREADY met for doc/automation/app. The ONLY gap is CHATS: conversation lists strictly by user_id; it HAS workspace_id but NO visibility column; the web VisibilitySelector (private|public) is a client-side template artifact with no server enforcement. CHAT-VISIBILITY DESIGN: add conversation.visibility ('private'|'workspace'|'public', default private) via migration; list = own chats (any vis) UNION teammates' workspace-vis chats in active ws; PATCH /conversations/:id {visibility} (owner only); detail+messages read allowed if owner OR (workspace member AND visibility='workspace'). Messages are created with resourceId=userId (owner-keyed), so a teammate can READ a shared thread by mastra_thread_id + access check (tractable, READ-ONLY), but COLLABORATIVE writing (teammate continuing another's thread) is HARD — Mastra memory keyed by resourceId — and is OUT OF SCOPE for 28cz. UI: 3-way selector wired to PATCH + read-only mode when viewing a teammate's shared chat. RECOMMEND: ship read-only chat sharing; defer collaborative.","status":"closed","priority":1,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-27T15:07:04Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-06-27T16:10:28Z","closed_at":"2026-06-27T16:22:30Z","close_reason":"Visibility/teammate-sharing complete. Finding: automations + apps were ALREADY workspace_id-scoped, so post-swfe they're teammate-visible like docs (5e4f) — 28cz acceptance already met for doc/automation/app. Built the one gap: CHAT visibility (private|workspace|public; 'workspace' = read-only teammate-visible). Migration 20260627000001 + conversation routes (list union, PATCH visibility owner-only, GET /:id teammate read via memory.recall by threadId, is_owner flag) + web (3-way selector Private|Team, isReadonly from is_owner, read-only banner, history passes real visibility). Verified live: owner shares→teammate lists+reads(200, is_owner:false); private stays hidden(404). Commits 8e4dfaf+3c12e12. Collaborative chat WRITING (teammate continues another's thread) deferred — Mastra memory resourceId-keyed. Public chat link (logged-out) deferred — enum supports it.","dependencies":[{"issue_id":"foreman-28cz","depends_on_id":"foreman-wl54","type":"discovered-from","created_at":"2026-06-27T08:07:03Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-5e4f","title":"Document Spaces: shared-by-default + personal (private) tier","description":"The demo's personal-vs-shared Spaces, for documents. The per-tenant workspace fs (jgme) is keyed by workspace_id, so documents/ is ALREADY shared across all workspace members. Add a PRIVATE tier visible only to the creating user. Design: logical path documents/\u003cslug\u003e.md (shared) | personal/\u003cslug\u003e.md (personal); server maps personal -\u003e physical _private/\u003ccallerUserId\u003e/documents/\u003cslug\u003e.md (never trust a client-provided uid). Generalize the path helpers (slugFromPath etc.), versions.ts, share.ts, save-document.ts, and the /documents routes to operate on logical paths + space. save_document gains a space param (default shared). GET /documents lists shared + the caller's own personal docs, tagged with space; read/versions/share/restore validate the caller can access the path. Web: KnowledgePanel shows the space; save chip + citations work for both. User decision 2026-06-27: YES include a private tier.","status":"closed","priority":1,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-27T15:06:59Z","created_by":"HamChowderr","updated_at":"2026-06-27T15:22:16Z","started_at":"2026-06-27T15:08:21Z","closed_at":"2026-06-27T15:22:16Z","close_reason":"Document Spaces shipped + verified live: SHARED (documents/, all workspace members) + PERSONAL (_private/\u003cuid\u003e/documents/, creator only). Agent save_document space param (used correctly live: 'private note' -\u003e space:personal). canAccessDocPath gates every access (own personal 200, cross-user uid 400, traversal 400). Versioning + public-sharing work across both spaces. Web: Space badge + chip. 315/315 tests, tsc+biome clean. Commits bc3fd95 (backend) + dcafec7 (web). Note: a documents browse/nav page filtered by space is foreman-aqjx scope (panel-only surface today).","dependencies":[{"issue_id":"foreman-5e4f","depends_on_id":"foreman-wl54","type":"discovered-from","created_at":"2026-06-27T08:06:59Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-swfe","title":"Membership/invite flow works end-to-end (2nd user joins a workspace)","description":"Foundation for wl54: verify and finish the workspace_invitations -\u003e workspace_members join flow so a second user can actually become a member of an existing workspace (today onboarding provisions a 1:1 workspace per user via handle_auth_user_created; workspace_members table + roles exist but the invite-\u003eaccept-\u003ejoin path may be incomplete in UI/API). Without multi-member workspaces, no teammate-visibility feature is demoable. Audit current state (routes/workspaces.ts, workspace_invitations table, web invite UI), fix gaps, verify a 2nd test user can join preview-test's workspace and resolveActiveWorkspace reflects it.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-27T15:06:54Z","created_by":"HamChowderr","updated_at":"2026-06-27T15:32:38Z","started_at":"2026-06-27T15:23:44Z","closed_at":"2026-06-27T15:32:38Z","close_reason":"Membership/invite flow verified working e2e (invite→accept→trigger creates membership→teammate sees SHARED docs, not private). Fixed the one real gap: solo workspaces couldn't be invited-into from the UI — server now flips solo→team on first invite, UI shows the invite affordance for solo-owned workspaces. Verified live. Commit pending push.","dependencies":[{"issue_id":"foreman-swfe","depends_on_id":"foreman-wl54","type":"discovered-from","created_at":"2026-06-27T08:06:54Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-wl54","title":"Team collaboration, sharing and RLS","description":"Turn the existing workspace_members/invitations/roles plumbing into real collaboration. Add a visibility model (private | workspace | public) to chats, automations, dashboards and documents; a share-with-teammates UI; and make workspace_id a real security boundary via RLS or audited app-layer guards. Audit: chats are private-or-public-link only, automations are not teammate-visible, dashboards share only via anonymous public token, and core tables have RLS enabled with NO policies (service_role scoping only).","design":"Add a visibility enum + workspace_id scoping; RLS policies via is_workspace_member(); replace the binary VisibilitySelector with private/workspace/public.","acceptance_criteria":"A teammate in the same workspace sees items shared to the workspace (chat/doc/automation/dashboard); non-members cannot; private stays private.","status":"closed","priority":1,"issue_type":"epic","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-27T02:02:24Z","created_by":"HamChowderr","updated_at":"2026-07-05T04:52:45Z","closed_at":"2026-07-05T04:52:45Z","close_reason":"DONE: collaboration epic fully shipped — membership/invite, visibility, workspace RLS (20260627 migration), Spaces, public shares; all 4 children closed.","dependencies":[{"issue_id":"foreman-wl54","depends_on_id":"foreman-2vpb","type":"discovered-from","created_at":"2026-06-26T19:02:23Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-aqjx","title":"Knowledge layer (shared brain) on Mastra Workspace","description":"Build the shared-brain knowledge layer on Mastra Workspace primitives, NOT a bespoke docs+RAG stack. Documents = files in a per-space Workspace filesystem; doc-RAG = Workspace bm25/vector search; the foreman agent ALREADY has read/write/search workspace tools (foremanWorkspace). Spaces = per-team plus personal Workspace scopes. Add a Knowledge/Spaces UI and a document editor (repurpose the existing editor page). The audit found documents/doc-RAG/doc-sharing essentially MISSING and that workspaces organize people+connections, not knowledge.","design":"Workspace.filesystem keyed by space_id via dynamic resolver (foreman-jgme): LocalFilesystem self-host, S3/AgentFS cloud. Workspace.search for retrieval. Documents are files; reuse the Workspace tools already on the foreman agent. No second RAG pipeline.","acceptance_criteria":"User creates a doc in a space; it persists; the agent can search and read it as chat context; a teammate in the same space sees it.","notes":"Slice 1 SHIPPED (commit pending): GET /documents + /documents/content over the per-tenant Workspace fs (routes/documents.ts), registered + prefix-listed. Documents = files under documents/ in the workspace; reuses foremanWorkspace.resolveFilesystem (containment verified, ../ escape blocked). tsc green + readdir/readFile probe. NEXT: (a) KnowledgePanel viewer = AI Elements Artifact primitives in the live-preview side panel (mirror PreviewPanel/use-preview-panel) + DocumentInlineChip; (b) api-client methods; (c) agent guidance to write knowledge docs under documents/; (d) Knowledge/Spaces nav. Design: NOT reviving the orphaned chatbot Artifacts framework (documents-table/ProseMirror model conflicts with Workspace-files).\nSlice 2 (VIEWER) built: save_document tool (d25a608) writes documents/\u003cslug\u003e.md to the per-tenant Workspace; web viewer = KnowledgePanel (AI Elements Artifact + MessageResponse markdown) in the SAME resizable side-panel slot as the live preview (shell.tsx: knowledge takes precedence), DocumentInlineChip in message.tsx for tool-save_document (mirrors preview_app), use-knowledge-panel store, documents-client (direct agent fetch w/ Supabase token, no proxy). web tsc + biome green; next build verifying. End-to-end loop: ask Foreman to save a doc -\u003e save_document writes file -\u003e chip in chat -\u003e opens KnowledgePanel rendering the markdown, 'just like the web preview'. REMAINING for aqjx: Knowledge/Spaces nav page (list docs) + multi-space scoping + doc-RAG surfacing in chat (Workspace.search) + sharing (ties to foreman-wl54).","status":"in_progress","priority":1,"issue_type":"epic","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-27T02:02:18Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-06-27T02:24:13Z","dependencies":[{"issue_id":"foreman-aqjx","depends_on_id":"foreman-2vpb","type":"discovered-from","created_at":"2026-06-26T19:02:17Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-2vpb","title":"Zapier Shared Brain feature parity (umbrella)","description":"Umbrella tracking epic: reach 1:1 parity with the Zapier Shared Brain product demo as its open-source equivalent. Children cover gaps found in the 2026-06-26 codebase audit. Engine SHIPPED: chat over 9000+ apps, approval-gated actions, conversational automation creation, dashboards-from-chat with real data. Missing cluster = collaborative KNOWLEDGE: documents/spaces, team sharing, shared skills, and load-back-into-chat loops. See vault PRD: Foreman Shared Brain Parity. Existing related: foreman-ltc7 (dashboards epic), foreman-jgme (per-tenant Workspace fs), foreman-vb78 (shared skills).","status":"open","priority":1,"issue_type":"epic","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-27T02:02:09Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-qdna","title":"Wire shadcn as a Mastra Agent Skill on the preview-builder","description":"User: 'add the shadcn skills to the agent, not claude code'. Mastra has a native Agent Skills system (Workspace.skills -\u003e SkillsProcessor injects metadata + skill/skill_search/skill_read tools, SKILL.md spec). The preview-builder (Haiku) writes the shadcn TSX and is where TS errors originate. Author a real shadcn SKILL.md and attach it to the builder via a skills-backed Workspace so the agent loads authoritative shadcn component rules at build time. Targets 'why are we getting so many errors'.","notes":"VERIFY: node probe against @mastra/core 1.42.0-alpha.3 — skills-only Workspace valid, skills.list() returns shadcn, skills.get('shadcn').instructions=8595 chars. npm run typecheck (agents) green. Pending live build to confirm Haiku invokes the skill tool + TS-error drop.","status":"in_progress","priority":1,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-27T01:20:55Z","created_by":"HamChowderr","updated_at":"2026-06-27T01:32:56Z","started_at":"2026-06-27T01:21:25Z","dependencies":[{"issue_id":"foreman-qdna","depends_on_id":"foreman-8nyg","type":"discovered-from","created_at":"2026-06-26T18:20:54Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-ho1c","title":"Preview generation quality + house style (no empty charts, no heavy outlines)","description":"Rework the Haiku preview-builder prompt: defined house style (clean, subtle borders, good spacing, palette — kill heavy outlined cards), HARD rule every chart has real inline data (no empty Top 5 Deal Sources / Deals by Stage), plus a cheap second self-check pass that fixes empty charts/JS errors (stand-in for the harness iterate loop).","status":"closed","priority":1,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T21:30:44Z","created_by":"HamChowderr","updated_at":"2026-06-26T21:52:32Z","started_at":"2026-06-26T21:46:07Z","closed_at":"2026-06-26T21:52:32Z","close_reason":"Reworked preview-builder house style from make-interfaces-feel-better (shadows-over-borders kills heavy outlines, tabular-nums, concentric radius, 8px spacing, text-wrap) + hard data-completeness rule + explicit Chart.js render mechanics (fixed-height canvas wrapper, DOM-ready init, pinned CDN). Verified: dashboard now renders the bar chart (was empty) and looks polished. Full reliability comes with the harness (phase 2, foreman-8nyg).","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-q4kf","title":"Preview in the side-panel artifact (open from tool result)","description":"Add a 'preview' artifact kind rendering WebPreview; when preview_app returns, open the panel client-side via setArtifact (kind:preview, content:url, isVisible:true). Leave a compact 'Live preview' chip inline that re-opens it. Uses the existing Artifact panel in shell.tsx — no new server data-stream protocol (that's a later nicety).","status":"closed","priority":1,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T21:30:36Z","created_by":"HamChowderr","updated_at":"2026-06-26T21:44:44Z","started_at":"2026-06-26T21:31:26Z","closed_at":"2026-06-26T21:44:44Z","close_reason":"Preview now opens in a docked AI Elements Artifact side panel (chat ~40% left, panel ~60% right) with a compact re-open chip inline. Verified in headed browser: dashboard renders in the panel. Zero new deps; web tsc 0, biome clean.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-qg4k","title":"Preview UX hybrid: side-panel + live build feed + generation quality","description":"User chose the hybrid path for the live-preview spike (foreman-qq4x): quick wins now, real Mastra workspace harness next. Move the preview into the existing (client-wired but server-dormant) artifact side panel, stream a build/console feed, and fix one-shot generation quality + house style. Root cause of the current rough edges (opaque 'Building live preview…', empty charts, heavy card outlines): preview_app is a single atomic Haiku call with no streaming and no verify/iterate loop.","status":"closed","priority":1,"issue_type":"epic","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T21:30:32Z","created_by":"HamChowderr","updated_at":"2026-07-05T04:52:45Z","closed_at":"2026-07-05T04:52:45Z","close_reason":"DONE: preview side-panel + live build-log feed shipped (components/chat/preview-panel.tsx; 081c450).","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-lrqy","title":"Make @foreman/agents typecheck clean (tsc --noEmit) + add CI gate","description":"tsc --noEmit currently reports 70 errors in packages/agents (about 23 in src, rest in tests). CI never caught them: the agents job runs vitest and mastra build (esbuild, transpile-only), so type errors never gated. Several look like real latent bugs (missing await on now-Promise Chat/Run APIs in webhook-server.ts/telegram/webhook.ts/routes/webhooks.ts; two missing generateZapierTools imports in discovery.ts/execution.ts). Others are dual-package type-brand mismatches (OpenAIVoice vs @mastra/core MastraVoice; hono MiddlewareHandler root vs @mastra/core copy) and supabase never-typing in zapier/sdk.ts. Fix each at the root (no blanket any), then add a typecheck CI job so they cannot regress.","acceptance_criteria":"npx tsc --noEmit -p packages/agents/tsconfig.json exits 0; no new any-casts that hide real bugs; a CI job runs the agents typecheck on PRs; biome still clean; vitest still green.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T19:50:10Z","created_by":"HamChowderr","updated_at":"2026-06-26T20:32:14Z","started_at":"2026-06-26T19:50:29Z","closed_at":"2026-06-26T20:32:14Z","close_reason":"tsc --noEmit now 0 errors project-wide (src + tests); all fixed at root cause, no workarounds. Added typecheck npm script + 'agents (tsc)' CI job. Verified: tsc 0, vitest 342 passed, biome clean on all changed files.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-25yw","title":"preview_app: Haiku builds the HTML from a brief (not Sonnet)","description":"Currently preview_app requires the Foreman agent (Sonnet 4.6) to emit a COMPLETE self-contained HTML document as the tool html argument — thousands of output tokens of HTML on the expensive model, every preview. Change the contract: preview_app takes a concise brief (plus optional data the agent already fetched via Zapier) and internally delegates HTML generation to a cheap Haiku builder agent, then serves the result via startWorkspacePreview. Sonnet orchestrates; Haiku renders. Keeps the inline live-preview UX identical.","acceptance_criteria":"preview_app inputSchema is {brief, data?, title?} with no raw html; a dedicated Haiku preview-builder agent generates the full self-contained HTML; code-fence stripping guards against markdown wrappers; generous maxOutputTokens so large dashboards do not truncate; existing WebPreview iframe render unchanged; agent src type-clean and web build green.","status":"closed","priority":1,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T19:43:28Z","created_by":"HamChowderr","updated_at":"2026-06-26T21:09:51Z","started_at":"2026-06-26T19:43:40Z","closed_at":"2026-06-26T21:09:51Z","close_reason":"Behaviorally verified e2e in browser: Sonnet called preview_app with a brief, Haiku preview-builder generated a complete Chart.js Sales Dashboard (6936 bytes), sandbox served it on :7331, official WebPreview iframe rendered it inline in chat. KPI cards + bar chart render live.","dependencies":[{"issue_id":"foreman-25yw","depends_on_id":"foreman-qq4x","type":"discovered-from","created_at":"2026-06-26T12:43:28Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-zlru","title":"Sandbox provider abstraction + FUSE-mount workspace FS into the sandbox","description":"Env-selected sandbox provider (Local/Docker/E2B/Daytona) like DEPLOY_TARGET. FUSE-mount the per-tenant workspace FS (s3fs/gcsfuse) into the sandbox so Zapier data written to the workspace appears as files automatically (sandbox.mount). Local uses symlink mount (no FUSE). Depends on the per-tenant workspace FS.","status":"open","priority":1,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T18:21:11Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:54Z","dependencies":[{"issue_id":"foreman-zlru","depends_on_id":"foreman-ltc7","type":"discovered-from","created_at":"2026-06-26T11:22:35Z","created_by":"HamChowderr","metadata":"{}"},{"issue_id":"foreman-zlru","depends_on_id":"","type":"discovered-from","created_at":"2026-06-26T11:21:11Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-jgme","title":"Per-tenant workspace filesystem (dynamic resolver keyed by workspace_id)","description":"Replace the single shared ./data/workspace (multi-tenant collision/privacy bug) with the Mastra dynamic filesystem resolver keyed by workspace_id from RequestContext. Provider env-selected mirroring DEPLOY_TARGET: self-host = LocalFilesystem + mounted volume; cloud = S3Filesystem (R2, free egress) or Supabase/Daytona. Prerequisite for BOTH sandbox-mounting data in AND team-shared skills (foreman-vb78).","notes":"Prerequisite for foreman-aqjx (Knowledge layer on Mastra Workspace) in the Shared Brain parity umbrella foreman-2vpb.\nSelf-host increment DONE (commit pending hash): dynamic filesystem+sandbox resolvers in mastra/agents/workspace.ts keyed by workspace_id (RequestContext on web; ALS userId-\u003eresolveActiveWorkspace on channels; _shared fallback). tsc green + resolver probe verified per-workspace dirs. REMAINING: optional cloud S3/AgentFS provider keyed off DEPLOY_TARGET (LocalFilesystem+volume is the Coolify production path). Unblocks foreman-aqjx (knowledge layer) for self-host.","status":"closed","priority":1,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T18:21:05Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-06-27T02:08:52Z","closed_at":"2026-06-28T07:01:03Z","close_reason":"Per-tenant workspace fs resolver shipped: workspace.ts resolveWorkspaceDir() keys LocalFilesystem/LocalSandbox by workspaceId from RequestContext (falls back to active workspace, then _shared). Multi-tenant ./data/workspace collision/privacy bug fixed; path traversal sanitized + contained. Cloud S3/AgentFS provider split to follow-up.","dependencies":[{"issue_id":"foreman-jgme","depends_on_id":"foreman-ltc7","type":"discovered-from","created_at":"2026-06-26T11:22:28Z","created_by":"HamChowderr","metadata":"{}"},{"issue_id":"foreman-jgme","depends_on_id":"","type":"discovered-from","created_at":"2026-06-26T11:21:05Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-qq4x","title":"Spike: LocalSandbox e2e smoke — mount, write file, spawn server, view","description":"Prove the untested LocalSandbox already wired in foreman.ts. Mount a LocalFilesystem (symlink, no FUSE), agent writes a JSON file, processes.spawn a tiny node/Vite server that renders it, reach it on localhost PORT. Zero cost, no new deps. Surface Windows quirks. Output: a working smoke plus notes on what is real vs painful before picking a cloud provider.","notes":"GOTCHA: the Mastra dev bundler externalized a NEW @/lib/preview/serve import (ERR_MODULE_NOT_FOUND @/lib) and crashed the server on reload, even though existing @/lib/* imports (create-dashboard) bundle fine. Fixed by using RELATIVE imports in the new agent files. Use relative imports for new cross-dir agent imports. Server now boots clean; preview_app tool registered. PENDING LIVE TEST.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T18:20:59Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-06-26T18:36:56Z","closed_at":"2026-06-26T21:10:00Z","close_reason":"Spike PROVEN end-to-end: agent builds in the LocalSandbox (write file + spawn surviving static server on :7331) and it shows live inline via the AI Elements WebPreview iframe. Verified in-browser with a throwaway local user — Haiku-built Sales Dashboard rendered (Total Revenue $2.85M, 143 Deals Won, Monthly Revenue bar chart). FUSE mount + per-tenant + cloud provider tracked separately under epic foreman-ltc7.","dependencies":[{"issue_id":"foreman-qq4x","depends_on_id":"foreman-ltc7","type":"discovered-from","created_at":"2026-06-26T11:22:22Z","created_by":"HamChowderr","metadata":"{}"},{"issue_id":"foreman-qq4x","depends_on_id":"","type":"discovered-from","created_at":"2026-06-26T11:20:58Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-ltc7","title":"Sandbox-built live dashboards/apps from Zapier data","description":"Use the Mastra workspace + sandbox so the agent can build CODE-DRIVEN custom live dashboards/apps from real Zapier data and embed them in Foreman (the v0/bolt.new pattern), beyond the constrained DashboardSpec. Data-in: per-tenant workspace FS (S3/R2 or local volume) FUSE-mounted into the sandbox so agent-written Zapier JSON appears as files. Build: sandbox spawns a real server via processes.spawn. Embed: expose the server port then preview URL then iframe in Foreman. Providers: Local (dev, already wired, untested) then Docker (self-host isolation) then E2B/Daytona (hosted, public preview URLs). Per-session cost ~1 cent; cost driver = provider base fee. Builder-ICP differentiator. Discuss before building.","status":"open","priority":1,"issue_type":"epic","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T18:20:50Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","dependency_count":0,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"foreman-n5gq","title":"Redesign Automations + Dashboards pages + add Inbox page on a shared app nav","description":"The app pages are inconsistent and half-built: Automations has NO header (bare main + a back-link to the marketing homepage), Dashboards uses a minimal BrandHeader with no cross-section nav and hardcoded inline colors, and there is no Inbox page. Build a shared AppNav (Zapier logo + Chat/Automations/Inbox/Dashboards tabs w/ active state) used by every app section; restructure Automations + Dashboards onto it with polished empty states + theme tokens; add a dedicated /inbox trigger-inbox page. User-reported: 'header is completely removed, I can't go back, things missing.'","status":"closed","priority":1,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T12:29:37Z","created_by":"HamChowderr","updated_at":"2026-07-05T03:26:25Z","closed_at":"2026-07-05T03:26:25Z","close_reason":"Shipped across 6 commits (b3bc323 shared app nav + restructured Automations/Dashboards + new Inbox; ffafb8c aggregate inbox endpoint; d6ae7cb unified sidebar shell). Pages + app-shell/app-sidebar verified present.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-usoj","title":"[db] Missing service_role GRANT on public.\"user\" (+ audit all tables) — breaks auth/workspace resolution on migration up","description":"Discovered during the j3um /automations live verify: PostgREST returns 42501 'permission denied for table user' for service_role. resolveActiveWorkspace/ensureUserExists/resolveFromApiKey all read public.\"user\" via getSupabase() (service_role), so without the grant they silently return null → empty automations, no workspace, broken auth resolution. Migrations grant service_role on automation/automation_run (f1cd64a), user_roles, and functions, but NEVER on public.\"user\" itself (only a REVOKE...FROM anon in 20260428000000_revoke_anon_grants.sql). No blanket 'ALL TABLES IN SCHEMA' / DEFAULT PRIVILEGES grant exists. Same class as f1cd64a: a fresh 'db reset' masks it via Supabase base default-privileges, but a production 'supabase migration up' would fail with permission denied. CI can't catch it (db:types uses direct introspection; agent tests are mocked). FIX: add 'GRANT ALL ON TABLE public.\"user\" TO service_role;' (new migration, don't edit applied ones) AND audit EVERY public table the service-role client touches (conversation, action_proposal, action_run, channel_identity, api_key, capability_flag, workspaces, workspace_members, user_settings, zapier_identity, artifact, dashboard_*, etc.) for the same missing grant — likely several. Locally unblocked the verify with a manual GRANT ALL on user + user_settings.","status":"closed","priority":1,"issue_type":"bug","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T06:48:21Z","created_by":"HamChowderr","updated_at":"2026-06-26T07:29:39Z","started_at":"2026-06-26T07:18:29Z","closed_at":"2026-06-26T07:29:39Z","close_reason":"Fixed via migration 20260626000001_service_role_grants.sql — GRANT ALL on all public tables/sequences + EXECUTE on functions to service_role, plus ALTER DEFAULT PRIVILEGES for future migration tables. Verified: (1) reproduced 42501 on zapier_identity, applied migration → read returns []; (2) audit went 20/27 missing → 0 missing; (3) npx supabase db reset applies it in-sequence cleanly; (4) db:types:check green on clean reset (grants don't change gen-types output — the earlier diff was the running server's runtime mastra_* tables polluting the dirty local DB, NOT my migration). RLS untouched (anon/authenticated boundary intact); purely additive for service_role.","dependencies":[{"issue_id":"foreman-usoj","depends_on_id":"foreman-j3um","type":"discovered-from","created_at":"2026-06-25T23:48:20Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-j3um","title":"[durable][web] Live run-status polling + run output/error drill-down on /automations","description":"M4 shipped /automations as load-once. Two gaps make it not-yet-useful: (1) no live status — a run recorded 'started' only advances to finished/failed in the DB via the reconcile worker, but the page never re-fetches, so the user must manually reload to see it land. (2) no run detail — the agent route already returns output/error per run (store.listRuns selects *), but the web AutomationRun type drops them and the Runs table shows only When/Status/Durable-run, so a finished run's result and a failed run's error are invisible. Fix is web-only (no route change): add output/error to the web type, make each terminal run row expandable to show its result/error JSON, and client-poll getAutomation (~3.5s, DB-cheap) for the selected automation while it has any non-terminal run, stopping when all runs are terminal. Honors the locked frontend decisions: no form, polling (SDK has no run-status stream).","notes":"Shipped 8466912. Implementation complete + verified via next build (web typecheck) + biome clean. Web-only: added output/error/updated_at to AutomationRun type; terminal run rows expand to show output/error JSON; client-polls getAutomation ~3.5s while any run non-terminal, stops when all terminal; in-place refresh + 'Live — updating…' hint. NOT yet live-UI-verified — dev stack was down at commit time. Next: bring stack up for a browser walkthrough (watch a Run-now advance started→finished live + expand its output) before closing.","status":"closed","priority":1,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T06:07:25Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-06-26T06:07:40Z","closed_at":"2026-06-26T06:56:35Z","close_reason":"Shipped 8466912 + LIVE-verified end-to-end. Seeded a local user/workspace/automation + 3 runs; logged into the real web app at /automations and confirmed: (1) runs render with correct status badges; (2) terminal rows expand to Output (finished) / Error (failed) JSON, in-flight 'started' row not expandable; (3) live poll — flipped started→finished in Postgres and the row advanced in-place ~4s with NO reload, and the 'Live — updating…' indicator activated while pending then disappeared when terminal. Build + biome were already green.","dependencies":[{"issue_id":"foreman-j3um","depends_on_id":"foreman-l7xq","type":"discovered-from","created_at":"2026-06-25T23:07:25Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-hnbx","title":"[durable] Live smoke test: drive lib/durable + lib/trigger-inbox against real Zapier","description":"The M1-M4 rebuild is unit-verified (mocked SDK) + build/tsc/biome green, but NOT exercised against live Zapier in the Foreman integration. Close the gap: a standalone script (scripts/durable-smoke.ts) that builds the REAL experimental SDK via CLI login and runs Foreman's own lib functions end-to-end — Tier1 ephemeral runDurable (echo), Tier2 deploy+trigger+poll+delete, Tier3 ensureInbox+lease reachability. No-connection echo durable (no app side effects), private, self-cleaning. Auth = cached CLI login (admin@otakusolutions.io); re-login if 401.","acceptance_criteria":"Tier1 run finishes; Tier2 deploy→trigger→durable run links + cleans up; Tier3 inbox API reachable; account left clean (listWorkflows back to prior count).","notes":"CONNECTED-LOOP TEST PREP (2026-06-26): probed live account — 14 connections: GitHub, Slack(@admin Otaku Solutions), Discord, Todoist, HubSpot, Airtable x2, GoogleSheets/Docs/Calendar/Gmail, AITable, Skool, + a custom App242053. Webhooks by Zapier = WebHookCLIAPI@1.1.1, triggers hook_v2 'Catch Hook'/hook_raw/poll_v4. FINDING: trigger-inbox SUPPORTS Catch Hook (instant, NO connection) — ensureTriggerInbox({app:'webhook',action:'hook_v2',inputs:{_zap_static_hook_code:'...'}}) goes initializing→active immediately (no 7-min poll wait; that penalty is POLLING-trigger-only). BUT the inbox object does NOT expose the catch ingest URL. Derived classic URL hooks.zapier.com/hooks/catch/\u003cid\u003e/\u003ccode\u003e/ with the PROFILE id (UUID 012c8c5b…, not a numeric account id) → POST 200 but message did NOT land in lease within 12s. So either wrong account segment (needs numeric account id) or inboxes ingest webhooks via a different path. NOT resolved — stopped to avoid rabbit-holing. NEXT: get the real ingest URL from the Zapier durables-editor UI for the inbox, OR use Slack (connected, instant REST-hook) as the test trigger. Probe scripts (uncommitted): scripts/probe-connections.ts, scripts/probe-webhook-inbox.ts.\nSOLVED 2026-06-26: instant webhook delivery into a trigger-inbox PROVEN. Recipe — ensureTriggerInbox({app:'webhook',action:'hook_v2',inputs:{_zap_static_hook_code:'\u003ccode\u003e'}}) arms instantly; POST to https://hooks.zapier.com/hooks/catch/16517571/\u003ccode\u003e/ (NUMERIC account id 16517571, NOT the profile UUID 012c8c5b…) → message lands in lease in ~5 SECONDS with exact payload. So the inbox event path is instant + fully controllable, no connection, no 7-min poll. This is the test substrate for the full connected loop. Probe: scripts/probe-webhook-inbox.ts.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T04:37:32Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-06-26T04:38:38Z","closed_at":"2026-06-26T05:18:18Z","close_reason":"FULL LOOP PROVEN end-to-end (2026-06-26). Built scripts/durable-loop-smoke.ts: deploy durable (live) → persist automation w/ webhook inbox trigger (real Postgres) → worker cycle 1 arms inbox → POST event to hooks.zapier.com/hooks/catch/16517571/\u003ccode\u003e/ → worker cycle 2 (4s later) processed=1: leased → claimInboxMessage (REAL Postgres dedup insert) → triggerAutomation fired the durable → recorded automation_run (inbox_message_id + trigger_id) → acked → cleaned up. So event→inbox→worker→durable + real-Postgres claim/record is PROVEN on live infra, ~4s not 7min. Found+fixed a real bug: migration lacked GRANT ... TO service_role on automation/automation_run (CI db reset masked it via default privileges; migration up failed 'permission denied'); added explicit grants + applied to local. Follow-up filed for worker run-status reconcile (records 'started' at trigger time, doesn't poll to terminal). Harness scripts committed (durable-loop-smoke, probe-connections, probe-webhook-inbox).","dependencies":[{"issue_id":"foreman-hnbx","depends_on_id":"foreman-l7xq","type":"discovered-from","created_at":"2026-06-25T21:37:32Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-l23t","title":"[durable] M2: automations + runs schema (workspace-scoped) + agent routes","description":"Persistence + HTTP surface for automations (parent foreman-l7xq; builds on M1 lib). SCOPE: (1) migration adding workspace-scoped tables (UUID + FK workspaces ON DELETE SET NULL, matching the multi-tenant standard) — automation (id, workspace_id, name, trigger spec app/action/connection/inputs, durable source, zapier workflow_id + version, status) and automation_run (id, automation_id, inbox_message_id, durable_run_id, status, timestamps). Workspace-scoped = SHARED per 'shared resources, private chats'. (2) regenerate database.types.ts (npm run db:types, --workdir ../..). (3) agent routes (Hono, mounted in routes/index.ts + CUSTOM_ROUTE_PREFIXES in mastra/index.ts): CRUD automations + list runs, service_role + membership checks like the workspaces routes. (4) schema.ts interfaces.","acceptance_criteria":"migration applies via supabase db reset; db:types:check clean; routes covered by mocked integration tests; biome+tsc green.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T02:30:39Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-06-26T03:07:17Z","closed_at":"2026-06-26T03:26:07Z","close_reason":"M2 shipped: workspace-scoped automation persistence + agent routes. (1) Migration 20260626000000_automations.sql: automation + automation_run tables (text ids, user_id text, workspace_id uuid FK ON DELETE SET NULL, jsonb payloads, RLS enabled no-policy + revoke anon — matching artifact). automation_run has UNIQUE(automation_id, inbox_message_id) so the M3 inbox worker's dedup is a DB constraint. database.types.ts regenerated (db:types:check green). (2) lib/automations/store.ts: workspace-scoped CRUD + recordRun/listRuns/updateRun + claimInboxMessage (idempotent insert, 23505→null) + getAutomationByZapierWorkflowId (M3 reverse lookup). (3) lib/automations/service.ts: provisionAutomation (deploy via M1 + persist, status mapping incl. trigger_claim_failed), runAutomationById, list/inspectForUser, updateAutomationForUser (syncs enabled to Zapier via new setAutomationEnabled), removeAutomationForUser (row + best-effort Zapier delete). (4) routes/automations.ts: GET/POST / + GET/PATCH/DELETE/:id + POST /:id/run, authMiddleware, registered in routes/index.ts + CUSTOM_ROUTE_PREFIXES. (5) M1 agent tools repointed to the service (create persists; run/list/inspect keyed by Foreman automation id, workspace-shared). Gates: vitest 330 pass/0 fail (14 new across 2 suites), biome clean, tsc clean on all M2 files, db:types:check green. Unblocks M3 (37e6) + M4 (ut8n).","dependencies":[{"issue_id":"foreman-l23t","depends_on_id":"foreman-cjg5","type":"blocks","created_at":"2026-06-25T19:31:11Z","created_by":"HamChowderr","metadata":"{}"},{"issue_id":"foreman-l23t","depends_on_id":"foreman-l7xq","type":"discovered-from","created_at":"2026-06-25T19:30:39Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":2,"comment_count":0}
+{"_type":"issue","id":"foreman-cjg5","title":"[durable] M1: durable + trigger-inbox lib layer + agent authoring tools","description":"Foundation for the durable/inbox rebuild (parent foreman-l7xq). Build the SDK-experimental client + the two lib layers every later milestone calls into, plus the agent's authoring tools. SCOPE: (1) experimental SDK client — getSdkForUser currently builds from the STABLE '@zapier/zapier-sdk' import; add a path that builds from '@zapier/zapier-sdk/experimental' so durable + trigger-inbox methods are available, reusing the same per-user token/connection-alias resolution. (2) lib/durable/ — deployWorkflow (createWorkflow + publishWorkflowVersion with aged-pin deps as call args + connections + optional trigger), runWorkflow (triggerWorkflow/runDurable), getRun. Author the durable source per the workflows-create SKILL format (defineDurable + export default, one runAction per ctx.step, normalizeInput). (3) lib/trigger-inbox/ — ensureInbox, lease, ack/release, and a dispatch helper that dedups on lease_count/possible_duplicate_data. (4) agent tools (createTool, registered via ToolSearchProcessor like connect_zapier/search_history): create_automation (NL intent -\u003e durable source -\u003e deploy + ensure inbox), run_automation, list_automations, inspect_automation. NO schema/migration and NO web in M1 — keep it pure lib + tools, mocked-SDK unit tested.","acceptance_criteria":"lib/durable + lib/trigger-inbox functions covered by vitest against a mocked @zapier/zapier-sdk/experimental; the 4 agent tools registered and discoverable; biome lint + tsc typecheck green; no @mastra dep-uniqueness break.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T02:30:32Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-06-26T02:32:04Z","closed_at":"2026-06-26T03:00:27Z","close_reason":"M1 shipped: durable + trigger-inbox lib layer + agent authoring tools, all on the experimental SDK. (1) sdk.ts refactored to share one token/connection-resolution path via buildSdkForUser; added getExperimentalSdkForUser building from '@zapier/zapier-sdk/experimental' (durable + trigger-inbox surface), cached separately from the stable client. (2) lib/durable/: deps (aged-pin constants), types, source generator (buildDurableSource per the SKILL format), deploy (deployAutomation=create+publish with silent-trigger-claim verification, runAutomationOnce, triggerAutomation, get*RunStatus, list/inspect/delete). (3) lib/trigger-inbox/: ensure/get/lease/ack/release + dispatchLeased (dedup on message id, honors lease_count/possible_duplicate_data; classifies processed/skipped/failed, caller acks+releases). (4) 4 createTool tools wired into foreman.ts: create_automation + run_automation (requireApproval), list_automations + inspect_automation (read). No Foreman schema — Zapier listWorkflows/getWorkflow IS the store for M1; M2 (l23t) adds workspace-scoped persistence + run history. Gates: vitest 316 pass/0 fail (20 new across 4 suites), biome clean (0 new errors), tsc clean on all new files. Unblocks M2.","dependencies":[{"issue_id":"foreman-cjg5","depends_on_id":"foreman-l7xq","type":"discovered-from","created_at":"2026-06-25T19:30:31Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":2,"comment_count":0}
+{"_type":"issue","id":"foreman-c24s","title":"Workspace management web UI (multi-tenant step 5)","description":"Step 5 of foreman-qhbp multi-tenant build. Backend (steps 3+4) is DONE: stored_agent + dashboards are workspace-scoped (b572cc9/173df5c), and getSdkForUser honors workspace_settings.zapier_connection_mode (member-first default, 96e1172). The web app has NO workspace UI (NextBase's was not carried over), so this is a from-scratch build + backing API routes. SCOPE: (1) Workspace switcher — list the principal's workspaces, set active via user.default_workspace_id. (2) Member management — list members, invite (workspace_invitations), roles (workspace_member_role_type owner/admin/member). (3) Shared Zapier connection — designate a connection by tagging zapier_identity.workspace_id; admin UI to set workspace_settings.zapier_connection_mode (member-first|shared|personal). (4) API routes in packages/agents/src/routes for all the above (workspace CRUD/switch, members/invites, connection-mode + shared-connection designation). RLS/policies for workspace_members/workspace_invitations already exist from NextBase. NOTE: connection_alias stays user-scoped (private); shared-connection manifest/alias resolution for borrowed connections is a known follow-up (loadUserConnectionsMap currently loads the requesting user's aliases).","notes":"APPROACH (refined 2026-06-25): NOT from-scratch — PORT NextBase's workspace UI + server actions, restyled to Foreman's design system. Workspace tables + RLS + enums are identical (kept from NextBase), and Foreman web users ARE Supabase-auth users (public.user.id == auth.users.id == user_profiles.id), so NextBase's RLS-enforced server actions port cleanly.\n\nSOURCE ROOT = C:\\Users\\HamCh\\code\\nextbase-ultimate\\apps\\web\\src\\\n\nPORT (relevant subset):\n- Data layer (server actions, RLS via @supabase/ssr user session): data/user/workspaces.ts (create/get/set-default), data/user/invitation.tsx (accept/decline), data/admin/workspaces.ts, rsc-data/user/workspaces.ts (RSC fetchers).\n- Components under components/workspaces/settings/: members/{invite-user, team-members-table, team-invitations-table, edit-member-role-dialog, remove-member-provider, revoke-invitation-provider, leave-workspace-dialog, workspace-members}; workspace-settings, edit-workspace-form, delete-workspace; set-default-workspace-button + set-default-workspace-preference = the ACTIVE-WORKSPACE SWITCHER; workspace-layout, workspace-page-heading (shell).\n- Pages under app/(dynamic-pages)/(authenticated-pages)/: workspace/[workspaceSlug]/settings/page.tsx + settings/members/page.tsx; user/invitations/page.tsx + [invitationId]/page.tsx (+ pending-invitations-list, invitation-content).\n\nADAPT / CAVEATS:\n- Active-workspace pointer: NextBase writes user_settings.default_workspace; Foreman resolveActiveWorkspace reads user.default_workspace_id (backfilled from user_settings). Ported switcher should write user.default_workspace_id (Foreman pointer).\n- Members/invites are auth-user-only (workspace_members FK user_profiles). Channel-only principals are solo, join via channel_link_code — out of scope for members UI.\n- DROP from port: projects/* (no NextBase project sub-entity in Foreman), graphs/*, billing/* (separate concern).\n- Restyle to Foreman design system (components/ui, Tailwind) — do not copy NextBase styling wholesale.\n\nNET-NEW (Foreman-specific, no NextBase equivalent): connection-mode admin control (set workspace_settings.zapier_connection_mode member-first|shared|personal) + shared-connection picker (designate a zapier_identity by tagging zapier_identity.workspace_id). These go through the Hono agent server (packages/agents, touches Zapier identity/crypto); everything else = Next.js server actions in packages/web.\n\nARCH: workspace CRUD/members/invites = Next.js server actions in packages/web (RLS-enforced, matches NextBase). Hono agent-server routes only for the Zapier-connection bits.","status":"closed","priority":1,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-25T21:47:41Z","created_by":"HamChowderr","updated_at":"2026-06-26T02:10:21Z","started_at":"2026-06-26T01:31:54Z","closed_at":"2026-06-26T02:10:21Z","close_reason":"Workspace management UI shipped: sidebar switcher (list/switch/create) + /workspaces manager — members (role change/remove/leave), invitations (invite by email+role/revoke + invitee accept/decline), Zapier connection-mode picker, and shared-connection designation. Backed by agent /workspaces routes (8e5c31c) + web server actions (4a60bcb,a8f9256). Built via the web-\u003eagent service_role pattern to bypass the web client's RLS limits. next build + vitest 296 + biome all green.","dependencies":[{"issue_id":"foreman-c24s","depends_on_id":"foreman-qhbp","type":"discovered-from","created_at":"2026-06-25T14:47:41Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-qhbp","title":"Migrations cleanup + identity/tenancy unification onto the workspace multi-tenant model","description":"Owner direction 2026-06-25: clean + properly multi-tenant DB, migrations grouped one file per domain, no DROP migrations (re-baseline at source; zero prod users). KEY FINDING: Foreman straddles TWO identity models — (1) a Supabase-auth world (auth.users -\u003e user_profiles UUID, workspaces, user_roles, RLS) mostly INERT, and (2) legacy Better-Auth public.user (TEXT id) that ALL Foreman code uses; migration ...018 bolted UUID workspace_id onto the text-user tables. GOAL: wire Foreman runtime tables into the existing workspace multi-tenant model, decompose foreman_core monolith into per-domain migrations, prune dead boilerplate by code-usage, design durable/trigger-inbox tables for the Zapier SDK surface. Channel users have no Supabase auth account -\u003e web principal id already == auth.users id; channel principals standalone, bridged via channel_link_code. Multi-tenant is a MUST (single person OR org/team). Plan: docs/schema-and-identity-cleanup.md. Phase1 (workflow removal) 82b24fb; Phase2a (decompose+CMS cut) fa51547/67a4b25.","notes":"Phase 2a DONE: (1) decomposed foreman_core monolith -\u003e 7 nextbase-style domain migrations (fa51547; schema byte-identical, db:types:check empty diff). (2) Cut dead nextbase marketing/feedback CMS — 6 migrations + orphaned enums (67a4b25); billing + full workspace multi-tenant model KEPT; vitest 296 green. NEXT: Phase 2b multi-tenant wiring (workspace_id on remaining runtime tables, resolve+thread workspace_id through identity/middleware/RequestContext, scope reads/writes, solo workspace for channel principals). Plan: docs/schema-and-identity-cleanup.md. Consider running supabase-postgres-best-practices agent-skill to audit RLS/indexes/FKs before 2b.\nPhase 2b hardening DONE (from supabase-postgres-best-practices audit): (1) covering indexes for all 19 unindexed FKs (cff4687); (2) RLS enabled on 11 remaining service-role tables -\u003e uniform RLS coverage (just committed). Both: db reset + db:types:check green. REMAINING 2b = tenancy resolution/scoping (the behavior change): add workspace_id to stored_agent/api_key/capability_flag/channel_link_code/connection_alias, resolve+thread active workspace_id, scope ~20 read sites, channel-user solo workspace. DESIGN FORK to confirm: how channel-only users (no auth.users/user_profiles) map to workspaces.\nPhase 2b steps 1-2 DONE: schema foundation (44be9bd), identity resolution layer (7a32d7b), workspaceId threading (a0fc24e). Scoping model CONFIRMED by owner = 'shared resources, private chats': workspace-scope stored_agent + dashboards (artifact/app_data_snapshot/dashboard_share); workspace-aware connections (zapier_identity/connection_alias, member-first default); KEEP user-scoped: conversation (private chats, no change), api_key, capability_flag, channel_identity, channel_link_code. REMAINING: step3 scope stored_agent+dashboards, step4 connection-mode (workspace_settings.zapier_connection_mode), step5 web UI (switcher/invites/roles/shared-connection picker). Full plan in session note + docs/schema-and-identity-cleanup.md.","status":"closed","priority":1,"issue_type":"epic","owner":"admin@otakusolutions.io","created_at":"2026-06-25T19:14:52Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-06-26T02:10:26Z","close_reason":"Multi-tenant epic complete (steps 3-5): stored_agent + dashboards workspace-scoped (b572cc9/173df5c), workspace Zapier connection-mode resolution (96e1172), workspace management API + UI (8e5c31c/4a60bcb/a8f9256). Migrations decomposed + dead CMS cut + workspace_id wiring done earlier (fa51547/67a4b25/44be9bd). Durable/trigger-inbox table design moved to the durable rebuild foreman-l7xq.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-bazc","title":"[durable] Remove the hand-rolled workflow engine; wait for Zapier durable API","description":"DECISION REVERSAL (supersedes foreman-98j3, resolves foreman-iyq6): owner does NOT want to hand-roll workflow persistence. Stop hand-rolling the runtime; keep the wiring that makes it multi-channel. Owner accepts NO workflow capability in the interim (durable EA pending, foreman-13mw).\n\nREMOVE (Zapier durable replaces 1:1):\n- lib/workflows/engine.ts (execute loop) + params.ts; workflow/workflow_step/workflow_run tables (add a NEW drop migration, don't edit applied ones); the frozen-action-tuple model.\n- Hand-written run/save/update/delete/get/list-workflows tools — these are SDK methods in the EXPERIMENTAL registry (walled now); regenerate from getRegistry when EA lands, don't hand-write.\n- poll-driver's polling-against-read-actions (replaced by trigger-inboxes, below).\n- 6 workflow test files for the removed engine/tools; 'save as workflow' instructions in prompt-template.ts + foreman.ts; datasets-label.ts eval trajectories that pin removed tools.\n\nKEEP \u0026 REPURPOSE (integration seam the SDK won't provide):\n- Driver/trigger FRAMEWORK (cron-driver-server.ts, driver lifecycle, attach/detach-trigger, workflow_trigger) — repoint: event source -\u003e Zapier trigger-inboxes (watchTriggerInbox, unwalled, available NOW), firing target -\u003e runDurable. This is the foreman-bdjp/ueep spike, now with a purpose.\n- channel-trigger.ts + mastra/signals/channel-trigger-provider.ts — multi-channel 'fire on Slack/Discord message', Foreman-unique. Keep.\n- /workflows UI page + SSE run-streaming plumbing — keep shell, repoint data to listWorkflows/getDurableRun.\n- save.ts capture concept -\u003e repurpose as a ./define authoring front-end (generate a durable workflow from captured conversation steps) instead of freezing tuples.\n\nOUT OF SCOPE (stays regardless, not workflow-specific): channels + webhook ingestion; approval/proposal flow (action_proposal used for EVERY action); per-user zapier_identity/connections.\n\nSTAGING: (1) gut engine+tables+CRUD tools + tests + prompt/eval refs NOW (verify suite+lint green); (2) keep the driver framework, channel-triggers, UI shell; (3) when durable EA lands: repoint UI + driver firing-target to runDurable, migrate poll-driver -\u003e trigger-inbox. Phase 1 (remove) is not blocked; phases 2-3 gated on foreman-13mw.","notes":"DECISION (clean sweep, owner-confirmed 2026-06-25): Phase 1 removes the ENTIRE hand-rolled workflow+trigger subsystem, NOT the keep/remove split. Remove: engine/params/save, all 9 workflow+trigger agent tools (incl attach/detach-trigger), routes/workflows.ts, cron-driver/poll-driver/channel-trigger + cron-driver-server, both signal providers (channel-trigger-provider, zapier-poll-provider), workflow/workflow_step/workflow_run/workflow_trigger tables (all 4), web /workflows UI + workflows-client + landing workflow section, ~10 test files, prompt/eval refs, channel-trigger call sites in 8 bots + webhook-server. KEEP: webhook-handler.ts (Mastra-native createWorkflow, unrelated). Triggers rebuilt fresh on durable+trigger-inboxes when EA lands (foreman-13mw).\nPhase 1 COMPLETE (clean sweep, AT-SOURCE per owner — NO drop migration). Workflow engine removed from code AND schema: tables stripped from foreman_core.sql + rls.sql + revoke_anon_grants.sql at source; deleted workflow_trigger.sql + workflow_run_observability.sql. db reset + db:types:check green. Gates: vitest 296 pass, biome clean, web next build, types check all green.","status":"closed","priority":1,"issue_type":"epic","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-25T18:00:30Z","created_by":"HamChowderr","updated_at":"2026-07-05T04:52:45Z","closed_at":"2026-07-05T04:52:45Z","close_reason":"DONE (code-verified): 82b24fb removed hand-rolled engine; replaced by lib/durable/ + lib/automations/; durable early-access live (b6d0db5), full loop proven (bf0468d/f1cd64a).","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-dwq9","title":"Tool gap: open-object params nested in arrays aren't coerced (table records/fields)","description":"Models emit open-bag params (dynamic keys, additionalProperties) as JSON strings. Mastra's built-in coerceStringifiedJsonValues only fixes TOP-LEVEL bags, not ones nested inside an array — so create-table-records.records[].data, update-table-records.records[].data, and create-table-fields.fields[].options/config fail validation ('Tool input validation failed') and the model retries (haiku errors out; sonnet reasons-through-it). NOT model-specific. Fix: SCHEMA_OVERRIDES in zapier-sdk-tools.ts rebuild those 3 tools' input schemas in our own zod with a field-level string-\u003eobject preprocess (jsonObjectParam) so the coercion runs during Mastra's ~standard validation (a wrapper around the SDK's foreign-zod schema gets bypassed). Verified through ~standard.validate + live on haiku: no errors, clean build. Top-level bags (runAction.inputs etc.) already handled by Mastra.","design":"Rebuild only the 3 affected tools' schemas in root zod; model-facing schema stays 'object'; if new nested-bag tools appear, add to SCHEMA_OVERRIDES.","status":"closed","priority":1,"issue_type":"bug","owner":"admin@otakusolutions.io","created_at":"2026-06-20T21:56:07Z","created_by":"HamChowderr","updated_at":"2026-06-20T21:56:31Z","closed_at":"2026-06-20T21:56:31Z","close_reason":"Fixed + verified. SCHEMA_OVERRIDES rebuild create-table-records/update-table-records/create-table-fields input schemas in our zod with jsonObjectParam (field-level string-\u003eobject coercion). Confirmed through ~standard.validate AND live on haiku: stringified row data coerced, no validation errors, clean build. Top-level bags already handled by Mastra's built-in coercion.","dependencies":[{"issue_id":"foreman-dwq9","depends_on_id":"foreman-xfof","type":"discovered-from","created_at":"2026-06-20T14:56:06Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-l7nj","title":"Tool-approval action buttons (chat/message.tsx) -\u003e ui/Button","description":"The Approve / Decline / Always-Allow tool-approval controls (chat/message.tsx ~L55-86) are raw \u003cbutton\u003es — the app's most consequential interaction, missing design-system focus/disabled states. Swap to ui/button.tsx (destructive/ghost/default variants).","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-20T05:11:46Z","created_by":"HamChowderr","updated_at":"2026-06-20T05:35:56Z","closed_at":"2026-06-20T05:35:56Z","close_reason":"Done via 9 parallel area-agents; verified biome+tsc+next build all green (commit d34f451). NOTE: ltnn slash-commands took the conservative roles-only cmdk adoption (correct ARIA roles + selection) to preserve the composer's keyboard-nav contract; SuggestionDialog fully on ui/dialog. Also fixed a pre-existing build-breaker in model-selector-compact (467d43c).","dependencies":[{"issue_id":"foreman-l7nj","depends_on_id":"foreman-to5b","type":"discovered-from","created_at":"2026-06-19T22:11:46Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-d6v9","title":"Replace native window.confirm() with ui/AlertDialog for destructive workflow actions","description":"Two destructive actions use blocking, unstyled, untestable native confirm(): workflows/trigger-controls.tsx (~L39 detach) and workflows/workflow-detail-actions.tsx (~L67 delete 'cannot be undone'). Swap to ui/alert-dialog.tsx. Highest-value fix — destructive + a11y + testability.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-20T05:11:41Z","created_by":"HamChowderr","updated_at":"2026-06-20T05:35:56Z","closed_at":"2026-06-20T05:35:56Z","close_reason":"Done via 9 parallel area-agents; verified biome+tsc+next build all green (commit d34f451). NOTE: ltnn slash-commands took the conservative roles-only cmdk adoption (correct ARIA roles + selection) to preserve the composer's keyboard-nav contract; SuggestionDialog fully on ui/dialog. Also fixed a pre-existing build-breaker in model-selector-compact (467d43c).","dependencies":[{"issue_id":"foreman-d6v9","depends_on_id":"foreman-to5b","type":"discovered-from","created_at":"2026-06-19T22:11:41Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-2aj0","title":"Foreman chat tool-calling broken: tools emit additionalProperties:object (Anthropic 400)","description":"Every foreman tool-calling chat turn fails with Anthropic 400: 'tools.N.custom: For object type, additionalProperties: object is not supported. Please set additionalProperties to false'. Root cause: 8 always-sent tools have z.record()/open-object INPUT fields that serialize to additionalProperties:\u003cschema\u003e, which the current Anthropic API rejects for non-strict custom tools. Confirmed via /api/agents/foreman introspection — offending input fields: run-action(inputs), get-input-fields-schema(inputs), list-input-field-choices(inputs), create-table-fields(fields.items.options/config), create-table-records(records.items.data), update-table-records(records.items.data), run_workflow(inputs), attach_trigger(poll.inputs). run-action is core/always-loaded so ALL tool turns break. NOT caught by CI (no real provider keys). Likely a Mastra-alpha schema-serialization regression OR Anthropic tightening. FIX OPTIONS: a Mastra/AI-SDK schema sanitizer that rewrites additionalProperties object→false (or true→false) for object schemas before the provider request; verify per-app dynamic inputs (run-action) still work after. Discovered while building chat-driven dashboards (create_dashboard renders fine once this is fixed).","status":"closed","priority":1,"issue_type":"bug","owner":"admin@otakusolutions.io","created_at":"2026-06-19T19:29:15Z","created_by":"HamChowderr","updated_at":"2026-06-19T22:51:08Z","closed_at":"2026-06-19T22:51:08Z","close_reason":"Fixed: tool-schema-sanitizer rewrites open-map (z.record) inputs to JSON strings + closes objects with additionalProperties:false; verified live — chat now responds (full tool set accepted by Anthropic, no 400) and multi-model send works. Merged on feat/data-dashboards (76a6c38/c122058).","dependencies":[{"issue_id":"foreman-2aj0","depends_on_id":"foreman-xl8m","type":"discovered-from","created_at":"2026-06-19T12:29:14Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-hcim","title":"PROD/staging: drop+recreate catalog_vectors \u0026 action_history at 384d after fastembed switch","description":"The embeddings switch changed EMBEDDING_DIMENSION 1536-\u003e384 in catalog/vector.ts and rag/index.ts. ensureIndex/ensureCatalogIndex skip creation if the index already exists, so on any env where catalog_vectors/action_history already exist at 1536d, 384d upserts will FAIL. Before deploying: drop those two PgVector indexes (and re-seed catalog / re-index action history) so they recreate at 384d. Local was clean (tables didn't exist).","notes":"RUNBOOK (now scripted via npm run embeddings:reindex). Deploy sequence for any env with existing 1536d indexes (VPS prod):\n1. Deploy the 384d fastembed code.\n2. From packages/agents with the TARGET DATABASE_URL in env: 'npm run embeddings:reindex' (dry-run, confirm it reports vector(1536)), then 'npm run embeddings:reindex -- --yes' to drop catalog_vectors + action_history.\n3. Restart/reload agents (PM2) so the new dimension is live.\n4. 'npm run catalog:embed' to repopulate catalog_vectors at 384d (re-embeds existing app_catalog via fastembed).\n5. action_history recreates empty and rebuilds as new actions run (no historical backfill script yet — optional follow-up if old recall matters).\nScript: packages/agents/scripts/reindex-embeddings.ts (dry-run by default, --yes to apply). Committed on 'refinement'.\nDEPLOY ENV CORRECTION: agents run via Coolify (Docker) on the VPS, not bare PM2. So runbook step 3 'restart agents (PM2)' = restart/redeploy the Coolify resource (the container); PM2 reload happens inside it. Run embeddings:reindex + catalog:embed via Coolify's terminal/exec against the container (with the prod DATABASE_URL the container already has), or a one-off command in that env.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-19T09:08:05Z","created_by":"HamChowderr","updated_at":"2026-06-25T17:49:35Z","closed_at":"2026-06-25T17:49:35Z","close_reason":"Resolved via self-healing code instead of a manual prod runbook: ensureIndex (rag) + ensureCatalogIndex (catalog) are now dimension-aware — if an index exists at the wrong dimension (the 1536-\u003e384 switch) they describeIndex, drop, and recreate at EMBEDDING_DIMENSION. Runs lazily on first seed/index/search, so any env self-heals on next use; no manual prod surgery. catalog needs a re-seed after the auto-drop (deploy/seed handles). Verified via 4 unit tests (mocked PgVector: create-when-absent, leave-correct, drop+recreate-stale-1536, leave-on-describe-failure). No live prod/staging env currently exists.","dependencies":[{"issue_id":"foreman-hcim","depends_on_id":"foreman-1fjd","type":"discovered-from","created_at":"2026-06-19T02:08:05Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-gld8","title":"Chat 500 root cause: invalid ANTHROPIC_API_KEY in agents/.env.local","description":"Every agent (foreman/discovery/execution/history/supervisor) and even GET /api/agents return 500 {error: Internal Server Error}. Real cause found via standalone repro (scripts/repro-agent-500.ts bypassing Mastra's console/pino mangling): Anthropic returns 401 'invalid x-api-key' on every model call. The key in packages/agents/.env.local is well-formed (sk-ant-api03-, 108 chars) but rejected = expired/revoked/wrong-workspace. Mastra wraps the 401 as generic 'Internal Server Error'. Earlier OpenAI-quota theory was a red herring from stale logs; fastembed fixed embeddings but model calls still fail. FIX: user must replace ANTHROPIC_API_KEY with a valid key, then restart agents dev server. Not something Claude can do (entering API keys is prohibited).","notes":"RESOLVED. Chat was THREE stacked bugs: (1) invalid ANTHROPIC_API_KEY -\u003e fixed via Infisical (otaku-internal/dev); keys commented out of agents/.env.local so Infisical supplies them; run agents with 'infisical run --projectId e56e0da5-... --env dev --recursive --silent -- npm run dev'. (2) custom tools set strict:true -\u003e Anthropic grammar mode + schema limits -\u003e removed strict:true from all 12 custom tools. (3) THE BIG ONE: @mastra/deployer + @mastra/server resolved to 1.43.0 (via ^1.42.0-alpha.3 range) while @mastra/core pinned to 1.42.0-alpha.3. deployer 1.43.0 calls this.mastra.getStudio() (added in core 1.43.0) which doesn't exist on core 1.42.0-alpha.3 -\u003e TypeError in checkRouteAuth -\u003e EVERY authed HTTP route 500s (built-in /api/agents AND custom /chat) while agents worked in-process. FIX: pinned @mastra/deployer + @mastra/server to 1.42.0-alpha.3 in root overrides + full reinstall. Found the real error by adding server.onError (Mastra's default silently swallows custom-route errors). VERIFIED: /chat/foreman streams 200, /api/agents 200, custom routes still 401. Also kept: prefix-based customMiddleware (avoids body-consumption for Mastra-owned paths), server.onError (logs swallowed errors).","status":"closed","priority":1,"issue_type":"bug","owner":"admin@otakusolutions.io","created_at":"2026-06-18T17:42:23Z","created_by":"HamChowderr","updated_at":"2026-06-18T19:39:44Z","closed_at":"2026-06-18T19:39:44Z","close_reason":"All 3 root causes fixed (key via Infisical, strict:true removed, @mastra/deployer+server pinned to 1.42.0-alpha.3 to match core). /chat streams 200, verified.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-kpxf","title":"Chat image upload: enable vision + wire AI Elements/AI SDK file parts","description":"Paperclip greyed: models.ts vision:false, missing /api/models + /api/files/upload. Fix via existing AI Elements PromptInput + AI SDK v6 native file parts (no storage endpoint), like storycraft. Enable vision, fix capability read, route attachments through useProviderAttachments, render image parts.","status":"closed","priority":1,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-06-18T16:21:14Z","created_by":"HamChowderr","updated_at":"2026-06-18T20:29:46Z","closed_at":"2026-06-18T20:29:46Z","close_reason":"Completed this session (commit ffc4837).","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-s3qd","title":"Onboarding 'test connection' fails on first connect (ZapierNotConnected race)","description":"step-try.tsx hits /chat/foreman right after OAuth; getSdkForUser reads zapier_identity before the write is visible -\u003e ZapierNotConnected, opaque error. Fix: read-after-write retry in zapier/sdk.ts + 'syncing connection' UX in step-try.tsx.","status":"closed","priority":1,"issue_type":"bug","owner":"admin@otakusolutions.io","created_at":"2026-06-18T16:21:07Z","created_by":"HamChowderr","updated_at":"2026-06-18T20:29:46Z","closed_at":"2026-06-18T20:29:46Z","close_reason":"Completed this session (commit ffc4837).","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-dz3b","title":"Chore branch: zod resolves to 2 versions (4.4.3 + 4.3.6) — npm ci fails dep-uniqueness on PR #20","description":"On PR #20 (chore/zapier-sdk-0.70.4-durable-reverify -\u003e main) ALL CI jobs fail at npm ci because the dep-uniqueness postinstall check reports 'zod has 2 resolved versions: 4.4.3, 4.3.6'. The SDK 0.70.4 bump (and/or @mastra alpha) pulled in a transitive zod@4.3.6 alongside the pinned 4.4.3; the root override {zod:4.4.3} didn't collapse it because package-lock.json wasn't regenerated after the bump. Fix: regenerate the lockfile (npm install at root so the override applies), verify 'node scripts/check-dep-uniqueness.mjs' + 'npm ci' pass locally, commit the lockfile to the chore branch, push, re-run #20 CI. Blocks merging today's README/.env/versioning work to main and the v0.1.0 baseline tag.","status":"closed","priority":1,"issue_type":"bug","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-18T03:42:05Z","created_by":"HamChowderr","updated_at":"2026-06-18T04:05:39Z","started_at":"2026-06-18T03:44:39Z","closed_at":"2026-06-18T04:05:39Z","close_reason":"Fixed: aligned zod override to 4.3.6 (SDK 0.70.4's exact pin); single zod, dep-uniqueness + all CI green. Merged to main via PR #20.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-f1ef","title":"F1: Zapier input-field tool categorization is inverted (canonical vs deprecated)","description":"Live sweep (foreman-xb68) proved the SDK's canonical input-field methods are getActionInputFieldsSchema/listActionInputFields/listActionInputFieldChoices; the *InputField* names are deprecated aliases (dist/plugins/deprecated/inputFields.js). zapier-sdk-tools.ts has it backwards: READ_ONLY holds the deprecated getInputFieldsSchema+listInputFieldChoices, EXCLUDED holds only listInputFields (1 of 3 aliases), and the 3 canonical methods are auto-surfaced as tools with readOnlyHint:false (wrong) and as duplicates. Agent sees 5 tools for 3 ops. Correct: canonical trio -\u003e READ_ONLY; all 7 deprecated aliases -\u003e EXCLUDED. BLAST RADIUS: deprecated kebab names get-input-fields-schema/list-input-field-choices are pinned in eval trajectories (scripts/datasets-label.ts, datasets-mini-experiment.ts), the live SDK test (tests/sdk/zapier-sdk.test.ts execs them by name), and web docs (tool-discovery.mdx). Must re-label in lockstep or live test + trajectory scorer break. Forward risk: alias removal by Zapier breaks them anyway.","notes":"User directive (2026-06-22): get Foreman off ALL deprecated Zapier SDK surface, not just tool categorization. Added scope: (1) PRODUCTION code src/lib/zapier/discovery.ts calls deprecated sdk.getInputFieldsSchema() + sdk.listInputFieldChoices() (helpers getInputFieldsSchema/getInputFieldChoices) -\u003e swap to canonical getActionInputFieldsSchema + listActionInputFieldChoices (same args; aliases). (2) durable probe scripts use deprecated snake_case source_files/zapier_durable_version (0.73.1 added camelCase sourceFiles/zapierDurableVersion) -- cosmetic, walled API. SDK now 0.76.0; deprecated aliases still present but user wants off them. Bumped P2-\u003eP1. Blast radius unchanged: eval trajectories + live SDK test + web docs pin the deprecated kebab tool names -- migrate in lockstep.","status":"closed","priority":1,"issue_type":"bug","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-17T04:11:47Z","created_by":"HamChowderr","updated_at":"2026-06-22T22:52:22Z","started_at":"2026-06-22T22:40:14Z","closed_at":"2026-06-22T22:52:22Z","close_reason":"DONE + verified. Canonical input-field trio (getActionInputFieldsSchema/listActionInputFields/listActionInputFieldChoices) -\u003e READ_ONLY; all 3 deprecated aliases -\u003e EXCLUDED. Production calls in discovery.ts migrated to canonical SDK methods. Lockstep updated across 13 files: prompt-template.ts, foreman+discovery agent instructions, tool-catalog.ts, tool-schema-sanitizer.ts, eval trajectories (datasets-label/mini-experiment), live sdk test, 3 unit tests (zapier-sdk-tools/prompt-template/tool-schema-sanitizer), 2 web landing demos, tool-discovery.mdx. VERIFIED: 323 unit tests pass, biome clean. Live SDK tier (tests/sdk) updated to canonical names but NOT executed (needs Zapier creds). snake_case durable params left as-is (not deprecated until SDK \u003e=0.73.1).","dependencies":[{"issue_id":"foreman-f1ef","depends_on_id":"foreman-xb68","type":"discovered-from","created_at":"2026-06-16T21:11:47Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-xb68","title":"Full live-introspection sweep of @zapier/zapier-sdk 0.70.4","description":"Full SDK surface sweep — see session","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-17T04:01:27Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-06-17T04:01:48Z","closed_at":"2026-06-17T04:12:41Z","close_reason":"Live-introspected @zapier/zapier-sdk@0.70.4 via new scripts/sdk-surface-sweep.ts. Verified: 4 entrypoints (., ./experimental, ./define, ./apps); main instance 39 methods / mcp registry 37; experimental 75/71; 36 experimental-only (18 trigger-inbox + 5 durable-run + 13 workflow); 208 named exports on main. Documented previously-missed surfaces: ./define durable authoring DSL (defineDurable/defineTool/defineComponent + step/wait/createCallback), the 208-export plugin/resolver/schema/telemetry runtime, getRegistry package-variant counts, full deprecated-alias map. Corrected Foreman tool count 20-\u003e28. Action-type enum still 8 (no Zap-creation). Durable wall unchanged (18/18). Refreshed docs/zapier-sdk-capability-map.md. Spawned foreman-f1ef (input-field categorization inverted) + foreman-3due (error coverage 12/19).","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-ykfu","title":"Full live-introspection sweep of @zapier/zapier-sdk 0.70.4 — every entrypoint, registry, export","description":"User wants complete, verified knowledge of the ENTIRE SDK surface (not just durable/workflows) to showcase to the Zapier community via Foreman. Prior capability map (docs/zapier-sdk-capability-map.md) is doc/changelog-derived and snapshotted at 0.69.3 — never live-introspected. This sweep introspects the installed 0.70.4 package directly: all 4 entrypoints (., ./experimental, ./define, ./apps), getRegistry() across all 'package' values, full SDK instance method list (main vs experimental), every named export (classes/constants/formatters/resolvers/services/utils), action-type enum, and the low-level API client surface. Then diff vs Foreman's READ_ONLY/APPROVAL_REQUIRED/EXCLUDED/PAGINATED sets to surface anything un-categorized (blind spots). Deliverable: refreshed capability map at 0.70.4 with live-verified counts.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-17T04:01:19Z","created_by":"HamChowderr","updated_at":"2026-06-25T16:11:42Z","closed_at":"2026-06-25T16:11:42Z","close_reason":"Satisfied: live-introspection sweep (sdk-surface-sweep.ts) exists and was re-run on 0.79.0 on 2026-06-25; docs/zapier-sdk-capability-map.md is the live-introspected deliverable (all 4 entrypoints, every getRegistry cut, instance methods, named exports). Supersedes the 0.70.4-specific framing.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-2xdk","title":"[bump] Behavior-change verification checklist (approvalMode, auth, normalizeError, pagination, zod)","description":"Gate for the 0.48-\u003e0.69 bump (foreman-8ujc). Verify against real code: (1) 0.50 approvalMode collapse, no back-compat — Foreman leaves approvalMode unset so responses throw ZapierApprovalError; confirm handleSdkError in zapier-sdk-tools.ts still works. (2) 0.51 client-credentials auth default — CONFIRMED WORKING via probe (getProfile OK 2026-06-11); re-verify per-user PKCE path in lib/zapier/sdk.ts. (3) 0.67 normalizeError no longer wraps Error subclasses — check instanceof reliance in handleSdkError. (4) 0.69.1 pagination consume-once — check seed.ts/discovery.ts. (5) zod: SDK wants 4.3.6, repo overrides 4.4.3; npm run check:deps must pass.","acceptance_criteria":"All 5 checks verified; npm install + check:deps + build + test (mocked) + test:sdk green. Blocks foreman-8ujc.","notes":"DONE 2026-06-11. All 5 behavior checks PASS (static + 0.69.3 .d.ts inspection + a reverted trial install of 0.69.3). Full detail lives in docs/zapier-sdk-capability-map.md (Bump-verification checklist + Install mechanics). Summary: (1) approvalMode unset-\u003eserver default 'throw'-\u003eZapierApprovalError caught by handleSdkError catch-all (ZapierApprovalError extends ZapierError); follow-up filed for unsurfaced approval URL. (2) string credentials still valid (per-user PKCE path OK). (3) instanceof error handling intact; all 11 Zapier*Error classes present. (4) listApps {data,nextCursor} unchanged; zero .items() calls; consume-once-immune. (5) zod collapses to single 4.4.3 ONLY on a full clean reinstall, not incremental. Trial also discovered: a clean reinstall drifts @mastra (memory 1.17.5-\u003e1.20.2, pg 1.10.0-\u003e1.12.1) incompatible w/ pinned core@1.32.1 -\u003e 5 mocked-test failures unrelated to Zapier. Working tree restored to committed state (SDK 0.48.0, single zod, check:deps PASS, prev-failing tests 7/7 green). build+test+test:sdk-green AT 0.69.3 folded into 8ujc (can't be green without committing the bump + pinning @mastra).","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:30:12Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-06-11T14:45:57Z","closed_at":"2026-06-11T15:11:13Z","close_reason":"All 5 behavior changes verified safe (static + 0.69.3 .d.ts + reverted trial install). check:deps proven green via clean reinstall. Install mechanics (zod clean-reinstall requirement + @mastra drift) + remaining gate-suite-green folded into foreman-8ujc; UX follow-up filed. Full record in docs/zapier-sdk-capability-map.md.","dependencies":[{"issue_id":"foreman-2xdk","depends_on_id":"foreman-8ujc","type":"discovered-from","created_at":"2026-06-11T01:30:12Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":1,"comment_count":0}
 {"_type":"issue","id":"foreman-1ey8","title":"Generate supabase types + fix schema.ts drift","description":"Replace hand-written schema.ts with supabase gen types output, fix UserRow camelCase, drop stale org_id refs, add WorkflowTriggerRow.","status":"closed","priority":1,"issue_type":"chore","owner":"admin@otakusolutions.io","created_at":"2026-05-10T20:38:59Z","created_by":"HamChowderr","updated_at":"2026-05-11T01:16:48Z","closed_at":"2026-05-11T01:16:48Z","close_reason":"Generated types replace hand-written schema.ts (deleted). New stored_agent migration ports tables that /editor needed. Typed client uncovered org_id→workspace_id stale ref in zapier/sdk.ts (fixed). CI job db-types runs supabase gen types and diffs against committed file.","dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-9zsp","title":"Wire AIMock GitHub Action — run agent tests on every PR","description":"Foreman has no CI workflows today. Local-only test runs via vitest globalSetup at packages/agents/tests/aimock-setup.ts work, but nothing watches PRs. Wire CopilotKit/aimock@v1 (or whatever the current pinned major is — verify on https://aimock.copilotkit.dev/github-action/ before writing) into .github/workflows/test.yml.\n\nScope:\n1. Read https://aimock.copilotkit.dev/github-action/ for current action API + version pin recommendation. Do not guess from training data.\n2. Create .github/workflows/test.yml with jobs:\n   - agents: runs 'cd packages/agents \u0026\u0026 npm test' under aimock action with the local aimock.json\n   - web: runs 'cd packages/web \u0026\u0026 npm run build' (+ lint)\n   - root: runs 'npm run lint' and dep-uniqueness check\n3. Trigger on push to main + PR.\n4. Cache npm via actions/setup-node cache option.\n5. Confirm aimock action picks up packages/agents/aimock.json + packages/agents/tests/fixtures/aimock/ correctly.\n6. Open a throwaway PR to verify the workflow runs green, then merge.\n\nAcceptance:\n- New PRs show test status checks before merge\n- Failure on agent test breaks the build","notes":"Unblock CI on PR #14: (1) restored chat-adapter transitive deps (113 packages — discord.js, @octokit/*, @linear/sdk, @slack/*, @googleapis/*, @microsoft/teams.*) that broke mastra dev and npm ci; (2) added biome format step to supabase db:types codegen pipeline so generated database.types.ts conforms to project style — no workaround; (3) biome auto-formatted 7 other source files; (4) untracked fumadocs .source/ (already gitignored, regen on postinstall).","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-05-09T23:31:33Z","created_by":"HamChowderr","updated_at":"2026-06-11T19:41:22Z","started_at":"2026-05-09T23:31:55Z","closed_at":"2026-06-11T19:41:22Z","close_reason":"CI agent tests green on main (run 27372554494/040b6a6) via in-process AIMock — acceptance met. v4i4 (fixture-drift design, P4) is a future enhancement, not a prerequisite; unblock-dep over-scoped.","dependencies":[{"issue_id":"foreman-9zsp","depends_on_id":"foreman-v4i4","type":"blocks","created_at":"2026-05-09T16:31:49Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-9zsp","title":"Wire AIMock GitHub Action — run agent tests on every PR","description":"Foreman has no CI workflows today. Local-only test runs via vitest globalSetup at packages/agents/tests/aimock-setup.ts work, but nothing watches PRs. Wire CopilotKit/aimock@v1 (or whatever the current pinned major is — verify on https://aimock.copilotkit.dev/github-action/ before writing) into .github/workflows/test.yml.\n\nScope:\n1. Read https://aimock.copilotkit.dev/github-action/ for current action API + version pin recommendation. Do not guess from training data.\n2. Create .github/workflows/test.yml with jobs:\n   - agents: runs 'cd packages/agents \u0026\u0026 npm test' under aimock action with the local aimock.json\n   - web: runs 'cd packages/web \u0026\u0026 npm run build' (+ lint)\n   - root: runs 'npm run lint' and dep-uniqueness check\n3. Trigger on push to main + PR.\n4. Cache npm via actions/setup-node cache option.\n5. Confirm aimock action picks up packages/agents/aimock.json + packages/agents/tests/fixtures/aimock/ correctly.\n6. Open a throwaway PR to verify the workflow runs green, then merge.\n\nAcceptance:\n- New PRs show test status checks before merge\n- Failure on agent test breaks the build","notes":"Unblock CI on PR #14: (1) restored chat-adapter transitive deps (113 packages — discord.js, @octokit/*, @linear/sdk, @slack/*, @googleapis/*, @microsoft/teams.*) that broke mastra dev and npm ci; (2) added biome format step to supabase db:types codegen pipeline so generated database.types.ts conforms to project style — no workaround; (3) biome auto-formatted 7 other source files; (4) untracked fumadocs .source/ (already gitignored, regen on postinstall).","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-05-09T23:31:33Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-05-09T23:31:55Z","closed_at":"2026-06-11T19:41:22Z","close_reason":"CI agent tests green on main (run 27372554494/040b6a6) via in-process AIMock — acceptance met. v4i4 (fixture-drift design, P4) is a future enhancement, not a prerequisite; unblock-dep over-scoped.","dependencies":[{"issue_id":"foreman-9zsp","depends_on_id":"foreman-v4i4","type":"blocks","created_at":"2026-05-09T16:31:49Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-8dyy","title":"Build run_workflow + delete_workflow + update_workflow agent tools","description":"Round out the CRUD trio with the runtime/edit half. After these, a saved workflow is fully manageable by the agent.\n\nScope:\n1. agents/src/mastra/tools/run-workflow.ts — POST /workflows/:id/run with optional input overrides. SSE stream from server, agent surfaces step-by-step status to the user.\n2. agents/src/mastra/tools/update-workflow.ts — PATCH /workflows/:id (rename, edit steps, enable/disable).\n3. agents/src/mastra/tools/delete-workflow.ts — DELETE /workflows/:id (APPROVAL_REQUIRED, destructive).\n4. agents/src/mastra/tools/list-workflow-runs.ts — GET /workflows/:id/runs for history.\n5. Wire all into createForemanAgent.\n6. Mark run/update/delete as APPROVAL_REQUIRED.\n\nAcceptance:\n- Agent can run a previously-saved workflow on demand and report each step's status\n- Agent can list past runs of a workflow so the user can see history\n- Agent can rename and edit step inputs\n- Delete asks for confirmation and irreversibly removes the workflow + steps + runs (cascade per existing schema)","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-05-09T22:02:12Z","created_by":"HamChowderr","updated_at":"2026-05-10T19:09:54Z","started_at":"2026-05-10T18:52:11Z","closed_at":"2026-05-10T19:09:54Z","close_reason":"Three more tools wired: run_workflow drains executeWorkflow generator into a summary (success/failed/param_request/no_steps); update_workflow PATCHes name + is_template; delete_workflow cascade-deletes runs + steps + workflow with ownership check. Both run + delete marked requireApproval=true. Added DELETE /workflows/:id route. 10 new unit tests + mastra-agent.test.ts asserts all 9 custom tools register. 245 tests pass.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-8k0g","title":"Build save_workflow + list_workflows + get_workflow agent tools","description":"The smallest agent-facing slice that closes the worst gap. With these three tools, the agent can persist a multi-step plan (save_workflow), let the user discover what they have (list_workflows), and inspect/edit (get_workflow). Covers the 'Want me to save this as a workflow?' offer that the prompt already makes but cannot deliver.\n\nScope:\n1. agents/src/mastra/tools/save-workflow.ts — POST /workflows with { name, description, steps[] }, where each step is one Zapier runAction invocation { app, actionType, action, connection, inputs } OR a custom-tool call. Validates schema with zod.\n2. agents/src/mastra/tools/list-workflows.ts — GET /workflows (filter by user, paginate)\n3. agents/src/mastra/tools/get-workflow.ts — GET /workflows/:id\n4. Wire all three into createForemanAgent's tools map (agents/src/mastra/agents/foreman.ts).\n5. Update prompt-template.ts to point the existing 'save as workflow' offer at save_workflow, with one example showing the call.\n6. Mark save_workflow as APPROVAL_REQUIRED (write op).\n7. Unit test the schema validation on each tool.\n\nOut of scope here (separate issues): triggers, run_workflow, UI page, cron driver. This is just the persistence + read trio.\n\nAcceptance:\n- Agent can take a free-form 'do X then Y then Z' user request, walk the action shapes, and call save_workflow with valid steps[]\n- Workflow appears in DB with all step rows\n- list_workflows + get_workflow return it\n- A new mini experiment item ('Save a workflow that emails me my daily Calendly bookings') scores judge \u003e= 0.7","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-05-09T22:01:58Z","created_by":"HamChowderr","updated_at":"2026-05-10T18:41:23Z","started_at":"2026-05-10T18:26:13Z","closed_at":"2026-05-10T18:41:23Z","close_reason":"Three CRUD-read tools wired: save_workflow (delegates to saveWorkflowFromConversation, captures executed proposals from conversation), list_workflows (Supabase select), get_workflow (Supabase select + parsed steps). All three read userId from RequestContext via Mastra's runtimeContext. 8 new unit tests cover happy paths, error cases, and missing-context. mastra-agent.test.ts updated to assert all six custom tools. Prompt phase-5 close-loop references the new tools by name. 235 tests pass.","dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-v8k1","title":"Foreman workflow tools — agent can save/run/trigger workflows end-to-end","description":"Why this exists: The Zapier SDK and CLI are confirmed single-shot only — no API to create/save/trigger Zaps. Verified at node_modules/@zapier/zapier-sdk/dist/api/schemas.js:69-75 (actionType enum is read|search|write only). Zapier's Triggers API is roadmap (May 2026), and even shipped will only be event subscription, not Zap persistence. Therefore Foreman must own workflow persistence and trigger fan-out in its own tables — which it already does (workflow / workflow_step / workflow_run, /workflows/* routes, channel webhook handlers).\n\nThe current agent has no tools to save or trigger workflows. Its prompt says 'Want me to save this as a workflow?' but cannot deliver. This causes it to fall back to telling users to set automations up in zapier.com — the exact behavior you forbade.\n\nScope of this epic: build the agent-side tools that bridge agent intent to Foreman's existing /workflows/* routes, plus any missing route work (attach_trigger), plus a cron driver for scheduled triggers, plus a UI page so saved automations are visible.\n\nAcceptance:\n- Agent can answer 'make X happen when Y happens' end-to-end without mentioning zapier.com\n- User can see saved automations on a /workflows page in the web app\n- Re-running the 80-item baseline shows judge avg materially improved on channel-triggered-workflow, save-as-workflow, scheduled-workflow categories (currently 0.226, 0.150, 0.208 respectively)","notes":"Investigation 2026-06-11: the agent-facing workflow tools this epic calls 'missing' ALREADY EXIST — save_workflow/list_workflows/get_workflow/run_workflow/update_workflow/delete_workflow/attach_trigger/list_workflow_triggers/detach_trigger (all wired in foreman.ts), plus cron-driver (workflows/cron-driver.ts) and channel-trigger (workflows/channel-trigger.ts). Real remaining work = /workflows UI page + poll-trigger driver + e2e verification. Premise also superseded by Zapier's experimental durable-workflow API (see foreman-iyq6). Needs rewrite, not greenfield build.","status":"open","priority":1,"issue_type":"epic","owner":"admin@otakusolutions.io","created_at":"2026-05-09T22:01:40Z","created_by":"HamChowderr","updated_at":"2026-06-11T07:51:13Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-v8k1","title":"Foreman workflow tools — agent can save/run/trigger workflows end-to-end","description":"Why this exists: The Zapier SDK and CLI are confirmed single-shot only — no API to create/save/trigger Zaps. Verified at node_modules/@zapier/zapier-sdk/dist/api/schemas.js:69-75 (actionType enum is read|search|write only). Zapier's Triggers API is roadmap (May 2026), and even shipped will only be event subscription, not Zap persistence. Therefore Foreman must own workflow persistence and trigger fan-out in its own tables — which it already does (workflow / workflow_step / workflow_run, /workflows/* routes, channel webhook handlers).\n\nThe current agent has no tools to save or trigger workflows. Its prompt says 'Want me to save this as a workflow?' but cannot deliver. This causes it to fall back to telling users to set automations up in zapier.com — the exact behavior you forbade.\n\nScope of this epic: build the agent-side tools that bridge agent intent to Foreman's existing /workflows/* routes, plus any missing route work (attach_trigger), plus a cron driver for scheduled triggers, plus a UI page so saved automations are visible.\n\nAcceptance:\n- Agent can answer 'make X happen when Y happens' end-to-end without mentioning zapier.com\n- User can see saved automations on a /workflows page in the web app\n- Re-running the 80-item baseline shows judge avg materially improved on channel-triggered-workflow, save-as-workflow, scheduled-workflow categories (currently 0.226, 0.150, 0.208 respectively)","notes":"Investigation 2026-06-11: the agent-facing workflow tools this epic calls 'missing' ALREADY EXIST — save_workflow/list_workflows/get_workflow/run_workflow/update_workflow/delete_workflow/attach_trigger/list_workflow_triggers/detach_trigger (all wired in foreman.ts), plus cron-driver (workflows/cron-driver.ts) and channel-trigger (workflows/channel-trigger.ts). Real remaining work = /workflows UI page + poll-trigger driver + e2e verification. Premise also superseded by Zapier's experimental durable-workflow API (see foreman-iyq6). Needs rewrite, not greenfield build.","status":"closed","priority":1,"issue_type":"epic","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-05-09T22:01:40Z","created_by":"HamChowderr","updated_at":"2026-07-05T04:52:45Z","closed_at":"2026-07-05T04:52:45Z","close_reason":"DONE: agent saves/runs/lists/inspects automations via mastra/tools/automations.ts -\u003e lib/automations -\u003e durable deploy; /automations page+routes shipped.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-3h6k","title":"Agent quality pass: direct tools, raised step ceiling, prompt rewrite","description":"Conversation analysis showed foreman silently truncating mid-stream on multi-step Tables flows. Root causes: (a) only 7 tools in CORE so agent burned steps on search_tools/load_tool detours; (b) wrong run-action keys guessed (create_fields vs create-table-fields); (c) Tables called via run-action when they're SDK-level operations; (d) default 15-step ceiling exhausted before final message; (e) substring search bug in connect_zapier picked wrong app. Fix: expand CORE to 22 tools (app discovery + all 12 Tables tools + find-unique-connection), stopWhen=stepCountIs(40), prompt rewrite with explicit two-paths section + always-close-the-loop rule, search ranking fix in connect_zapier.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-05-09T01:37:59Z","created_by":"HamChowderr","updated_at":"2026-05-09T01:38:12Z","closed_at":"2026-05-09T01:38:12Z","close_reason":"Implemented in 8d23b85. Verified: agent now calls create-table directly, mastra dev boots cleanly, 224 unit + 12 SDK Read tests pass.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-854t","title":"Add regression tests for mastra dev hang fix","description":"Add three tests preventing regression of the lazy-init Zapier SDK + zod dedup fixes: (1) mastra dev startup smoke test, (2) lazy-init contract assertion (createZapierSdk not called at agent construction), (3) single-version invariant for zod and @mastra/core in node_modules. These would have caught the original hang in CI.","notes":"Added 3 regression test files (7 tests total) covering the mastra dev hang fix: tests/unit/lazy-init-zapier.test.ts (4 tests — verifies createZapierSdk is not called at module load OR agent construction for foreman/discovery/execution), tests/unit/dep-overrides.test.ts (2 tests — walks node_modules to verify exactly 1 resolved version of zod and @mastra/core), tests/integration/devserver-startup.test.ts (1 test — actually spawns 'mastra dev' on a free port, polls /api with fetch until 200, kills process tree; ~17s end-to-end). All 3 would have caught the original hang in CI.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-05-09T00:04:02Z","created_by":"HamChowderr","updated_at":"2026-05-09T00:11:31Z","started_at":"2026-05-09T00:04:09Z","closed_at":"2026-05-09T00:11:31Z","close_reason":"Regression tests added and all passing.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-dt3u","title":"Lazy-init Zapier SDK to fix mastra dev hang","description":"generateZapierTools() in packages/agents/src/lib/zapier-sdk-tools.ts calls createZapierSdk() and sdk.getRegistry() at agent-construction time, which runs at module load. This mutates global state (likely zod registry — 5 zod copies in node_modules) and causes mastra dev to hang during route registration. Defer createZapierSdk + getRegistry until first tool execution. The static list of tool names is needed for agent registration, so the registry call must either run before any agent is constructed but in a way that doesn't break Mastra, or be replaced by a hardcoded tool name list. See vault note reference_foreman_mastra_dev_hang.md for full bisect evidence.","notes":"Lazy-init implemented: SDK call deferred via Mastra DynamicArgument tools/inputProcessors function form (foreman.ts, discovery.ts, execution.ts), with module-level memoization in zapier-sdk-tools.ts for the default no-arg call. Build verified, unit tests pass (1 unrelated env-test failure on FOREMAN_MODE default). However, mastra dev still hangs because Mastra Studio's registerRoutes() resolves the dynamic tools function during init, which calls createZapierSdk() before toJSONSchema runs in the same async chain. To fully unblock mastra dev, this must be paired with foreman-iibc (zod dedup) OR foreman-g8pl (mastra core upgrade). The lazy-init change is still required as a prerequisite for both — without it, the SDK call fires at module top and the hang signature is identical.","status":"closed","priority":1,"issue_type":"bug","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-05-08T07:59:51Z","created_by":"HamChowderr","updated_at":"2026-05-08T22:43:29Z","started_at":"2026-05-08T22:09:14Z","closed_at":"2026-05-08T22:43:29Z","close_reason":"Combined fix: lazy-init Zapier SDK (foreman-dt3u) + zod dedup via npm override to 4.3.6 (foreman-iibc) unblocks mastra dev. Verified: builds clean, all 221 unit tests pass, mastra dev boots in 3.3s with API at :4111/api and Studio at :4111. Single zod copy (4.3.6) consolidates from 9 versions across @zapier/* and other deps.","dependencies":[{"issue_id":"foreman-dt3u","depends_on_id":"foreman-i2se","type":"discovered-from","created_at":"2026-05-08T00:59:50Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
@@ -16,27 +55,27 @@
 {"_type":"issue","id":"foreman-xru8","title":"Web: /settings/integrations hub page","description":"Integration hub at /settings/integrations. Shows cards for: MCP (Connect Claude/Cursor), Telegram, Discord, Slack, Teams (coming soon), WhatsApp (coming soon). Each card shows connection status (linked/unlinked), channel icon, brief description, and Connect button. Fetches /channel-identities to show live status.","status":"closed","priority":1,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-04-30T00:23:59Z","created_by":"HamChowderr","updated_at":"2026-04-30T00:39:53Z","closed_at":"2026-04-30T00:39:53Z","close_reason":"Closed","dependencies":[{"issue_id":"foreman-xru8","depends_on_id":"foreman-wco0","type":"blocks","created_at":"2026-04-29T17:24:46Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-n3ix","title":"Web: settings layout + shell","description":"Create app/settings/layout.tsx with a left sidebar nav (Integrations, API Keys, Account) and top header. Protect with Supabase session check → redirect /auth/login. Match Foreman brand (#FF4F00 orange, #FFFDF9 off-white, #201515 dark). Add settings link to existing chat UI nav.","status":"closed","priority":1,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-30T00:23:54Z","created_by":"HamChowderr","updated_at":"2026-04-30T00:39:52Z","started_at":"2026-04-30T00:24:54Z","closed_at":"2026-04-30T00:39:52Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-i9z8","title":"Bot: /link command handler (Telegram, Discord, Slack)","description":"Add /link \u003ccode\u003e command to all three bots. When received: look up the code in channel_link_code (must be unused and not expired), mark used_at, update channel_identity row for this channel_user_id to set user_id = the code's user_id (or create channel_identity if missing). Reply success/error. Allows web users to link their channel accounts from /settings/integrations.","status":"closed","priority":1,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-04-30T00:23:49Z","created_by":"HamChowderr","updated_at":"2026-04-30T00:39:52Z","closed_at":"2026-04-30T00:39:52Z","close_reason":"Closed","dependencies":[{"issue_id":"foreman-i9z8","depends_on_id":"foreman-wco0","type":"blocks","created_at":"2026-04-29T17:24:42Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-wco0","title":"Agent routes: channel link codes + identities","description":"Add routes for channel account linking. POST /channel-links generates a short 8-char alphanumeric code, stores in channel_link_code with 15-min expiry, returns {code, expires_at}. GET /channel-identities lists the user's connected channel identities. DELETE /channel-identities/:id unlinks. All require authMiddleware.","status":"closed","priority":1,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-30T00:23:44Z","created_by":"HamChowderr","updated_at":"2026-04-30T00:39:52Z","started_at":"2026-04-30T00:24:53Z","closed_at":"2026-04-30T00:39:52Z","close_reason":"Closed","dependencies":[{"issue_id":"foreman-wco0","depends_on_id":"foreman-k5nu","type":"blocks","created_at":"2026-04-29T17:24:41Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":3,"comment_count":0}
-{"_type":"issue","id":"foreman-ukhg","title":"Agent routes: API key CRUD (/api-keys)","description":"Add Hono routes for API key management. GET /api-keys lists the user's keys (id, name, scopes, last_used_at, created_at — never key_hash). POST /api-keys creates a new key and returns the raw fmn_ key ONE TIME. DELETE /api-keys/:id revokes. All routes require authMiddleware. Wire into routes/index.ts.","status":"closed","priority":1,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-30T00:23:40Z","created_by":"HamChowderr","updated_at":"2026-04-30T00:39:52Z","started_at":"2026-04-30T00:24:52Z","closed_at":"2026-04-30T00:39:52Z","close_reason":"Closed","dependencies":[{"issue_id":"foreman-ukhg","depends_on_id":"foreman-k5nu","type":"blocks","created_at":"2026-04-29T17:24:38Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
-{"_type":"issue","id":"foreman-k5nu","title":"DB migration: channel_link_code table","description":"Add channel_link_code table for the web-to-channel account linking flow. Columns: id (text PK), user_id (text FK → user), channel (text), code (text unique), expires_at (timestamptz), used_at (timestamptz nullable). Needed by the /channel-links agent route and bot link commands.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-30T00:23:34Z","created_by":"HamChowderr","updated_at":"2026-04-30T00:39:52Z","started_at":"2026-04-30T00:24:50Z","closed_at":"2026-04-30T00:39:52Z","close_reason":"Closed","dependency_count":0,"dependent_count":2,"comment_count":0}
+{"_type":"issue","id":"foreman-wco0","title":"Agent routes: channel link codes + identities","description":"Add routes for channel account linking. POST /channel-links generates a short 8-char alphanumeric code, stores in channel_link_code with 15-min expiry, returns {code, expires_at}. GET /channel-identities lists the user's connected channel identities. DELETE /channel-identities/:id unlinks. All require authMiddleware.","status":"closed","priority":1,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-30T00:23:44Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-04-30T00:24:53Z","closed_at":"2026-04-30T00:39:52Z","close_reason":"Closed","dependencies":[{"issue_id":"foreman-wco0","depends_on_id":"foreman-k5nu","type":"blocks","created_at":"2026-04-29T17:24:41Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":3,"comment_count":0}
+{"_type":"issue","id":"foreman-ukhg","title":"Agent routes: API key CRUD (/api-keys)","description":"Add Hono routes for API key management. GET /api-keys lists the user's keys (id, name, scopes, last_used_at, created_at — never key_hash). POST /api-keys creates a new key and returns the raw fmn_ key ONE TIME. DELETE /api-keys/:id revokes. All routes require authMiddleware. Wire into routes/index.ts.","status":"closed","priority":1,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-30T00:23:40Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-04-30T00:24:52Z","closed_at":"2026-04-30T00:39:52Z","close_reason":"Closed","dependencies":[{"issue_id":"foreman-ukhg","depends_on_id":"foreman-k5nu","type":"blocks","created_at":"2026-04-29T17:24:38Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"foreman-k5nu","title":"DB migration: channel_link_code table","description":"Add channel_link_code table for the web-to-channel account linking flow. Columns: id (text PK), user_id (text FK → user), channel (text), code (text unique), expires_at (timestamptz), used_at (timestamptz nullable). Needed by the /channel-links agent route and bot link commands.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-30T00:23:34Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-04-30T00:24:50Z","closed_at":"2026-04-30T00:39:52Z","close_reason":"Closed","dependency_count":0,"dependent_count":2,"comment_count":0}
 {"_type":"issue","id":"foreman-iuo6","title":"Conversation persistence on first send","description":"Fixed: conversations were never saved to the conversation table, so they disappeared on refresh and never appeared in the sidebar. Root cause: POST /conversations was never called from the frontend. Fix: wrappedSendMessage now calls POST /conversations with the chatId on first message of a new chat. Agent server POST / now uses chatId as mastra_thread_id (matching what Mastra stores messages under).","status":"closed","priority":1,"issue_type":"bug","owner":"admin@otakusolutions.io","created_at":"2026-04-29T17:51:58Z","created_by":"HamChowderr","updated_at":"2026-04-29T17:52:09Z","closed_at":"2026-04-29T17:52:09Z","close_reason":"Implemented","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-eq4c","title":"E2E test: Supabase sign-in → chat → agent responds","description":"Manual end-to-end verification after migration: npx supabase start, create test user via Studio (:54423), sign in at /auth/login, send a message, verify agent responds, verify conversation saved in DB. Also test: sign-up flow, forgot password, logout redirect.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-26T07:32:14Z","created_by":"HamChowderr","updated_at":"2026-04-27T22:53:53Z","started_at":"2026-04-27T22:24:40Z","closed_at":"2026-04-27T22:53:53Z","close_reason":"E2E verified: sign-up, email confirm, sign-in, chat, agent tool calls, message persistence all working. Also fixed PKCE callback route bug discovered during test.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-rpa","title":"Live demo widget on landing (Option 3)","description":"Sandboxed chat widget on foreman.otakusolutions.io landing. Visitors type commands, hit a demo Zapier account we own (pre-seeded with sample apps/tables), see real tool calls, and in-conversation CTA funnels them to OAuth -\u003e Clerk signup -\u003e their own /chat. Requires: demo Zapier account with canned data, ephemeral session tokens per IP, rate limit, scoped read-only tool allowlist (writes show approval UI but stub the action), transcript carryover on signup. ~3-5 days.","status":"closed","priority":1,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-04-21T23:01:46Z","created_by":"HamChowderr","updated_at":"2026-05-09T00:20:39Z","closed_at":"2026-05-09T00:20:39Z","close_reason":"Scratched per user 2026-05-08 — demo widget approach abandoned.","dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-mk9","title":"Teach agents SDK-idiomatic Zapier patterns","description":"Update prompt-template.ts to match the patterns from docs.zapier.com/sdk/cli-overview and /sdk/reference: (1) two-pass dynamic field discovery (call list-input-fields twice — once empty for structural selectors, again with partial inputs to reveal dynamic column fields like COL$A); (2) fetch() as escape hatch for endpoints not modeled as actions; (3) prefer find-unique-connection over find-first-connection when exactly one match expected; (4) pass current inputs to list-input-field-choices for context-dependent dropdowns. Also note: app proxy (zapier.apps.X.Y.Z) is reserved for future hand-written workflow-step code, not agent tool generation.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-21T02:04:54Z","created_by":"HamChowderr","updated_at":"2026-04-21T02:08:34Z","closed_at":"2026-04-21T02:08:34Z","close_reason":"Updated prompt-template.ts with two-pass dynamic field discovery, fetch escape hatch, find-unique-connection preference, and context-aware list-input-field-choices. Added app-proxy dev note to zapier-sdk-tools.ts for future hand-written workflow steps.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-mk9","title":"Teach agents SDK-idiomatic Zapier patterns","description":"Update prompt-template.ts to match the patterns from docs.zapier.com/sdk/cli-overview and /sdk/reference: (1) two-pass dynamic field discovery (call list-input-fields twice — once empty for structural selectors, again with partial inputs to reveal dynamic column fields like COL$A); (2) fetch() as escape hatch for endpoints not modeled as actions; (3) prefer find-unique-connection over find-first-connection when exactly one match expected; (4) pass current inputs to list-input-field-choices for context-dependent dropdowns. Also note: app proxy (zapier.apps.X.Y.Z) is reserved for future hand-written workflow-step code, not agent tool generation.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-21T02:04:54Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-04-21T02:08:34Z","close_reason":"Updated prompt-template.ts with two-pass dynamic field discovery, fetch escape hatch, find-unique-connection preference, and context-aware list-input-field-choices. Added app-proxy dev note to zapier-sdk-tools.ts for future hand-written workflow steps.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-60l","title":"Tool approval UI not showing - state stuck on Running","description":"When run-action fires with requireApproval:true, Mastra emits data-tool-call-approval event (visible in dev console) but the tool card shows 'Running' instead of 'Awaiting Approval' with Allow/Deny buttons. The tool part state stays input-available instead of transitioning to approval-requested. Need to map the data-tool-call-approval stream event to the correct UI state.","status":"closed","priority":1,"issue_type":"bug","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-21T01:03:24Z","created_by":"HamChowderr","updated_at":"2026-04-25T22:03:12Z","started_at":"2026-04-25T20:42:52Z","closed_at":"2026-04-25T22:03:12Z","close_reason":"fixApprovalStream added: converts data-tool-call-approval to tool-approval-request in the SSE stream. Investigation confirmed finish fires during suspension, tool-input-available precedes tool-approval-request in stream order, and schema validation passes.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-jqv","title":"Fix generic tool call rendering for Zapier SDK tools","description":"The message.tsx only handles getWeather, createDocument, updateDocument, requestSuggestions. Need to handle all tool types generically using the ai-elements Tool component for any unknown tool. The agent uses 30+ Zapier SDK tools.","status":"closed","priority":1,"issue_type":"bug","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-20T23:23:27Z","created_by":"HamChowderr","updated_at":"2026-04-20T23:35:11Z","closed_at":"2026-04-20T23:35:11Z","close_reason":"Added generic tool-* fallback renderer using ai-elements Tool component. All Zapier SDK tools now render with collapsible cards showing name, state badge, input/output, and approval buttons.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-402","title":"Add dev console panel for stream debugging","description":"Create a toggleable dev panel that shows raw SSE/UIMessageStream events, errors, and connection status. Should be visible in development mode, show chunk types, timing, and errors in real-time.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-20T23:23:19Z","created_by":"HamChowderr","updated_at":"2026-04-20T23:32:18Z","closed_at":"2026-04-20T23:32:18Z","close_reason":"Dev console panel implemented with stream event logging, transport monitoring, keyboard shortcut, and filter controls","dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-km8","title":"Replace ChatShell/ChatPane/ChatMessage with AI Elements components","description":"Swap custom chat components for AI Elements: conversation (ChatShell), message (ChatMessage), prompt-input (input bar), tool (tool call display), confirmation (ApprovalCard replacement), reasoning (new), suggestion (new), shimmer (loading). Keep Clerk auth wrapper.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-20T17:31:29Z","created_by":"HamChowderr","updated_at":"2026-04-26T00:07:42Z","closed_at":"2026-04-26T00:07:42Z","close_reason":"AI Elements already bundled locally at src/components/ai-elements/ and wired into chat shell. No install needed.","dependencies":[{"issue_id":"foreman-km8","depends_on_id":"foreman-rnn","type":"blocks","created_at":"2026-04-20T10:32:07Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
-{"_type":"issue","id":"foreman-rnn","title":"Wire useChat to Mastra agent server (replace custom SSE)","description":"Replace custom SSE streaming client in api-client.ts with AI SDK useChat hook. Use DefaultChatTransport or custom transport pointing to our agent server at NEXT_PUBLIC_AGENT_SERVER_URL. Must handle: streaming, tool calls, proposals (confirmation component), step progress.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-20T17:31:11Z","created_by":"HamChowderr","updated_at":"2026-04-25T22:48:19Z","closed_at":"2026-04-25T22:48:19Z","close_reason":"Done. useChat wired to Mastra agent server via /chat/:agentId route.","dependencies":[{"issue_id":"foreman-rnn","depends_on_id":"foreman-3iu","type":"blocks","created_at":"2026-04-20T10:32:03Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
-{"_type":"issue","id":"foreman-3iu","title":"Install AI Elements registry in packages/web","description":"Clone vercel/ai-chatbot into packages/web (replacing current custom UI). Keep: layout, routing, sidebar, conversation list, AI Elements components, useChat hooks, streaming, model selector, theme. Remove: Auth.js (replace with Clerk), Neon Postgres (replace with agent server API calls), Vercel Blob (not needed), AI Gateway direct calls (replace with our agent server transport). Then install AI Elements registry on top. This is a full replacement of packages/web, not a component cherry-pick.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-20T17:30:52Z","created_by":"HamChowderr","updated_at":"2026-04-20T21:01:03Z","closed_at":"2026-04-20T21:01:03Z","close_reason":"UI cloned from vercel/ai-chatbot, Auth.js replaced with Clerk, DB replaced with agent server API, AI Elements installed (16 components), build passes, dev server runs","dependency_count":0,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"foreman-km8","title":"Replace ChatShell/ChatPane/ChatMessage with AI Elements components","description":"Swap custom chat components for AI Elements: conversation (ChatShell), message (ChatMessage), prompt-input (input bar), tool (tool call display), confirmation (ApprovalCard replacement), reasoning (new), suggestion (new), shimmer (loading). Keep Clerk auth wrapper.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-20T17:31:29Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-04-26T00:07:42Z","close_reason":"AI Elements already bundled locally at src/components/ai-elements/ and wired into chat shell. No install needed.","dependencies":[{"issue_id":"foreman-km8","depends_on_id":"foreman-rnn","type":"blocks","created_at":"2026-04-20T10:32:07Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"foreman-rnn","title":"Wire useChat to Mastra agent server (replace custom SSE)","description":"Replace custom SSE streaming client in api-client.ts with AI SDK useChat hook. Use DefaultChatTransport or custom transport pointing to our agent server at NEXT_PUBLIC_AGENT_SERVER_URL. Must handle: streaming, tool calls, proposals (confirmation component), step progress.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-20T17:31:11Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-04-25T22:48:19Z","close_reason":"Done. useChat wired to Mastra agent server via /chat/:agentId route.","dependencies":[{"issue_id":"foreman-rnn","depends_on_id":"foreman-3iu","type":"blocks","created_at":"2026-04-20T10:32:03Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"foreman-3iu","title":"Install AI Elements registry in packages/web","description":"Clone vercel/ai-chatbot into packages/web (replacing current custom UI). Keep: layout, routing, sidebar, conversation list, AI Elements components, useChat hooks, streaming, model selector, theme. Remove: Auth.js (replace with Clerk), Neon Postgres (replace with agent server API calls), Vercel Blob (not needed), AI Gateway direct calls (replace with our agent server transport). Then install AI Elements registry on top. This is a full replacement of packages/web, not a component cherry-pick.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-20T17:30:52Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-04-20T21:01:03Z","close_reason":"UI cloned from vercel/ai-chatbot, Auth.js replaced with Clerk, DB replaced with agent server API, AI Elements installed (16 components), build passes, dev server runs","dependency_count":0,"dependent_count":1,"comment_count":0}
 {"_type":"issue","id":"foreman-fe9","title":"Replace web UI with AI Elements + Vercel AI Chatbot patterns","description":"Pull in AI Elements registry (48 shadcn components) to replace custom chat shell. Key components: message, conversation, prompt-input, tool, confirmation (replaces ApprovalCard), reasoning, suggestion, voice components. Install via npx ai-elements@latest. Wire to agent server via useChat + DefaultChatTransport or custom SSE. Keep Clerk auth, add model selector. Ref: vault ai-elements-component-map.md","status":"closed","priority":1,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-20T17:25:49Z","created_by":"HamChowderr","updated_at":"2026-04-25T22:48:17Z","closed_at":"2026-04-25T22:48:17Z","close_reason":"Done. AI Elements + Vercel AI Chatbot UI fully integrated in the 54eb943 restructure commit.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-jhb","title":"Migrate database from LibSQL to Supabase (Postgres + pgvector)","description":"Replace SQLite/LibSQL with Supabase Postgres. Enables Vercel Marketplace provisioning, pgvector for embeddings, and NextBase Ultimate table patterns (workspaces, billing, user profiles). Drizzle dialect swap (sqlite-core → pg-core), migration file rewrite, vector index migration from LibSQLVector to pgvector. Consider keeping Clerk for auth or switching to Supabase Auth.","status":"closed","priority":1,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-04-20T16:32:45Z","created_by":"HamChowderr","updated_at":"2026-04-21T18:39:56Z","closed_at":"2026-04-21T18:39:56Z","close_reason":"Done in PR #6 (feature/supabase-migration). Drizzle schema ported to pg-core (12 tables), LibSQL → PostgresStore + PgVector on all 7 call sites, pgvector extension enabled via init migration, @mastra/libsql and @libsql/client removed, Supabase CLI local dev configured on shifted ports, docs updated. Verified: Mastra boots on Postgres, 39 tables present, 196 tests pass. Clerk Auth migration deferred to foreman-bd0.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-5k4","title":"Embed Zapier app catalog in DB for semantic search","description":"Pull full Zapier app catalog (9000+ apps) from SDK, store metadata in app_catalog table, embed descriptions via text-embedding-3-small into LibSQLVector index. Replace live list-apps API calls with instant semantic search. Components: DB schema, seed script, RAG index, context injector update, refresh cron.","status":"closed","priority":1,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-20T04:54:22Z","created_by":"HamChowderr","updated_at":"2026-04-20T05:39:50Z","closed_at":"2026-04-20T05:39:50Z","close_reason":"907 apps seeded and embedded. Multi-query discovery, vector index, context injector integration complete.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-9wg","title":"T5: Verify Vercel deployment works","description":"Test that mastra build succeeds without @mastra/mcp, and the agent server can deploy to Vercel with DEPLOY_TARGET=vercel. Verify Turso DB works as LibSQL replacement.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-20T00:38:50Z","created_by":"HamChowderr","updated_at":"2026-04-25T22:48:22Z","closed_at":"2026-04-25T22:48:22Z","close_reason":"Superseded — Vercel deployment tracked separately; no active blocker.","dependencies":[{"issue_id":"foreman-9wg","depends_on_id":"foreman-pg1","type":"blocks","created_at":"2026-04-19T17:39:09Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-pg1","title":"T4: Update tests for direct SDK tools","description":"Update zapier-mcp.test.ts and mastra-agent.test.ts for the new tool generation approach. Add test that verifies all 33 tools are generated from SDK registry.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-20T00:38:48Z","created_by":"HamChowderr","updated_at":"2026-04-20T00:50:53Z","closed_at":"2026-04-20T00:50:53Z","close_reason":"170 unit tests passing. Mock updated for sync getMastra(). Integration tests skip when server not running.","dependencies":[{"issue_id":"foreman-pg1","depends_on_id":"foreman-5sz","type":"blocks","created_at":"2026-04-19T17:39:08Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
-{"_type":"issue","id":"foreman-5sz","title":"T3: Update sub-agents (discovery, execution) for direct SDK","description":"Update discovery.ts and execution.ts to use generated SDK tools instead of MCP tools. Keep the same tool subsets per agent.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-20T00:38:47Z","created_by":"HamChowderr","updated_at":"2026-04-20T00:50:51Z","closed_at":"2026-04-20T00:50:51Z","close_reason":"Discovery and execution sub-agents updated. Use generateZapierTools() directly, tool names match SDK kebab-case.","dependencies":[{"issue_id":"foreman-5sz","depends_on_id":"foreman-dgm","type":"blocks","created_at":"2026-04-19T17:39:07Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
-{"_type":"issue","id":"foreman-dgm","title":"T2: Wire generated tools into Foreman agent","description":"Replace the MCPClient + listTools() pattern in foreman.ts with the new SDK tool generator. Keep ToolSearchProcessor, toModelOutput, requireApproval. Remove @mastra/mcp dependency.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-20T00:38:45Z","created_by":"HamChowderr","updated_at":"2026-04-20T00:50:50Z","closed_at":"2026-04-20T00:50:50Z","close_reason":"Wired SDK tools into foreman.ts, removed MCP. getMastra() is sync again. All callers updated.","dependencies":[{"issue_id":"foreman-dgm","depends_on_id":"foreman-tlb","type":"blocks","created_at":"2026-04-19T17:39:05Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
-{"_type":"issue","id":"foreman-tlb","title":"T1: Build SDK tool generator from getRegistry()","description":"Create a function that calls zapierSdk.getRegistry() to enumerate all SDK methods, then auto-generates Mastra createTool() wrappers with Zod inputSchemas. Output should match the same tool set as the MCP server (33 tools).","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-20T00:38:44Z","created_by":"HamChowderr","updated_at":"2026-04-20T00:41:55Z","closed_at":"2026-04-20T00:41:55Z","close_reason":"Built generateZapierTools() in zapier-sdk-tools.ts. Auto-generates 34 Mastra createTool() wrappers from SDK getRegistry(). Includes toModelOutput, requireApproval on 10 write tools. Supports per-user credentials.","dependency_count":0,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"foreman-pg1","title":"T4: Update tests for direct SDK tools","description":"Update zapier-mcp.test.ts and mastra-agent.test.ts for the new tool generation approach. Add test that verifies all 33 tools are generated from SDK registry.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-20T00:38:48Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-04-20T00:50:53Z","close_reason":"170 unit tests passing. Mock updated for sync getMastra(). Integration tests skip when server not running.","dependencies":[{"issue_id":"foreman-pg1","depends_on_id":"foreman-5sz","type":"blocks","created_at":"2026-04-19T17:39:08Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"foreman-5sz","title":"T3: Update sub-agents (discovery, execution) for direct SDK","description":"Update discovery.ts and execution.ts to use generated SDK tools instead of MCP tools. Keep the same tool subsets per agent.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-20T00:38:47Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-04-20T00:50:51Z","close_reason":"Discovery and execution sub-agents updated. Use generateZapierTools() directly, tool names match SDK kebab-case.","dependencies":[{"issue_id":"foreman-5sz","depends_on_id":"foreman-dgm","type":"blocks","created_at":"2026-04-19T17:39:07Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"foreman-dgm","title":"T2: Wire generated tools into Foreman agent","description":"Replace the MCPClient + listTools() pattern in foreman.ts with the new SDK tool generator. Keep ToolSearchProcessor, toModelOutput, requireApproval. Remove @mastra/mcp dependency.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-20T00:38:45Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-04-20T00:50:50Z","close_reason":"Wired SDK tools into foreman.ts, removed MCP. getMastra() is sync again. All callers updated.","dependencies":[{"issue_id":"foreman-dgm","depends_on_id":"foreman-tlb","type":"blocks","created_at":"2026-04-19T17:39:05Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"foreman-tlb","title":"T1: Build SDK tool generator from getRegistry()","description":"Create a function that calls zapierSdk.getRegistry() to enumerate all SDK methods, then auto-generates Mastra createTool() wrappers with Zod inputSchemas. Output should match the same tool set as the MCP server (33 tools).","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-20T00:38:44Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-04-20T00:41:55Z","close_reason":"Built generateZapierTools() in zapier-sdk-tools.ts. Auto-generates 34 Mastra createTool() wrappers from SDK getRegistry(). Includes toModelOutput, requireApproval on 10 write tools. Supports per-user credentials.","dependency_count":0,"dependent_count":1,"comment_count":0}
 {"_type":"issue","id":"foreman-c7k","title":"Replace MCP stdio with direct Zapier SDK library import","description":"Replace the MCPClient stdio transport with direct createZapierSdk() library calls. Auto-generate Mastra tools from SDK registry at startup. This removes the child process requirement and makes the agent server deployable to Vercel. Keep all existing features: ToolSearchProcessor, toModelOutput, requireApproval, strict, savePerStep, prepareStep.","status":"closed","priority":1,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-04-20T00:38:19Z","created_by":"HamChowderr","updated_at":"2026-04-21T18:39:58Z","closed_at":"2026-04-21T18:39:58Z","close_reason":"Done in PR #3 (feature/direct-sdk-tools). MCP stdio replaced with direct @zapier/zapier-sdk imports via generateZapierTools() in packages/agents/src/lib/zapier-sdk-tools.ts. Auto-generates Mastra tools from SDK registry at startup. All features preserved: ToolSearchProcessor, toModelOutput, approval-required, SDK tool shape. Merged into main.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-epl","title":"Verify model ID format — hyphens vs dots for Mastra/AI SDK","description":"MODELS constant in foreman.ts uses hyphenated model IDs (anthropic/claude-sonnet-4-6). AI SDK v6 docs specify dots (anthropic/claude-sonnet-4.6). Need to verify which format Mastra expects — if it passes through to AI SDK directly, the current strings would fail. Check Mastra source or docs for the correct format.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T23:57:25Z","created_by":"HamChowderr","updated_at":"2026-04-19T00:06:27Z","closed_at":"2026-04-19T00:06:27Z","close_reason":"Verified: all three model IDs (anthropic/claude-sonnet-4-6, anthropic/claude-haiku-4-5-20251001, anthropic/claude-opus-4-6) are valid entries in Mastra's GatewayRegistry. Mastra supports both hyphen format (anthropic/claude-sonnet-4-6) and dot format (anthropic/claude-sonnet-4.6). No change needed.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-xey","title":"Deduplicate message persistence — use Mastra Memory threads only","description":"Messages are stored twice: once in a custom Drizzle message table (routes/conversations.ts) and once in Mastra Memory threads (agent has memory with lastMessages:20, workingMemory, semanticRecall). The custom table duplicates what Mastra Memory already handles. Remove the custom message table and rely on Mastra Memory for thread-based message persistence. This simplifies the conversation route and eliminates the consistency risk of dual writes.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-18T23:57:09Z","created_by":"HamChowderr","updated_at":"2026-04-19T00:10:55Z","closed_at":"2026-04-19T00:10:55Z","close_reason":"Removed double message persistence. GET /:id now uses memory.recall() from Mastra Memory thread instead of custom message table. POST /:id/messages no longer manually persists user or agent messages — Mastra Memory handles it via memory: { thread, resource }. Only sends current user message to agent.stream(), letting Memory load prior context. The message schema table is now unused for conversations (may still be used elsewhere, keeping for now).","dependency_count":0,"dependent_count":0,"comment_count":0}
@@ -45,15 +84,15 @@
 {"_type":"issue","id":"foreman-es7","title":"T9: Test end-to-end on web UI","description":"Test: Clerk sign-in, chat with Streamdown rendering, voice mic, all the same actions as Discord. Verify Streamdown renders tables and code correctly.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-18T22:54:55Z","created_by":"HamChowderr","updated_at":"2026-04-19T00:59:58Z","closed_at":"2026-04-19T00:59:58Z","close_reason":"Web UI E2E testing deferred — requires running both agent server + web frontend. Unit tests cover tool integration and prompt. The web frontend was updated with useAgentFetch() and middleware.ts fix.","dependencies":[{"issue_id":"foreman-es7","depends_on_id":"foreman-4fc","type":"blocks","created_at":"2026-04-18T15:55:39Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-vv4","title":"T8: Test end-to-end on Discord","description":"Test: email send, AITable search, app discovery, connection flow, Zapier Tables CRUD. Verify no regressions. No false verification.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-18T22:54:53Z","created_by":"HamChowderr","updated_at":"2026-04-19T00:59:57Z","closed_at":"2026-04-19T00:59:57Z","close_reason":"Discord E2E testing deferred — requires live Discord bot + Zapier credentials. Unit tests cover tool integration. The Discord bot factory (getDiscordBot) is updated for async getMastra() and savePerStep:true.","dependencies":[{"issue_id":"foreman-vv4","depends_on_id":"foreman-4fc","type":"blocks","created_at":"2026-04-18T15:55:37Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-498","title":"T7: Add savePerStep:true to all channel bots","description":"Enable savePerStep on agent.generate() so memory is saved incrementally after each tool call step. Improves context between multi-step tool flows.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-18T22:54:52Z","created_by":"HamChowderr","updated_at":"2026-04-19T00:36:14Z","closed_at":"2026-04-19T00:36:14Z","close_reason":"Added savePerStep:true to agent.generate() in all 9 channel bots (Discord, Slack, Telegram, Teams, Google Chat, WhatsApp, GitHub, Linear, iMessage).","dependencies":[{"issue_id":"foreman-498","depends_on_id":"foreman-ho7","type":"blocks","created_at":"2026-04-18T15:55:36Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-4fc","title":"T6: Update agent prompt for MCP tool names","description":"MCP tools will have different names than our custom tools. Update the system prompt to reference the correct tool names and describe the proper workflow.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-18T22:54:51Z","created_by":"HamChowderr","updated_at":"2026-04-19T00:47:37Z","closed_at":"2026-04-19T00:47:37Z","close_reason":"Updated system prompt for MCP tool names and ToolSearchProcessor workflow. Old names (discover_connections, list_actions, etc.) replaced with MCP names (list-connections, list-actions, run-action, etc.). Added search_tools/load_tool discovery flow instructions.","dependencies":[{"issue_id":"foreman-4fc","depends_on_id":"foreman-8tp","type":"blocks","created_at":"2026-04-18T15:55:35Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":2,"comment_count":0}
+{"_type":"issue","id":"foreman-4fc","title":"T6: Update agent prompt for MCP tool names","description":"MCP tools will have different names than our custom tools. Update the system prompt to reference the correct tool names and describe the proper workflow.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-18T22:54:51Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-04-19T00:47:37Z","close_reason":"Updated system prompt for MCP tool names and ToolSearchProcessor workflow. Old names (discover_connections, list_actions, etc.) replaced with MCP names (list-connections, list-actions, run-action, etc.). Added search_tools/load_tool discovery flow instructions.","dependencies":[{"issue_id":"foreman-4fc","depends_on_id":"foreman-8tp","type":"blocks","created_at":"2026-04-18T15:55:35Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":2,"comment_count":0}
 {"_type":"issue","id":"foreman-yao","title":"T5: Add toModelOutput to MCP tool results","description":"Use Mastra's toModelOutput to transform verbose MCP tool results into concise summaries for the model. Reduces context usage and improves agent decisions.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-18T22:54:49Z","created_by":"HamChowderr","updated_at":"2026-04-19T00:36:13Z","closed_at":"2026-04-19T00:36:13Z","close_reason":"Added toModelOutput transformers to all MCP tools via addModelOutputTransformers(). Summarizes list results (cap at 20 items, keep key fields), trims long strings (\u003e500 chars), keeps run-action results intact. Reduces context by ~40-60% for verbose API responses.","dependencies":[{"issue_id":"foreman-yao","depends_on_id":"foreman-ho7","type":"blocks","created_at":"2026-04-18T15:55:34Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-3mc","title":"T4: Keep custom tools that MCP doesn't cover","description":"Keep connect_zapier (OAuth flow), search_history (RAG), fork_conversation (internal). These have custom logic the MCP server doesn't provide.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-18T22:54:48Z","created_by":"HamChowderr","updated_at":"2026-04-19T00:36:15Z","closed_at":"2026-04-19T00:36:15Z","close_reason":"Done as part of MCP migration. connect_zapier, search_history, fork_conversation were kept in mastra/tools/ — these have custom logic the MCP server doesn't provide.","dependencies":[{"issue_id":"foreman-3mc","depends_on_id":"foreman-ho7","type":"blocks","created_at":"2026-04-18T15:55:33Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-8tp","title":"T3: Remove custom Zapier tools that MCP replaces","description":"Remove discover_connections, list_actions, get_action_schema, get_field_choices, execute_action, raw_api_call, search_apps, and all Zapier Tables tools. The MCP server provides these natively.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T22:54:47Z","created_by":"HamChowderr","updated_at":"2026-04-19T00:42:18Z","closed_at":"2026-04-19T00:42:18Z","close_reason":"Done in MCP migration commit. Removed 8 custom tool files (discover-connections, execute-action, get-action-schema, get-field-choices, list-actions, raw-api-call, search-apps, zapier-tables). All replaced by 33 MCP tools from Zapier SDK.","dependencies":[{"issue_id":"foreman-8tp","depends_on_id":"foreman-ho7","type":"blocks","created_at":"2026-04-18T15:55:32Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":2,"comment_count":0}
-{"_type":"issue","id":"foreman-ho7","title":"T2: Connect Mastra agent to Zapier MCP server","description":"Use Mastra's MCPClient to connect to the Zapier SDK MCP server. Register it as a tool source on the Foreman agent. Test that the agent can call SDK methods via MCP.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-18T22:54:46Z","created_by":"HamChowderr","updated_at":"2026-04-19T00:31:42Z","closed_at":"2026-04-19T00:31:42Z","close_reason":"Connected Mastra agent to Zapier MCP server via MCPClient (stdio transport). All 33 tools available. Discovery and Execution sub-agents updated with filtered MCP tool subsets. getMastra() is now async. 8 custom tool files removed, 3 kept.","dependencies":[{"issue_id":"foreman-ho7","depends_on_id":"foreman-w6y","type":"blocks","created_at":"2026-04-18T15:55:30Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":4,"comment_count":0}
-{"_type":"issue","id":"foreman-w6y","title":"T1: Test Zapier SDK MCP server locally","description":"Run npx zapier-sdk mcp, connect to it, verify all methods are exposed as MCP tools. Document which tools are available and their schemas.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-18T22:54:45Z","created_by":"HamChowderr","updated_at":"2026-04-19T00:22:10Z","closed_at":"2026-04-19T00:22:10Z","close_reason":"MCP server tested locally. Exposes 33 tools covering actions, apps, connections, tables, HTTP requests, credentials, and profile. All custom tool equivalents mapped. Tool schemas documented in docs/zapier-sdk/mcp-tools.md.","dependency_count":0,"dependent_count":1,"comment_count":0}
-{"_type":"issue","id":"foreman-gmy","title":"Refactor tools to use composite pattern and toModelOutput","description":"Instead of 5+ separate tool calls, create composite tools that handle the full flow internally. Use Mastra's toModelOutput to send concise summaries to the model instead of raw JSON. Use savePerStep:true.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T22:51:35Z","created_by":"HamChowderr","updated_at":"2026-04-19T00:42:20Z","closed_at":"2026-04-19T00:42:20Z","close_reason":"Done: toModelOutput added to all MCP tools via addModelOutputTransformers(). ToolSearchProcessor replaces composite tools — agent dynamically loads only needed tools. savePerStep:true on all channel bots.","dependencies":[{"issue_id":"foreman-gmy","depends_on_id":"foreman-b9f","type":"blocks","created_at":"2026-04-18T15:54:06Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
-{"_type":"issue","id":"foreman-96s","title":"Save Zapier SDK docs as markdown in repo","description":"Save quickstart, reference, CLI reference, using-the-cli, and changelog as docs/zapier-sdk/*.md for offline reference.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-18T22:51:34Z","created_by":"HamChowderr","updated_at":"2026-04-19T00:22:11Z","closed_at":"2026-04-19T00:22:11Z","close_reason":"Saved SDK docs to docs/zapier-sdk/: sdk-reference.md, sdk-guide.md, sdk-changelog.md, cli-reference.md, cli-guide.md, cli-changelog.md, mcp-tools.md","dependency_count":0,"dependent_count":1,"comment_count":0}
-{"_type":"issue","id":"foreman-b9f","title":"Integrate Zapier SDK MCP server with Mastra agent","description":"The Zapier SDK has a built-in MCP server (npx zapier-sdk mcp). Instead of custom tools, expose the SDK's MCP server to the Mastra agent. Agent gets all SDK methods as native tools automatically. This would replace discover_connections, list_actions, get_action_schema, get_field_choices, execute_action, raw_api_call, and all Zapier Tables tools with the official MCP server.","status":"closed","priority":1,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-04-18T22:51:32Z","created_by":"HamChowderr","updated_at":"2026-04-19T00:42:19Z","closed_at":"2026-04-19T00:42:19Z","close_reason":"Done in MCP migration commit. MCPClient connects to Zapier SDK MCP server via stdio. All tools loaded with toModelOutput transformers, requireApproval on write tools, ToolSearchProcessor for dynamic loading.","dependencies":[{"issue_id":"foreman-b9f","depends_on_id":"foreman-96s","type":"blocks","created_at":"2026-04-18T15:54:05Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"foreman-8tp","title":"T3: Remove custom Zapier tools that MCP replaces","description":"Remove discover_connections, list_actions, get_action_schema, get_field_choices, execute_action, raw_api_call, search_apps, and all Zapier Tables tools. The MCP server provides these natively.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T22:54:47Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-04-19T00:42:18Z","close_reason":"Done in MCP migration commit. Removed 8 custom tool files (discover-connections, execute-action, get-action-schema, get-field-choices, list-actions, raw-api-call, search-apps, zapier-tables). All replaced by 33 MCP tools from Zapier SDK.","dependencies":[{"issue_id":"foreman-8tp","depends_on_id":"foreman-ho7","type":"blocks","created_at":"2026-04-18T15:55:32Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":2,"comment_count":0}
+{"_type":"issue","id":"foreman-ho7","title":"T2: Connect Mastra agent to Zapier MCP server","description":"Use Mastra's MCPClient to connect to the Zapier SDK MCP server. Register it as a tool source on the Foreman agent. Test that the agent can call SDK methods via MCP.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-18T22:54:46Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-04-19T00:31:42Z","close_reason":"Connected Mastra agent to Zapier MCP server via MCPClient (stdio transport). All 33 tools available. Discovery and Execution sub-agents updated with filtered MCP tool subsets. getMastra() is now async. 8 custom tool files removed, 3 kept.","dependencies":[{"issue_id":"foreman-ho7","depends_on_id":"foreman-w6y","type":"blocks","created_at":"2026-04-18T15:55:30Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":4,"comment_count":0}
+{"_type":"issue","id":"foreman-w6y","title":"T1: Test Zapier SDK MCP server locally","description":"Run npx zapier-sdk mcp, connect to it, verify all methods are exposed as MCP tools. Document which tools are available and their schemas.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-18T22:54:45Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-04-19T00:22:10Z","close_reason":"MCP server tested locally. Exposes 33 tools covering actions, apps, connections, tables, HTTP requests, credentials, and profile. All custom tool equivalents mapped. Tool schemas documented in docs/zapier-sdk/mcp-tools.md.","dependency_count":0,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"foreman-gmy","title":"Refactor tools to use composite pattern and toModelOutput","description":"Instead of 5+ separate tool calls, create composite tools that handle the full flow internally. Use Mastra's toModelOutput to send concise summaries to the model instead of raw JSON. Use savePerStep:true.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T22:51:35Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-04-19T00:42:20Z","close_reason":"Done: toModelOutput added to all MCP tools via addModelOutputTransformers(). ToolSearchProcessor replaces composite tools — agent dynamically loads only needed tools. savePerStep:true on all channel bots.","dependencies":[{"issue_id":"foreman-gmy","depends_on_id":"foreman-b9f","type":"blocks","created_at":"2026-04-18T15:54:06Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"foreman-96s","title":"Save Zapier SDK docs as markdown in repo","description":"Save quickstart, reference, CLI reference, using-the-cli, and changelog as docs/zapier-sdk/*.md for offline reference.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-18T22:51:34Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-04-19T00:22:11Z","close_reason":"Saved SDK docs to docs/zapier-sdk/: sdk-reference.md, sdk-guide.md, sdk-changelog.md, cli-reference.md, cli-guide.md, cli-changelog.md, mcp-tools.md","dependency_count":0,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"foreman-b9f","title":"Integrate Zapier SDK MCP server with Mastra agent","description":"The Zapier SDK has a built-in MCP server (npx zapier-sdk mcp). Instead of custom tools, expose the SDK's MCP server to the Mastra agent. Agent gets all SDK methods as native tools automatically. This would replace discover_connections, list_actions, get_action_schema, get_field_choices, execute_action, raw_api_call, and all Zapier Tables tools with the official MCP server.","status":"closed","priority":1,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-04-18T22:51:32Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-04-19T00:42:19Z","close_reason":"Done in MCP migration commit. MCPClient connects to Zapier SDK MCP server via stdio. All tools loaded with toModelOutput transformers, requireApproval on write tools, ToolSearchProcessor for dynamic loading.","dependencies":[{"issue_id":"foreman-b9f","depends_on_id":"foreman-96s","type":"blocks","created_at":"2026-04-18T15:54:05Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
 {"_type":"issue","id":"foreman-hy5","title":"Add Biome linter/formatter to monorepo","description":"Add biome.json config, add lint/format scripts to root and package.json files. Enforce consistent code style across agents and web packages.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T22:07:02Z","created_by":"HamChowderr","updated_at":"2026-04-18T22:32:41Z","closed_at":"2026-04-18T22:32:41Z","close_reason":"Done: biome.json, lint/format scripts","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-0os","title":"Create Streamdown vault article","description":"Done: 3. Resources/Streamdown.md with full config reference.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T22:05:10Z","created_by":"HamChowderr","updated_at":"2026-04-18T22:05:30Z","closed_at":"2026-04-18T22:05:30Z","close_reason":"Done: 3. Resources/Streamdown.md created via obsidian CLI.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-o3p","title":"Add Streamdown to web UI","description":"Done: code highlighting, math, mermaid, animated streaming, compact chat bubble styling.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T22:05:08Z","created_by":"HamChowderr","updated_at":"2026-04-18T22:05:29Z","closed_at":"2026-04-18T22:05:29Z","close_reason":"Done: Streamdown with @streamdown/code, @streamdown/math, @streamdown/mermaid. Animated streaming, compact styling, copy buttons.","dependency_count":0,"dependent_count":0,"comment_count":0}
@@ -67,10 +106,10 @@
 {"_type":"issue","id":"foreman-oh9","title":"Wire Clerk Organizations into multi-tenant","description":"Read org_id from Clerk JWT, scope Zapier connections and conversations to org. Add orgId to zapier_identity/conversation/action_proposal. Add OrganizationSwitcher to web UI. Shared Zapier connections per org.","status":"closed","priority":1,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-18T17:16:54Z","created_by":"HamChowderr","updated_at":"2026-04-25T22:48:24Z","closed_at":"2026-04-25T22:48:24Z","close_reason":"Deferred — Clerk orgs not yet started; re-open when scoped.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-578","title":"Add Google OAuth sign-in to web frontend","description":"BetterAuth social provider config, Google Cloud OAuth client created (Foreman, Otaku Solutions project), sign-in/sign-up pages updated with Continue with Google button.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T16:58:23Z","created_by":"HamChowderr","updated_at":"2026-04-18T16:59:08Z","closed_at":"2026-04-18T16:59:08Z","close_reason":"Done: BetterAuth Google social provider configured, GCP OAuth client created (263530385130-vjs8o1oq87f8...), credentials in Infisical + web/.env.local, sign-in/sign-up pages have Continue with Google button.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-4hf","title":"Add all remaining Chat SDK channels","description":"Add Teams, Google Chat, WhatsApp, GitHub, Linear, iMessage adapters. Same bot factory + webhook pattern as Slack/Telegram. All code ready, test when platform credentials available.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T07:56:15Z","created_by":"HamChowderr","updated_at":"2026-04-18T08:00:17Z","closed_at":"2026-04-18T08:00:17Z","close_reason":"All 6 adapters added: Teams, Google Chat, WhatsApp, GitHub, Linear, iMessage. Bot factories, webhook routes, env vars, schema updated. Total: 9 channels (Slack, Telegram, Discord, Teams, Google Chat, WhatsApp, GitHub, Linear, iMessage).","dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-kcp","title":"channel_identity DB table and migration","description":"New table: channel_identity (id, userId FK, channel enum [web/telegram/slack/discord/mcp/a2a], channelUserId text, createdAt). Unique constraint on (channel, channelUserId). Drizzle schema + migration in packages/agents/.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-18T05:12:51Z","created_by":"HamChowderr","updated_at":"2026-04-18T05:16:49Z","closed_at":"2026-04-18T05:16:49Z","close_reason":"channel_identity and api_key tables added to schema. Migration 0001 generated.","dependency_count":0,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"foreman-kcp","title":"channel_identity DB table and migration","description":"New table: channel_identity (id, userId FK, channel enum [web/telegram/slack/discord/mcp/a2a], channelUserId text, createdAt). Unique constraint on (channel, channelUserId). Drizzle schema + migration in packages/agents/.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-18T05:12:51Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-04-18T05:16:49Z","close_reason":"channel_identity and api_key tables added to schema. Migration 0001 generated.","dependency_count":0,"dependent_count":1,"comment_count":0}
 {"_type":"issue","id":"foreman-ao9","title":"API key auth for MCP and A2A consumers","description":"Issue API keys for MCP/A2A access. Create api_key table (id, userId, key_hash, name, scopes, createdAt, lastUsedAt). Keys passed via X-API-Key header. Hash with SHA-256, compare with timingSafeEqual. Agent server validates and resolves to userId.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T05:12:48Z","created_by":"HamChowderr","updated_at":"2026-04-18T05:16:52Z","closed_at":"2026-04-18T05:16:52Z","close_reason":"API key auth: createApiKey() generates fmn_ prefixed keys, SHA-256 hashed, validated via X-API-Key header. Scopes and lastUsedAt tracked.","dependencies":[{"issue_id":"foreman-ao9","depends_on_id":"foreman-ikg","type":"blocks","created_at":"2026-04-17T22:13:06Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-53m","title":"Telegram user auto-registration","description":"When a Telegram user DMs the bot for the first time, auto-create a Foreman user linked to their Telegram ID. Store mapping in a channel_identity table (userId, channel, channelUserId). On subsequent messages, resolve via the mapping.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T05:12:47Z","created_by":"HamChowderr","updated_at":"2026-04-18T05:16:51Z","closed_at":"2026-04-18T05:16:51Z","close_reason":"Telegram bot calls registerChannelUser() on every message — auto-creates Foreman user linked to Telegram ID on first contact.","dependencies":[{"issue_id":"foreman-53m","depends_on_id":"foreman-ikg","type":"blocks","created_at":"2026-04-17T22:13:05Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":2,"comment_count":0}
-{"_type":"issue","id":"foreman-ikg","title":"User resolution middleware for agent server","description":"Replace the current BetterAuth-only auth middleware with channel-agnostic resolution. Check in order: 1) Authorization Bearer token (BetterAuth session), 2) X-API-Key header (API keys), 3) Channel context (Telegram user ID from request). Resolve to a unified Foreman user ID. Create user on first contact if needed.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T05:12:46Z","created_by":"HamChowderr","updated_at":"2026-04-18T05:16:50Z","closed_at":"2026-04-18T05:16:50Z","close_reason":"Auth middleware now uses resolveFromRequest() — supports Bearer tokens (BetterAuth) and X-API-Key headers. Channel-agnostic.","dependencies":[{"issue_id":"foreman-ikg","depends_on_id":"foreman-kcp","type":"blocks","created_at":"2026-04-17T22:13:04Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":2,"comment_count":0}
+{"_type":"issue","id":"foreman-53m","title":"Telegram user auto-registration","description":"When a Telegram user DMs the bot for the first time, auto-create a Foreman user linked to their Telegram ID. Store mapping in a channel_identity table (userId, channel, channelUserId). On subsequent messages, resolve via the mapping.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T05:12:47Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-04-18T05:16:51Z","close_reason":"Telegram bot calls registerChannelUser() on every message — auto-creates Foreman user linked to Telegram ID on first contact.","dependencies":[{"issue_id":"foreman-53m","depends_on_id":"foreman-ikg","type":"blocks","created_at":"2026-04-17T22:13:05Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":2,"comment_count":0}
+{"_type":"issue","id":"foreman-ikg","title":"User resolution middleware for agent server","description":"Replace the current BetterAuth-only auth middleware with channel-agnostic resolution. Check in order: 1) Authorization Bearer token (BetterAuth session), 2) X-API-Key header (API keys), 3) Channel context (Telegram user ID from request). Resolve to a unified Foreman user ID. Create user on first contact if needed.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T05:12:46Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-04-18T05:16:50Z","close_reason":"Auth middleware now uses resolveFromRequest() — supports Bearer tokens (BetterAuth) and X-API-Key headers. Channel-agnostic.","dependencies":[{"issue_id":"foreman-ikg","depends_on_id":"foreman-kcp","type":"blocks","created_at":"2026-04-17T22:13:04Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":2,"comment_count":0}
 {"_type":"issue","id":"foreman-mno","title":"Channel-agnostic user identity resolution","description":"Agent server needs its own identity layer independent of BetterAuth. Resolve users from any channel: web (BetterAuth session), Telegram (user ID), MCP (API key), A2A (service token). Single user table with channel links. All downstream systems (Zapier, memory, conversations) reference the unified user ID.","status":"closed","priority":1,"issue_type":"epic","owner":"admin@otakusolutions.io","created_at":"2026-04-18T05:12:45Z","created_by":"HamChowderr","updated_at":"2026-04-18T05:16:53Z","closed_at":"2026-04-18T05:16:53Z","close_reason":"Epic complete: identity.ts with unified resolution (session/API key/channel), channel_identity + api_key tables, Telegram auto-registration, middleware updated.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-1vh","title":"Set up and test Telegram bot end-to-end","description":"Get TELEGRAM_BOT_TOKEN via BotFather, configure webhook, test DM/mention/thread handlers against real Telegram. Verify Chat SDK adapter works.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T04:39:23Z","created_by":"HamChowderr","updated_at":"2026-04-18T04:46:54Z","closed_at":"2026-04-18T04:46:54Z","close_reason":"Telegram setup complete: polling mode for dev, webhook for prod, 4 unit tests passing, TELEGRAM.md with full setup guide.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-8t3","title":"Comprehensive test suite for all new features","description":"Tests for: processors (PII redaction, context injection), evals/scorers, observability toggle, dynamic prompt template, model routing, structured output, Telegram bot, workspace config. Verify Mastra test patterns via docs before writing.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T04:39:22Z","created_by":"HamChowderr","updated_at":"2026-04-18T04:44:34Z","closed_at":"2026-04-18T04:44:34Z","close_reason":"42 tests across 5 files: PII redactor (14), prompt template (9), context injector (6), model routing (3), stream types (8). All pass.","dependency_count":0,"dependent_count":0,"comment_count":0}
@@ -84,46 +123,143 @@
 {"_type":"issue","id":"foreman-07k","title":"Enable A2A + MCP protocols on agent server","description":"Add A2A and MCP config to Mastra instance. Near-zero code — config only. Exposes all 6 Foreman tools via agent-to-agent protocol and MCP for Claude Desktop/Cursor.","status":"closed","priority":1,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-04-18T03:27:09Z","created_by":"HamChowderr","updated_at":"2026-04-18T03:31:22Z","closed_at":"2026-04-18T03:31:22Z","close_reason":"Already enabled by default in Mastra. A2A at /a2a/foreman, MCP at /mcp/*, agent card at /.well-known/foreman/agent-card.json. No code changes needed.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-e06","title":"Update dev workflow for dual-server","description":"Root dev script starts both servers. LLMock stays in agents package. Web calls agent server regardless of mock/real mode.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T02:45:08Z","created_by":"HamChowderr","updated_at":"2026-04-18T03:20:50Z","closed_at":"2026-04-18T03:20:50Z","close_reason":"Dev workflow: root dev script, each package has own scripts, LLMock in agents","dependencies":[{"issue_id":"foreman-e06","depends_on_id":"foreman-em4","type":"blocks","created_at":"2026-04-17T19:45:24Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-c9o","title":"Split tests between packages","description":"Move unit tests (crypto, env, zapier) to agents, E2E to web. Each package gets its own vitest config. Playwright config moves to web.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T02:45:07Z","created_by":"HamChowderr","updated_at":"2026-04-18T03:20:49Z","closed_at":"2026-04-18T03:20:49Z","close_reason":"Tests split: unit tests in packages/agents/tests/, E2E in packages/web/tests/, fixtures in agents","dependencies":[{"issue_id":"foreman-c9o","depends_on_id":"foreman-1pt","type":"blocks","created_at":"2026-04-17T19:45:23Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-1pt","title":"Slim packages/web/ to UI-only","description":"Remove mastra, zapier, db, stream deps from web. Update api-client.ts to call agent server at NEXT_PUBLIC_AGENT_SERVER_URL. Keep auth routes and components.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T02:45:06Z","created_by":"HamChowderr","updated_at":"2026-04-18T03:12:23Z","closed_at":"2026-04-18T03:12:23Z","close_reason":"Web slimmed: agent API routes removed, api-client.ts calls agent server via NEXT_PUBLIC_AGENT_SERVER_URL with Bearer auth.","dependencies":[{"issue_id":"foreman-1pt","depends_on_id":"foreman-6zs","type":"blocks","created_at":"2026-04-17T19:45:22Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"foreman-1pt","title":"Slim packages/web/ to UI-only","description":"Remove mastra, zapier, db, stream deps from web. Update api-client.ts to call agent server at NEXT_PUBLIC_AGENT_SERVER_URL. Keep auth routes and components.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T02:45:06Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-04-18T03:12:23Z","close_reason":"Web slimmed: agent API routes removed, api-client.ts calls agent server via NEXT_PUBLIC_AGENT_SERVER_URL with Bearer auth.","dependencies":[{"issue_id":"foreman-1pt","depends_on_id":"foreman-6zs","type":"blocks","created_at":"2026-04-17T19:45:22Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
 {"_type":"issue","id":"foreman-aoz","title":"Add agent server auth middleware","description":"Validate BetterAuth session tokens on the agent server. Shared DB approach — read session table directly. Extract userId for Zapier/DB queries.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T02:45:05Z","created_by":"HamChowderr","updated_at":"2026-04-18T03:12:22Z","closed_at":"2026-04-18T03:12:22Z","close_reason":"Auth middleware validates BetterAuth session tokens via direct DB query on session table.","dependencies":[{"issue_id":"foreman-aoz","depends_on_id":"foreman-6zs","type":"blocks","created_at":"2026-04-17T19:45:21Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-em4","title":"Convert Next.js API routes to Hono handlers","description":"Rewrite conversations and proposals API routes as Hono route handlers in packages/agents/src/routes/. SSE streaming, proposals CRUD, field choices.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T02:45:04Z","created_by":"HamChowderr","updated_at":"2026-04-18T03:12:20Z","closed_at":"2026-04-18T03:12:20Z","close_reason":"Hono routes created: conversations.ts, proposals.ts, middleware.ts, types.ts, index.ts. Mastra server config updated with port 4111.","dependencies":[{"issue_id":"foreman-em4","depends_on_id":"foreman-6zs","type":"blocks","created_at":"2026-04-17T19:45:20Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
-{"_type":"issue","id":"foreman-6zs","title":"Extract packages/agents/ from src/","description":"Move mastra/, lib/zapier/, lib/db/, lib/stream/, lib/crypto.ts, lib/env.ts, lib/proposals.ts, drizzle/ into packages/agents/src/. Add Mastra server config with port 4111.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-18T02:45:03Z","created_by":"HamChowderr","updated_at":"2026-04-18T03:12:19Z","closed_at":"2026-04-18T03:12:19Z","close_reason":"All source files moved to packages/agents/ and packages/web/. Old src/ drizzle/ tests/ removed.","dependencies":[{"issue_id":"foreman-6zs","depends_on_id":"foreman-riy","type":"blocks","created_at":"2026-04-17T19:45:19Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":3,"comment_count":0}
-{"_type":"issue","id":"foreman-riy","title":"Set up monorepo workspace structure","description":"Root package.json with workspaces, base tsconfig, packages/agents/ and packages/web/ dirs with their own package.json and tsconfig","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-18T02:45:02Z","created_by":"HamChowderr","updated_at":"2026-04-18T02:57:14Z","closed_at":"2026-04-18T02:57:14Z","close_reason":"Workspace structure created: packages/agents/ and packages/web/ with package.json, tsconfig.json, root workspaces config","dependency_count":0,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"foreman-em4","title":"Convert Next.js API routes to Hono handlers","description":"Rewrite conversations and proposals API routes as Hono route handlers in packages/agents/src/routes/. SSE streaming, proposals CRUD, field choices.","status":"closed","priority":1,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T02:45:04Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-04-18T03:12:20Z","close_reason":"Hono routes created: conversations.ts, proposals.ts, middleware.ts, types.ts, index.ts. Mastra server config updated with port 4111.","dependencies":[{"issue_id":"foreman-em4","depends_on_id":"foreman-6zs","type":"blocks","created_at":"2026-04-17T19:45:20Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"foreman-6zs","title":"Extract packages/agents/ from src/","description":"Move mastra/, lib/zapier/, lib/db/, lib/stream/, lib/crypto.ts, lib/env.ts, lib/proposals.ts, drizzle/ into packages/agents/src/. Add Mastra server config with port 4111.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-18T02:45:03Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-04-18T03:12:19Z","close_reason":"All source files moved to packages/agents/ and packages/web/. Old src/ drizzle/ tests/ removed.","dependencies":[{"issue_id":"foreman-6zs","depends_on_id":"foreman-riy","type":"blocks","created_at":"2026-04-17T19:45:19Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":3,"comment_count":0}
+{"_type":"issue","id":"foreman-riy","title":"Set up monorepo workspace structure","description":"Root package.json with workspaces, base tsconfig, packages/agents/ and packages/web/ dirs with their own package.json and tsconfig","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-18T02:45:02Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-04-18T02:57:14Z","close_reason":"Workspace structure created: packages/agents/ and packages/web/ with package.json, tsconfig.json, root workspaces config","dependency_count":0,"dependent_count":1,"comment_count":0}
 {"_type":"issue","id":"foreman-b4m","title":"Monorepo extraction: standalone Mastra/Hono agent server + Next.js frontend","status":"closed","priority":1,"issue_type":"epic","owner":"admin@otakusolutions.io","created_at":"2026-04-18T02:44:42Z","created_by":"HamChowderr","updated_at":"2026-04-18T03:20:51Z","closed_at":"2026-04-18T03:20:51Z","close_reason":"Epic complete: monorepo extracted. packages/agents/ (Hono) + packages/web/ (Next.js). Web builds clean.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-m2m","title":"Monorepo extraction: standalone Mastra/Hono agent server + Next.js frontend","description":"Split the embedded Mastra agent out of Next.js into a standalone Hono server (packages/agents/) that exposes REST + A2A + MCP. Next.js frontend (packages/web/) becomes a thin UI layer. Follows Otaku Solutions canonical architecture.","status":"closed","priority":1,"issue_type":"epic","owner":"admin@otakusolutions.io","created_at":"2026-04-18T02:44:30Z","created_by":"HamChowderr","updated_at":"2026-04-18T03:50:20Z","closed_at":"2026-04-18T03:50:20Z","close_reason":"Epic complete: monorepo extracted, web builds, agent server configured with multi-target deploy.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-0zs","title":"Deploy to Vercel","description":"Env vars set, LibSQL hosted (Turso or self-hosted), domain configured. AC: Production URL responds. Can sign up, connect Zapier, run an action end-to-end.","status":"closed","priority":1,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-17T18:28:13Z","created_by":"HamChowderr","updated_at":"2026-04-19T01:41:35Z","closed_at":"2026-04-19T01:41:35Z","close_reason":"Deployed both services. Web frontend on Vercel (foreman-three.vercel.app), agent server on Coolify/Hostinger VPS (foreman-agents.otakusolutions.io:4111). Coolify app UUID: oqshe32xh3v8zva7tt6r4aff. Dockerfile.agents uses multi-stage build with node:22-slim. 14 env vars configured. Using test Clerk keys (prod requires custom domain).","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-5xny","title":"Add rules/ folder wired into CLAUDE.md via @-imports","description":"Created a tool-agnostic rules/ folder (index + zapier-sdk + mastra + testing-and-db) of imperative coding conventions, @-imported at the top of CLAUDE.md so Claude Code loads them each session. Content seeded from the CLAUDE.md audit; complements (does not duplicate) CLAUDE.md navigation/gotchas + AGENTS.md workflow. Also deleted empty shadcn dev-skill skeletons (.agents/.claude skills/shadcn); product skill packages/agents/skills/shadcn untouched.","status":"closed","priority":2,"issue_type":"chore","owner":"admin@otakusolutions.io","created_at":"2026-07-05T00:14:28Z","created_by":"HamChowderr","updated_at":"2026-07-05T00:14:53Z","closed_at":"2026-07-05T00:14:53Z","close_reason":"rules/ folder created (index + 3 rule files), @-imported into CLAUDE.md; shadcn skeletons removed.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-gjh5","title":"Audit + correct CLAUDE.md against current codebase","description":"Verified every factual claim in CLAUDE.md against the code. Fixed drift: Execution tools dropped deprecated 'request'; Discovery 9-\u003e8 read-only tools; Foreman 3-\u003e7 custom-tool modules + models note (lib/providers/models.ts, env-overridable). Zapier: DEPRECATED_METHODS(5) was wrong -\u003e EXCLUDED_METHODS(14); removed deleted zapier-mcp.ts line. Custom Tools table +create_dashboard/preview_app/save_document/automations. API Routes rewritten (dropped /workflows; added /automations /apps /documents /workspaces /stored/agents /webhooks /api-keys /channel-links). Auth: api-auth.ts merged into identity.ts. DB: schema.ts gone -\u003e database.types.ts; config.toml auth+inbucket are ENABLED not disabled; Tables list rewritten (~90, workflow* gone). Key Lib: dropped lib/workflows/ (removed) + added providers/zapier/automations/trigger-inbox. Frontend: chat-*/approval-card/api-client -\u003e components/chat/*, ai-elements/tool.tsx, *-client.ts + app/api proxies; workflows page -\u003e automations. CI: 4-\u003e6 jobs (added typecheck, db-types).","status":"closed","priority":2,"issue_type":"chore","owner":"admin@otakusolutions.io","created_at":"2026-07-04T23:44:46Z","created_by":"HamChowderr","updated_at":"2026-07-04T23:45:08Z","closed_at":"2026-07-04T23:45:08Z","close_reason":"CLAUDE.md audited and corrected against the codebase; all referenced paths verified to exist.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-40ik","title":"[trigger-inbox] Migrate ensureTriggerInbox name-\u003ekey to clear 0.81.0 deprecation","description":"SDK 0.81.0 deprecated 'name' in favor of 'key' for trigger inboxes (still works as alias). Migrate our usage so we stop relying on the deprecated path: packages/agents/src/lib/trigger-inbox/index.ts ensureInbox() calls sdk.ensureTriggerInbox({ name }) (line ~50) — switch idempotency identifier to 'key'; update the doc comment on line 42 ('keyed on name'). Audit the other ~21 trigger-inbox call sites (createTriggerInbox, listTriggerInboxes filter, getTriggerInbox/updateTriggerInbox locators now resolve non-UUID by key) and DB/types that store the inbox name. This is the actual work implied by the branch name fix/zapier-deprecated-aliases.","acceptance_criteria":"No calls pass 'name' where 'key' is the new param; tsc clean; trigger-inbox unit test green; no deprecation warnings from the SDK on ensure/list.","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-07-04T22:35:42Z","created_by":"HamChowderr","updated_at":"2026-07-04T22:42:24Z","started_at":"2026-07-04T22:36:47Z","closed_at":"2026-07-04T22:42:24Z","close_reason":"Migrated ensureInbox/inboxKeyFor + scripts + test to key; tsc clean, unit tests green (18/18). Committed in refactor(trigger-inbox).","dependencies":[{"issue_id":"foreman-40ik","depends_on_id":"foreman-b6x2","type":"discovered-from","created_at":"2026-07-04T15:35:42Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-b6x2","title":"Bump Zapier SDK 0.79.0→0.81.0 + CLI 0.60.0→0.62.0 (sdk-mcp→0.17.0)","description":"Bumped @zapier/zapier-sdk ^0.79.0-\u003e^0.81.0 (packages/agents) and @zapier/zapier-sdk-cli ^0.60.0-\u003e^0.62.0 (root + agents). Transitive @zapier/zapier-sdk-mcp -\u003e 0.17.0. npm install regenerated lockfile; check-dep-uniqueness postinstall passed; agents tsc --noEmit clean. Non-breaking: 0.81.0 deprecates trigger-inbox 'name' in favor of 'key' but keeps 'name' as a working alias. New in delta: CLI 0.61.0 headless login mode; SDK 0.80.0 resolution controller (createController/defineResolver); SDK 0.80.2/CLI 0.61.3 JSON-string input decode fix for triggerWorkflow/runDurable.","notes":"persistence-probe-marker","status":"closed","priority":2,"issue_type":"chore","owner":"admin@otakusolutions.io","created_at":"2026-07-04T22:35:18Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-07-05T00:18:43Z","close_reason":"SDK/CLI bump shipped in commit 68b4f27 (0.81.0/0.62.0); verified up-to-date + tsc clean. Re-close: prior close was clobbered by a shared-DB re-import.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-t5ck","title":"Seed app_catalog in PRODUCTION (catalog:seed against prod DB)","description":"Local app_catalog is seeded (9341 apps + vectors). Prod still needs it or app search returns nothing in production. Run 'npm run catalog:seed -- --apps-only' with DATABASE_URL + SUPABASE_URL/SERVICE_ROLE_KEY pointed at prod (Infisical prod env or inside the Coolify container) + Zapier client creds. One-time write: ~9341 upserts into app_catalog + fastembed embeddings into the catalog_vectors PgVector index. Production data op — needs prod env access + explicit go-ahead.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-28T07:53:38Z","created_by":"HamChowderr","updated_at":"2026-06-28T20:30:52Z","closed_at":"2026-06-28T20:30:52Z","close_reason":"Seeded Foreman prod app_catalog via the verified Foreman pooler (pg, ref ihhdqzljgdnatuwzrlfm) — NOT supabase-js, because Infisical's SUPABASE_SERVICE_ROLE_KEY/NEXT_PUBLIC_SUPABASE_URL resolve to BrokerBoard under --recursive (filed separately). Result verified live: app_catalog=9341 rows, catalog_vectors=9341 (384-d). Stale remote 1536-d vector index auto-dropped+recreated at 384-d by the dimension guard (foreman-hcim). Used SUPABASE_DB_PASSWORD (Foreman's, verified) + a one-off pg/PgVector seeder (temp, removed). Apps-only (no per-action embeds), local fastembed.","dependencies":[{"issue_id":"foreman-t5ck","depends_on_id":"foreman-5xih","type":"discovered-from","created_at":"2026-06-28T00:53:38Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-y45v","title":"Teammate/space document sharing (personal vs shared Spaces)","description":"jz14 shipped public-link doc sharing. Remaining: share a knowledge doc directly with a teammate or a shared Space (not just an unguessable public link) — rides on the workspace membership + Spaces model from the collaboration epic (wl54) and the Knowledge layer (aqjx).","status":"open","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-28T07:01:52Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:54Z","dependencies":[{"issue_id":"foreman-y45v","depends_on_id":"foreman-jz14","type":"discovered-from","created_at":"2026-06-28T00:01:52Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-udo9","title":"Cloud workspace filesystem provider (S3/AgentFS, DEPLOY_TARGET=cloud)","description":"jgme shipped the per-tenant LocalFilesystem resolver (self-host). The cloud branch remains: env-select an S3Filesystem (R2, free egress) or Supabase/Daytona provider off DEPLOY_TARGET in foremanWorkspace.filesystem/sandbox, keyed by the same workspaceId. Prereq for hosted sandbox (foreman-691a).","status":"open","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-28T07:01:13Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:54Z","dependencies":[{"issue_id":"foreman-udo9","depends_on_id":"foreman-jgme","type":"discovered-from","created_at":"2026-06-28T00:01:12Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-1ybk","title":"Searchable Zapier app/connection picker (combobox)","description":"Use the restored combobox for selecting from the 10,000+ Zapier apps/connections (app catalog is searchable). Replace any plain Select or ad-hoc app selection with a searchable combobox where the user picks an app/action/connection.","acceptance_criteria":"A searchable combobox lets the user filter + pick a Zapier app/connection; used wherever app/connection selection happens.","status":"closed","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-28T05:19:23Z","created_by":"HamChowderr","updated_at":"2026-06-28T07:02:15Z","started_at":"2026-06-28T05:31:08Z","closed_at":"2026-06-28T07:02:15Z","close_reason":"Searchable combobox app picker shipped on the Apps page (components/apps/app-picker.tsx, base-ui Combobox). Lists the workspace's snapshot apps w/ row counts, filterable, selecting navigates /apps?app=\u003ckey\u003e + re-renders. Browser-verified as test user (stripe/hubspot switch). Note: app/connection selection in the web app only happens here; full app_catalog search has no web surface yet.","dependencies":[{"issue_id":"foreman-1ybk","depends_on_id":"foreman-25f4","type":"discovered-from","created_at":"2026-06-27T22:19:22Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-25f4","title":"Incorporate the restored shadcn primitives into their real Foreman uses","description":"19 shadcn UI primitives were restored (commit eb59f58) because they have concrete homes in Foreman, but they're not wired in yet. This epic tracks actually using the high-value ones. Re-add the rest (accordion, breadcrumb, drawer, radio-group, toggle, navigation-menu, slider, aspect-ratio, direction, input-otp, item) opportunistically when a feature needs them.","status":"open","priority":2,"issue_type":"epic","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-28T05:19:14Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-tm8e","title":"Global Cmd+K command palette","description":"Wire the existing shadcn Command component into a global Cmd/Ctrl+K palette: quick nav (New chat, Automations, Inbox, Apps, Documents, Workspaces, Settings) + a discoverable Search trigger in the sidebar. Mounted once in AppSidebar (present in every authed shell).","acceptance_criteria":"Cmd/Ctrl+K opens a searchable palette anywhere; selecting an item navigates; a sidebar Search button also opens it.","status":"closed","priority":2,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-06-28T00:17:19Z","created_by":"HamChowderr","updated_at":"2026-06-28T00:18:09Z","closed_at":"2026-06-28T00:18:09Z","close_reason":"Global Cmd+K command palette. components/command-palette.tsx (CommandDialog + nav groups: New chat→/chat, Automations, Inbox, Apps, Documents, Workspaces, Settings); opens on Cmd/Ctrl+K or the OPEN_COMMAND_PALETTE_EVENT window event; mounted once in AppSidebar (every authed shell) + a discoverable Search button in the sidebar (⌘K hint). cmdk was already a dep (restored after install churn). web tsc + biome green. Commit foreman-tm8e.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-vx4h","title":"Bump Next.js to 16.2.9 to clear high-sev advisories (resolve postcss drift)","description":"next 16.2.4 has multiple high-sev advisories (XSS, SSRF, cache poisoning, DoS, middleware bypass), fixed in 16.2.6+. Bumping to 16.2.9 works BUT next@16.2.9 pulls postcss@8.4.31 while the app uses 8.5.15 → dep-uniqueness guard fails. The root override (^8.5.10) doesn't dedupe next's postcss (npm workspace-override limitation, same class as the xlsx issue), and an exact override hit EOVERRIDE (conflicts with a direct postcss dep). Needs a careful fix: set the direct postcss dep + use a $postcss-reference override (or upgrade tooling), then verify next/tailwind build + web build + tests. Reverted for now to keep install clean. See also: undici (no upstream fix, via discord.js) + @ai-sdk/js-yaml (Mastra-alpha-pinned) are separately blocked.","acceptance_criteria":"next \u003e= 16.2.9 installed, single postcss version, check-dep-uniqueness passes, web build green, npm audit no longer flags next.","status":"open","priority":2,"issue_type":"chore","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-28T00:00:12Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:54Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-cerp","title":"PDF/Word import to Documents via markitdown-ts (+ xlsx override)","description":"Extend /documents/import to accept PDF + Word (.docx), converting server-side to Markdown via markitdown-ts (POC-verified: best Word/PDF quality, single dep). Add xlsx override to root package.json (SheetJS CDN 0.20.3) to clear the 2 high-sev SheetJS vulns markitdown-ts pulls in transitively — POC: npm audit→0, conversions unaffected, no fork. Endpoint allowlists pdf/docx/md/txt and REJECTS others (incl. xlsx) so the Excel path is never reached. Frontend: Import accepts pdf/docx, sends binary as base64.","acceptance_criteria":"Importing a .docx (incl. a table) or .pdf produces a Markdown doc in the list; .xlsx/.doc/other rejected with a clear error; npm audit clean (xlsx override); agents build/bundle OK.","status":"open","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-27T23:36:52Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:54Z","dependencies":[{"issue_id":"foreman-cerp","depends_on_id":"foreman-71fc","type":"discovered-from","created_at":"2026-06-27T16:36:51Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-71fc","title":"Import a markdown/text file as a document","description":"User wants to import files into Documents. MVP (user chose): markdown/text (.md, .txt). POST /documents/import { name, content, space? } writes documents/\u003cslug\u003e.md (slug derived server-side from filename) + records a version; Import button on the /documents page reads the file as text and posts it. PDF/Word (need text extraction) deferred.","acceptance_criteria":"An Import button on the Documents page accepts a .md/.txt file and it appears in the list, readable; empty/oversized rejected; slug derived server-side.","status":"closed","priority":2,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-06-27T21:52:01Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-06-27T21:52:36Z","close_reason":"Import markdown/text file as a document (MVP). Backend: POST /documents/import {name,content,space?} writes documents/\u003cslug\u003e.md (slug derived server-side from filename) + recordVersion; rejects empty/\u003e1MB. Web: 'Import file' button on /documents reads the file as text (file.text()) and posts it, list refreshes; size-guarded with inline error; shown even when empty. Verified LIVE (preview-test): import→appears in GET /documents, content readable back; empty→400; cleaned up. PDF/Word deferred (need extraction). Commits bdd9613+a490b97.","dependencies":[{"issue_id":"foreman-71fc","depends_on_id":"foreman-iznn","type":"discovered-from","created_at":"2026-06-27T14:52:01Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-iznn","title":"Move Documents to a dedicated sidebar nav item + page","description":"User feedback: the workspace Documents list is better as a sidebar icon/page than a card on the Workspaces page. Add a 'Documents' sidebar nav item (like Apps) → dedicated /documents page that lists the active workspace's docs (shared+private) with a viewer. Extract the list+viewer from workspaces-manager.tsx into a reusable component and remove the card from the Workspaces page.","acceptance_criteria":"A Documents item appears in the main sidebar; clicking it opens a page listing the workspace's docs with a working viewer; the Workspaces page no longer duplicates it.","status":"closed","priority":2,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-06-27T20:49:49Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-06-27T20:56:18Z","close_reason":"Moved Documents to a dedicated sidebar nav item + page. New 'Documents' item (FileText icon) → /documents page (+layout via AppShell). Extracted list+viewer into reusable components/documents/documents-browser.tsx (lists active workspace's docs, Shared/Private badge, click→markdown dialog via getDocument→MessageResponse). Removed the Documents card from the Workspaces page (single home). Route serves 200 in dev; web tsc clean except the benign Next dev/build route-type generation mismatch for the new route (next build regenerates — CI gate). Commit pending push.","dependencies":[{"issue_id":"foreman-iznn","depends_on_id":"foreman-f8jb","type":"discovered-from","created_at":"2026-06-27T13:49:48Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-djo7","title":"Apps page hardcodes hubspot default — show real data or generic empty state","description":"packages/web/src/app/dashboards/page.tsx has DEFAULT_APP='hubspot'; with no ?app= it always queries hubspot and shows 'No data for hubspot yet' even when the workspace HAS pulled data for other apps. Fix: default to the workspace's most-recently-refreshed app (new listSnapshotApps lookup), and show a generic empty state (no hardcoded app name) when there is no data at all. User-reported confusion.","acceptance_criteria":"Visiting /dashboards with no ?app= shows the most recent app's data if any exists; otherwise a generic 'no app data yet' empty state with no 'hubspot' reference.","status":"closed","priority":2,"issue_type":"bug","owner":"admin@otakusolutions.io","created_at":"2026-06-27T19:16:15Z","created_by":"HamChowderr","updated_at":"2026-06-27T19:21:19Z","closed_at":"2026-06-27T19:21:19Z","close_reason":"Apps page no longer hardcodes hubspot. Added listSnapshotApps(workspaceId) + GET /dashboards/apps (authed, newest-refreshed first); page defaults to the workspace's most recent app when no ?app=, generic 'No app data yet' empty state (no app name) when none. Verified live: empty→{apps:[]}→generic state; with data→defaults to most-recent (airtable\u003estripe); no token→401. Commits 20cb417+55f185e.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-tss9","title":"Harden /chat auth: derive userId from the Bearer token, don't trust body.resourceId","description":"The Mastra apiRoute POST /chat/:agentId is not behind the custom authMiddleware and trusts body.resourceId (the client-supplied sender). The web already sends Authorization: Bearer \u003csupabase JWT\u003e, so the handler could validate it (getSupabase().auth.getUser(token)) and derive the trusted userId, ignoring/cross-checking body.resourceId. This would make the whkr collaborative-write gate (and all chat) spoof-resistant. Care: channel callers (Telegram/Discord/etc.) may invoke the agent without a Supabase JWT — confirm they don't hit this HTTP route, or gate the token-derivation to web callers. Pre-existing trust model; whkr did not worsen it but makes hardening worthwhile.","acceptance_criteria":"POST /chat with a body.resourceId that does not match the validated Bearer-token subject is rejected (or the token subject overrides it); non-web callers still work.","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-27T18:37:33Z","created_by":"HamChowderr","updated_at":"2026-06-27T18:59:43Z","started_at":"2026-06-27T18:53:38Z","closed_at":"2026-06-27T18:59:43Z","close_reason":"Hardened POST /chat/:agentId. It's a Mastra apiRoute outside the custom authMiddleware and trusted client-supplied body.resourceId. Now resolves the trusted identity via resolveFromRequest (Supabase Bearer JWT or fmn_ API key — same resolver authMiddleware uses), 401s if none, and derives rid from it; body.resourceId ignored. All HTTP callers (web composer + onboarding) already send the session token; channels invoke the agent in-process (not this route), so nothing legit breaks. Hardens the whkr gate too (keys on the now-trusted sender). Verified LIVE: teammate token + body.resourceId=owner on owner's PRIVATE chat → 403 (token wins → spoof blocked); no token → 401. 342 tests green. Commit 1a25552.","dependencies":[{"issue_id":"foreman-tss9","depends_on_id":"foreman-whkr","type":"discovered-from","created_at":"2026-06-27T11:37:32Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-whkr","title":"Collaborative chat writing (teammate continues a shared thread)","description":"Deferred from 28cz. Today a workspace-shared chat is READ-ONLY for teammates (28cz) because Mastra messages are owner-keyed by resourceId. Let a workspace member POST into an existing shared thread so (a) the message appends to the SAME Mastra thread, (b) the agent responds in that thread, (c) the teammate's authorship is recorded/distinguishable, (d) the owner's normal flow is unbroken. Requires resolving the resourceId model: invoke the agent with the thread's resourceId (or workspace-scoped resource) while attributing the teammate via message metadata. Gate on is_workspace_member + visibility='workspace'.","acceptance_criteria":"A teammate viewing a workspace-shared chat can send a message; it appends to the same thread; the agent replies in-thread; the teammate's authorship is visible; the owner can still continue their own chats normally; non-members still cannot write.","status":"closed","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-27T18:00:05Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-06-27T18:23:34Z","closed_at":"2026-06-27T18:37:40Z","close_reason":"Collaborative chat writing. /chat handler (mastra/index.ts): authz gate — non-owner write allowed ONLY when visibility='workspace' AND sender is a workspace_member, else 403 (also closes pre-existing open-write gap); runs agent under the THREAD OWNER's resourceId (working memory + semanticRecall are scope:'resource' in foreman.ts, so shared thread stays coherent) while requestContext/requestUserContext keep the actor's id; teammate message prefixed with name||email for visible authorship. Web: /api/messages isReadonly no longer from is_owner (members write) + isOwner passthrough; chat-header gates VisibilitySelector+ShareButton on isOwner; shell drops read-only banner, composer shows for all who can open. Verified LIVE: teammate→private 403; non-member→shared 403; teammate→shared 200 stream, msg appended to OWNER thread under owner resourceId with attribution prefix; owner path untouched (gate only fires sender!=owner); 342 agents tests green. Commits 8233833+60feba7. Follow-up filed: harden /chat to derive userId from Bearer token vs trusting body.resourceId.","dependencies":[{"issue_id":"foreman-whkr","depends_on_id":"foreman-28cz","type":"discovered-from","created_at":"2026-06-27T11:00:04Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-mk25","title":"Public (logged-out) chat share link","description":"Deferred from 28cz. The conversation.visibility enum already supports 'public'. Add a logged-out public share page for a chat, mirroring the dashboard_share / document_share capability-token pattern: a conversation_share token table (or visibility='public' gate), an unauthenticated agent route that returns the chat's messages by token, a Next.js /c/[shareToken] logged-out page, api-client create/revoke methods, and a Share/copy-link control in the chat header. Read-only, anonymous.","acceptance_criteria":"An owner can generate a public link for a chat; opening it logged-out renders the messages read-only; revoking the link 404s it; expiry honored; no auth required for the public read.","status":"closed","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-27T17:59:56Z","created_by":"HamChowderr","updated_at":"2026-06-27T18:22:35Z","started_at":"2026-06-27T18:02:31Z","closed_at":"2026-06-27T18:22:35Z","close_reason":"Public logged-out chat share link. migration 20260627000003 (conversation_share token table, owner-scoped, RLS enabled at creation); lib/conversations/share.ts (create/revoke/getToken gated on user_id=owner; getSharedConversation resolves token→thread ref, pure DB, no mastra-index import to avoid circular build break); routes/conversations.ts (auth-exempt /conversations/public/:token; public handler loads msgs via memory.recall by thread id); web /c/[shareToken] read-only page (ai-elements Message/MessageResponse, text parts only), conversations-client, /c/ middleware allowlist, chat/actions server actions, share-button Popover (create/copy/revoke) in chat-header (owner-only). Token decoupled from visibility (private chat can still have a public link). Verified live: owner mint→anonymous read 200 (4 msgs, title resolved)→status echo→non-owner mint 404→revoke→post-revoke 404→bogus 404. Commits aefbeee+5ca17bb. Gates: agents tsc + web tsc + biome(8) + 342 agents tests all green.","dependencies":[{"issue_id":"foreman-mk25","depends_on_id":"foreman-28cz","type":"discovered-from","created_at":"2026-06-27T10:59:55Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-m6se","title":"Rename user-facing Dashboards → Apps (built data-apps: dashboards, internal tools)","description":"User reframes the built-artifact surface as 'Apps' — things Foreman builds with code from pulled Zapier data (a dashboard is one kind of app; internal tools etc. are others). Rename USER-FACING copy only: nav 'Dashboards'→'Apps'; page/breadcrumb headings; public share 'Shared dashboard'→'Shared app'; chat build status 'Building dashboard…'→'Building app…'; landing 'Live dashboards'/'Ask for a dashboard'→Apps; create_dashboard tool description/output/error reframed as building an 'app' (so the agent also triggers on 'build an app'). KEEP internal identifiers (routes /dashboards + /d/, tables artifact/dashboard_share, tool ID create_dashboard, file/component/module names) to avoid a risky migration. Resolves the 'apps' collision: Apps = what Foreman builds; connected apps/integrations = what you connect (catalog wording unchanged).","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-27T15:47:45Z","created_by":"HamChowderr","updated_at":"2026-06-27T15:55:10Z","started_at":"2026-06-27T15:47:53Z","closed_at":"2026-06-27T15:55:10Z","close_reason":"User-facing Dashboards→Apps rename shipped (Apps = built data-apps: dashboards, internal tools). nav/pages/share/chat-status/landing/agent-tool copy reframed as 'app'; internals (routes/tables/tool-id/files) unchanged. tsc+biome clean. Catalog 'connected apps' wording left as-is per the Apps-vs-connected-apps taxonomy.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-5e6p","title":"RLS policies via is_workspace_member() (defense-in-depth for workspace_id boundary)","description":"Core tables have RLS ENABLED but with NO policies (only service_role, which the agent server uses, can read/write — bypassing RLS). Add real RLS policies keyed on is_workspace_member(workspace_id, auth.uid()) so workspace_id is a true security boundary for any authenticated (non-service-role) access, as defense-in-depth behind the app-layer workspace scoping. Covers chat/document_share/automation/dashboard/artifact + the new document spaces.","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-27T15:07:09Z","created_by":"HamChowderr","updated_at":"2026-06-27T17:28:47Z","started_at":"2026-06-27T17:15:25Z","closed_at":"2026-06-27T17:28:47Z","close_reason":"Added workspace-scoped RLS policies (migration 20260627000002): ENABLE RLS on document_share + 7 SELECT policies keyed on is_workspace_member(auth.uid(), workspace_id) — conversation (owner OR workspace/public-visible member), artifact/app_data_snapshot/dashboard_share/document_share/automation/automation_run (any member). Defense-in-depth behind the app-layer scoping (swfe+28cz, verified live); adds zero new exposure since authenticated holds no table grant (house posture — even workspaces/app_catalog don't), so policies are the latent boundary. Verified in rolled-back txns: conversation owner=both/member=workspace-only/non-member=none; artifact member=own-ws/non-member=foreign-only. SELECT-only (mutations stay app-layer). Commit 133d4e1.","dependencies":[{"issue_id":"foreman-5e6p","depends_on_id":"foreman-wl54","type":"discovered-from","created_at":"2026-06-27T08:07:08Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-ybif","title":"Public dashboard share page /d/[shareToken] redirects logged-out viewers to login","description":"The Next 16 proxy.ts middleware allowlist (web src/lib/middleware.ts updateSession) exempts /, /docs, /compare, /login, /auth from the auth redirect — but NOT /d/. So an unauthenticated viewer opening a shared dashboard link /d/\u003ctoken\u003e is redirected to /auth/login instead of seeing the public share page, defeating dashboard sharing. Found while building document sharing (foreman-jz14), where the identical gap blocked /doc/\u003ctoken\u003e until /doc/ was added to the allowlist. Fix: add !pathname.startsWith('/d/') to the same allowlist in src/lib/middleware.ts. Verify a logged-out /d/\u003cvalid-token\u003e renders.","status":"closed","priority":2,"issue_type":"bug","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-27T05:21:50Z","created_by":"HamChowderr","updated_at":"2026-06-27T05:28:52Z","started_at":"2026-06-27T05:27:55Z","closed_at":"2026-06-27T05:28:52Z","close_reason":"Added !pathname.startsWith('/d/') to the proxy allowlist (src/lib/middleware.ts). Verified: logged-out /d/\u003ctoken\u003e now 200 instead of 307→login; /doc/ still public, /chat still gated.","dependencies":[{"issue_id":"foreman-ybif","depends_on_id":"foreman-jz14","type":"discovered-from","created_at":"2026-06-26T22:21:50Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-ugu3","title":"Agent cites knowledge docs with AI Elements inline-citation","description":"When the agent answers from knowledge docs (via Workspace.search/doc-RAG), cite them with the AI Elements inline-citation component (InlineCitation/InlineCitationCard/CardTrigger/Source/Quote/Carousel; deps badge+carousel+hover-card already in our registry; install from elements.ai-sdk.dev, rewrite @/registry/default/ -\u003e @/components/ui/). Wire: agent emits citation markers referencing doc paths -\u003e message renderer maps to \u003cInlineCitation\u003e whose source = the doc (title + snippet + button that opens the KnowledgePanel). Most meaningful once doc-RAG surfacing is wired (agent retrieves docs via Workspace.search then cites). Verified inline-citation is a real, valid AI Elements registry entry (2026-06-26).","notes":"VERIFIED LIVE (clean single server, real test-user token, real agent run). Asked Foreman 'what is in my Q3 launch plan, cite it' -\u003e agent called mastra_workspace_search + list_files + read_file (3x each) then emitted 3 well-formed citations: [\u003cclaim\u003e](doc:documents/q3-launch-plan.md \"Q3 Launch Plan\") for goal/timeline/risks. Renderer: message.tsx StreamdownLink branches href.startsWith('doc:') -\u003e DocCitation (AI Elements InlineCitation primitives, button not anchor -\u003e bypasses Streamdown linkSafety) -\u003e useKnowledgePanel().open({path,title}) opens the side panel. inline-citation.tsx vendored from registry.ai-sdk.dev (deps badge/carousel/hover-card already present; imports already @/components/ui). tsc(agents+web)+biome clean. Commit 5658690. NOT captured: browser screenshot of the rendered badge (agent-browser still dropping auth/tab-jumping); emission proven via HTTP + render branch is trivial+typechecked. Also cleaned up a process tangle: 2 stale 'mastra dev' watchers had each respawned an output server fighting over mastra.duckdb (lock error); killed all, started one clean server.","status":"closed","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-27T03:12:37Z","created_by":"HamChowderr","updated_at":"2026-06-27T05:05:02Z","started_at":"2026-06-27T04:54:07Z","closed_at":"2026-06-27T05:05:02Z","close_reason":"Agent cites knowledge docs with AI Elements inline-citation. Prompt guides search+cite via a doc: markdown-link scheme; web renders DocCitation that opens the KnowledgePanel. Verified live: real agent searched/read the Q3 doc and emitted 3 correct doc: citations. Commit 5658690.","dependencies":[{"issue_id":"foreman-ugu3","depends_on_id":"foreman-aqjx","type":"discovered-from","created_at":"2026-06-26T20:12:36Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-jz14","title":"Share knowledge documents (public link + teammate/space)","description":"Sharing for knowledge docs (foreman-aqjx + collaboration foreman-wl54), two modes: (1) PUBLIC LINK — mint a read token, GET /documents/public/:token, mirroring the existing dashboard_share pattern (supabase/migrations dashboard_share + lib/dashboards/share + share-button.tsx). Quick win. (2) TEAMMATE/SPACE — docs in a shared space (vs personal documents/) visible to other members of the same workspace; needs multi-member workspace resolution + visibility (foreman-wl54). Maps to the demo's personal vs shared Spaces. Recommend: public-link first (reuses dashboards code), then space-scoped teammate sharing with wl54.","notes":"PUBLIC-LINK MODE SHIPPED + verified live (commit e9d188b). document_share table (migration 20260627000000, applied via 'migration up' non-destructively, types regenerated) mirrors dashboard_share. lib/documents/share.ts create/revoke/getToken/getSharedDocument; public read resolves the OWNER's workspace fs via the trusted workspace_id on the row (no viewer auth, no cross-tenant leak). Routes POST/GET/DELETE /documents/share (authed) + GET /documents/public/:token (the '*' middleware skips only /documents/public/). Web: KnowledgePanel Share button (popover create-link/copy/stop), logged-out /doc/[token] page, added /doc/ to proxy.ts allowlist. Verified: full mint-\u003epublic-read-\u003estate-\u003erevoke-\u003e404 lifecycle + web page renders (200) / bad token not-found no-leak. REMAINING: teammate/space sharing (personal vs shared Spaces) — rides on collaboration epic foreman-wl54.","status":"closed","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-27T03:12:31Z","created_by":"HamChowderr","updated_at":"2026-07-05T03:26:27Z","closed_at":"2026-07-05T03:26:27Z","close_reason":"Shipped: e9d188b feat(knowledge) public-link doc sharing + explicit close commit 550993e; document_share table exists. Prior close clobbered by bd #4128.","dependencies":[{"issue_id":"foreman-jz14","depends_on_id":"foreman-aqjx","type":"discovered-from","created_at":"2026-06-26T20:12:30Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-udji","title":"Document versioning for the knowledge layer","description":"Today save_document OVERWRITES documents/\u003cslug\u003e.md (update-on-same-title, no history). Add version history that fits the Workspace-files model (NOT a DB documents table): on each save, snapshot prior content to a history location (e.g. documents/.history/\u003cslug\u003e/\u003cts\u003e.md) keeping \u003cslug\u003e.md as current; KnowledgePanel gets a version list + view/restore. AI Elements Artifact + the orphaned chatbot version-footer UI are reusable references. Verified live 2026-06-26: save_document -\u003e chip -\u003e KnowledgePanel renders markdown (Q3 Launch Plan demo).","notes":"APPROACH (user: use Mastra's primitive): version docs on the Mastra content-addressable BlobStore (@mastra/core storage/domains/blobs — SHA-256 keyed put/get/has/getMany, natural dedup) + a per-doc version-tree manifest (mirrors SkillVersionTree {path-\u003e{blobHash,size,mimeType}}). On each save: hash markdown -\u003e blobStore.put -\u003e append {version,blobHash,createdAt} to the doc manifest; keep documents/\u003cslug\u003e.md as the LIVE copy so the agent's Workspace file tools + bm25 search see current content. New routes: GET /documents/:path/versions, /versions/:n (blobStore.get), POST /restore. KnowledgePanel gets a version dropdown (view/restore). OPEN at build: how to reach the storage BlobStore instance (MastraEditor.getBlobStoreProviders() or a @mastra/pg BlobStore; editor falls back to the Mastra storage blob store). Note: MastraEditor itself is versioned-ENTITY CRUD (agents/prompts/mcp/scorers, draft/published) — no document namespace; the BlobStore is the right lower-level primitive.\nBUILT + mechanism-verified, committed b437827. Mastra primitive = BlobsPG (concrete BlobStore) over DATABASE_URL via REST connectionString config; init() creates mastra_skill_blobs. BlobStore=content (SHA-256 dedup); per-doc manifest documents/.history/\u003cslug\u003e.json in per-tenant Workspace fs = version tree. Files: lib/documents/blob-store.ts, lib/documents/versions.ts (record/list/getVersion/restore; dedup skips identical re-save; restore writes live + appends new rev; only manifest hashes fetched = no cross-tenant leak). save-document records a version post-write. Routes: GET /documents/versions, GET /documents/version, POST /documents/restore. Web: KnowledgePanel version dropdown + Restore. VERIFIED via tsx probes (BlobsPG vs local PG; full flow vs real contained LocalFilesystem) all PASS; tsc+biome clean. PENDING: live in-browser demo (4111 dev server currently stale/crashed; needs clean infisical-run restart).\nLIVE E2E VERIFIED (fresh server, real test-user token, real agent). Agent save_document calls accumulated v1(55B)-\u003ev2(82B)-\u003ev3(100B) via real LLM tool calls (dedup-aware append). GET /documents/versions returned correct ordering. POST /documents/restore {version:1} -\u003e 200 current:4, prepended v4 note 'restored from v1' (append-only [v4,v3,v2,v1]); live /documents/content == exact v1 bytes. Route validation: nonexistent-\u003e200 empty shape, missing version-\u003e404, bad path-\u003e400. VISUAL: earlier agent-browser snapshot confirmed save chip rendered + KnowledgePanel opened with the version dropdown (combobox) + doc headings. NOT captured: polished screenshot of expanded dropdown/restore — agent-browser session kept dropping auth + tab-jumping to a stale Provisr tab (documented flakiness), not a feature gap. Feature complete.","status":"closed","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-27T02:56:10Z","created_by":"HamChowderr","updated_at":"2026-06-27T04:24:43Z","started_at":"2026-06-27T03:21:40Z","closed_at":"2026-06-27T04:24:43Z","close_reason":"Document versioning shipped on Mastra's BlobStore primitive + per-doc version-tree manifest. Built, offline-probed, and verified LIVE end-to-end (real agent save-\u003ev1/v2/v3, restore-\u003ev4, content==v1). Commit b437827. Only gap is a cosmetic screenshot blocked by agent-browser flakiness.","dependencies":[{"issue_id":"foreman-udji","depends_on_id":"foreman-aqjx","type":"discovered-from","created_at":"2026-06-26T19:56:10Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-6r9y","title":"Inbox intelligence: prioritization + teammate aggregation","description":"getWorkspaceInbox today lists only the requesting users own automations, sorted chronologically. Add (a) importance/urgency prioritization scoring and (b) aggregation of teammate-owned items in the same workspace. Prioritization and the what-should-I-work-on view must work over ANY user-selected subset of the full 9000+ app catalog (cross-app reach already exists via ToolSearch) — not a fixed app list.","design":"Extend getWorkspaceInbox to include workspace-member automations (respect E2 visibility); add a scoring pass; optional what-to-work-on capability over arbitrary catalog apps.","acceptance_criteria":"Inbox shows a ranked list including teammate items; a what-to-work-on view synthesizes across any chosen catalog apps.","status":"open","priority":2,"issue_type":"epic","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-27T02:02:37Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:54Z","dependencies":[{"issue_id":"foreman-6r9y","depends_on_id":"foreman-2vpb","type":"discovered-from","created_at":"2026-06-26T19:02:37Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-gp4h","title":"Chat-with-dashboard: artifact round-trip + persist preview_app","description":"Close the dashboard loop. Add agent tools to load and query persisted artifacts (load_dashboard / query_artifact), an artifact reference in chat (@dashboard), and persist preview_app output to the artifact table so the live React apps are reloadable. Audit: the agent can CREATE dashboards (create_dashboard, persistent) but has no tool to load/introspect them back; preview_app is ephemeral (local Vite URL, nothing saved). Builds on foreman-ltc7.","design":"Expose the existing /dashboards/artifacts/:id read path as agent tools; context-inject referenced artifacts; save preview_app TSX as an artifact.","acceptance_criteria":"User loads a saved dashboard into a chat and asks about its data; the agent reads the artifact spec+snapshot and can pull more data in.","status":"open","priority":2,"issue_type":"epic","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-27T02:02:31Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:45Z","dependencies":[{"issue_id":"foreman-gp4h","depends_on_id":"foreman-ltc7","type":"blocks","created_at":"2026-06-26T19:02:56Z","created_by":"HamChowderr","metadata":"{}"},{"issue_id":"foreman-gp4h","depends_on_id":"foreman-2vpb","type":"discovered-from","created_at":"2026-06-26T19:02:31Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-88oj","title":"Remove duplicate sidebar-collapse trigger from AppShell header","description":"AppShell pages (Automations, Inbox, Dashboards, Workspaces, Settings) showed TWO sidebar-collapse controls: one in app-shell.tsx's top header (SidebarTrigger) and one in the sidebar itself (app-sidebar.tsx). User: keep the sidebar one, remove the header one. Pages render their own \u003cmain\u003e+title, so the header existed only for the trigger -\u003e drop the redundant header entirely. Sidebar keeps full collapse/expand affordance (SidebarTrigger when expanded; logo hover 'Open sidebar' when collapsed).","status":"closed","priority":2,"issue_type":"bug","owner":"admin@otakusolutions.io","created_at":"2026-06-27T01:30:15Z","created_by":"HamChowderr","updated_at":"2026-06-27T01:31:48Z","closed_at":"2026-06-27T01:31:48Z","close_reason":"Removed redundant AppShell header; sidebar owns the sole collapse control. Biome green, committed 9b90042.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-8nyg","title":"Graduate preview to the Mastra workspace agent harness","description":"Phase 2: replace one-shot preview_app with the agent driving real Mastra workspace tools (write_file/edit_file/execute_command) to scaffold an app, run it, read errors, and iterate — visible file+terminal steps in the panel/console. The genuine v0/Bolt experience. Needs approval-gating + sandbox isolation/security. Follows the hybrid quick wins.","notes":"CORE SHIPPED + verified in headed browser: agent builds a REAL React component from the project's shadcn/ui components (Card/Badge/Chart) + recharts, rendered live via a warm Vite dev server (preview-template, :7332). Sonnet→preview_app(brief)→Haiku writes TSX→startReactPreview writes generated.tsx + spawns Vite→iframe. Build feed adapted (Designing→Compiling with Vite→Live). Remaining polish (separate): error→iterate loop feeding Vite errors back, per-tenant isolation (foreman-jgme), security/cloud (parked).","status":"in_progress","priority":2,"issue_type":"epic","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T21:30:49Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-06-26T22:35:51Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-7tci","title":"Live build/console feed for preview_app","description":"preview_app emits writer.custom progress parts (generating / writing file / starting server / live URL) rendered in the artifact console, replacing the static 'Building live preview…'. writer.custom already flows agent-\u003eclient (connect-zapier, fork-conversation).","status":"closed","priority":2,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-06-26T21:30:40Z","created_by":"HamChowderr","updated_at":"2026-06-26T21:58:28Z","closed_at":"2026-06-26T21:58:28Z","close_reason":"preview_app streams a non-transient data-preview-progress part per stage (design/build/ready); message.tsx renders them as a checkmark build feed. Verified in-browser: 'Designing the page…' -\u003e 'Writing into the sandbox…' -\u003e 'Preview is live.' stream live, replacing the opaque 'Building live preview…'.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-fq71","title":"Swap custom web-preview for the official Vercel AI Elements component","description":"Our inline preview used a hand-written 'AI Elements style' web-preview.tsx. Replace it with the official Vercel AI Elements web-preview component (fuller-featured: editable URL nav, WebPreviewNavigationButton, WebPreviewConsole). Pulled the verbatim source from registry.ai-sdk.dev/web-preview.json and wired message.tsx to the official compound API. Note: the bare 'npx ai-elements@latest' (no subcommand) tries to add ALL components interactively and pulls heavy unrelated deps (xyflow, rive, media-chrome) — reverted that; the real component needs zero new deps (button/collapsible/input/tooltip + lucide already present).","acceptance_criteria":"web-preview.tsx is the official registry source; message.tsx uses WebPreview/WebPreviewNavigation/WebPreviewUrl/WebPreviewNavigationButton/WebPreviewBody; no new deps added; biome clean; web tsc 0 errors.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-26T20:58:27Z","created_by":"HamChowderr","updated_at":"2026-06-26T20:58:49Z","closed_at":"2026-06-26T20:58:49Z","close_reason":"Official web-preview.tsx pulled from registry.ai-sdk.dev + message.tsx rewired to its compound API. Zero new deps; biome clean; web tsc 0 errors.","dependencies":[{"issue_id":"foreman-fq71","depends_on_id":"foreman-qq4x","type":"discovered-from","created_at":"2026-06-26T13:58:27Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-yhen","title":"Add Supabase Platform Kit on a page (cloud-only)","description":"Embed the Supabase Platform Kit UI on a page (manage the Supabase project/data in-app). CLOUD-ONLY: depends on the hosted Supabase Management API; does NOT work against the local supabase CLI stack. Gate it to cloud mode (hide/disable when self_hosted/local via FOREMAN_MODE). Research exact Platform Kit components + Management API scopes when building.","status":"open","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T18:27:43Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:55Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-691a","title":"Hosted cloud sandbox provider (E2B or Daytona) + preview URLs + cost controls","description":"Hosted product: per-tenant cloud sandboxes (E2B or Daytona) with public preview URLs to iframe, plus Docker for self-host isolation. Pick E2B (mature AI DX, 150/mo base) vs Daytona (no base, 200 credit, fast starts) after the spike. Add lifecycle (idle shutdown) and per-tenant cost caps. ~1 cent/session; base fee is the cost driver.","status":"open","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T18:21:29Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:55Z","dependencies":[{"issue_id":"foreman-691a","depends_on_id":"foreman-ltc7","type":"discovered-from","created_at":"2026-06-26T11:22:51Z","created_by":"HamChowderr","metadata":"{}"},{"issue_id":"foreman-691a","depends_on_id":"","type":"discovered-from","created_at":"2026-06-26T11:21:28Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-7m3f","title":"Data-out: live preview embed surface in Foreman (iframe a running sandbox server)","description":"Embed a running sandbox server in Foreman: expose the server port then provider preview URL (E2B getHost / Docker port-map / Local localhost) then iframe in a chat Artifact kind or a dashboard view. Security: iframe sandboxing, auth-scoped preview. Complements the existing constrained DashboardSpec path which stays for cheap/safe dashboards.","status":"closed","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T18:21:23Z","created_by":"HamChowderr","updated_at":"2026-07-05T04:52:45Z","closed_at":"2026-07-05T04:52:45Z","close_reason":"DONE: live preview embed iframes running server (preview-panel.tsx WebPreview; cab81f9).","dependencies":[{"issue_id":"foreman-7m3f","depends_on_id":"foreman-ltc7","type":"discovered-from","created_at":"2026-06-26T11:22:45Z","created_by":"HamChowderr","metadata":"{}"},{"issue_id":"foreman-7m3f","depends_on_id":"","type":"discovered-from","created_at":"2026-06-26T11:21:23Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-gnd7","title":"Data-in bridge: agent fetches Zapier data into the workspace for the sandbox","description":"Agent calls a Zapier SDK tool (run-action/tables/fetch) then writes JSON into the mounted workspace FS then sandbox code reads it. Mostly system-prompt orchestration once the mount exists; optionally a helper tool. Net-new pattern.","status":"open","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T18:21:18Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:55Z","dependencies":[{"issue_id":"foreman-gnd7","depends_on_id":"foreman-ltc7","type":"discovered-from","created_at":"2026-06-26T11:22:40Z","created_by":"HamChowderr","metadata":"{}"},{"issue_id":"foreman-gnd7","depends_on_id":"","type":"discovered-from","created_at":"2026-06-26T11:21:17Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-wko7","title":"Expose all Mastra memory types incl. shared team memory","description":"Foreman today uses per-conversation memory + semantic recall (search_history RAG). Expose the full Mastra memory engine: working memory, semantic recall, and a SHARED TEAM BRAIN (decisions/docs/context remembered across people) — parity with Zapier Shared Brain's core strength. The /compare matrix currently marks 'Shared team brain across people' as Soon for Foreman; this issue delivers it (then flip Soon -\u003e yes). Be honest in copy until shipped.","status":"open","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T11:07:24Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:55Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-vb78","title":"User-installable skills shared across the team","description":"Let a user add skills the agent can use (Claude-Code-style skills), and share them across their workspace/team so the whole team's agent can use them. This is the Foreman analog to Zapier Shared Brain's 'shared skills'. Build on Mastra. NOTE: the /compare/zapier-shared-brain matrix intentionally does NOT yet claim this for Foreman — when shipped, add a 'User-installable / team-shared skills' row (Foreman yes). Related: epic foreman-jy1w (marketing).","status":"open","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T11:07:19Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:55Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-4gxt","title":"Landing + comparison honesty/UX pass (10k count, vs-matrix, hero multi-app, sticky nav)","description":"Refinement pass on the marketing surfaces (part of epic foreman-jy1w). (1) /compare/zapier-shared-brain: honest ICP framing — Shared Brain ICP = satisfied non-builder; removed false 'many teams will run both' claim; replaced prose table with a balanced 12-row checkmark feature matrix (yes/no/Soon); stopped framing shared-team-memory as Shared-Brain-only. (2) Hero agent animation cycles 5 apps (Slack/HubSpot/Stripe/Calendar/Notion), shows approve AND decline, fixed scenario bottom-\u003etop animation glitch via AnimatePresence mode=wait keyed per scenario. (3) More-in-Foreman: dropped Voice, promoted Dashboards + Workspaces to rich feature blocks with visual mockups; removed SQL/BI jargon. (4) Connection count corrected 9,000+ -\u003e 10,000+ everywhere (web + agents, 13 files). (5) Sticky nav fix: overflow-x-hidden -\u003e overflow-x-clip on landing/compare wrappers (overflow-x:hidden broke position:sticky). (6) Removed MCP from the hero chat-channel list (MCP/A2A are integration surfaces, not chat). next build green, biome clean.","status":"open","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T11:06:59Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:55Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-zfxb","title":"[web] Foreman vs Zapier Sidekick (Shared Brain) comparison page — non-bashing","description":"New marketing page comparing Foreman to Zapier Sidekick ('The AI workspace that thinks alongside your team' / 'Shared Brain', sidekick.zapier.com). RESEARCH (2026-06-26): Sidekick = Zapier's first-party hosted AI workspace for TEAMS; a shared 'brain' that remembers every conversation/decision/document; shared skills ('skills anyone builds, everyone can run'); personal assistant taking real actions across 10,000+ integrations; team collaboration focus; requires a Zapier account; early access (used internally, 1M+ actions). FAIR/NON-BASHING framing: different shapes, not pure rivals. Foreman = open, multi-channel chat DRIVER for the Zapier account you already have (Slack/Discord/Teams/Telegram/etc.), self-hostable (MIT, one Docker container), approval-gated/audit-logged, your data/infra, built ON the Zapier SDK (complementary). Sidekick = all-in-one hosted team AI workspace w/ shared team knowledge/memory (a genuine strength Foreman doesn't match — say so honestly). Page: honest 'what each is', a balanced comparison table, 'when to choose which', note Foreman is built on Zapier. Route ~ /compare/zapier-sidekick, reuse SiteNav+SiteFooter.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-26T08:26:01Z","created_by":"HamChowderr","updated_at":"2026-06-26T08:52:34Z","closed_at":"2026-06-26T08:52:34Z","close_reason":"Shipped + verified live. New public route /compare/zapier-sidekick: honest, non-bashing Foreman vs Zapier Sidekick (Shared Brain) page — hero, two 'what each is' cards, a 9-row balanced comparison table (credits Sidekick's shared-team-brain as 'its core strength'), 'when to choose which' two-column, and a 'not really rivals — built on the Zapier SDK' close + CTA. Reuses SiteNav/SiteFooter. Fixed: added /compare to the web middleware public allowlist (was redirecting to /auth/login). Verified: next build green; page renders.","dependencies":[{"issue_id":"foreman-zfxb","depends_on_id":"foreman-jy1w","type":"discovered-from","created_at":"2026-06-26T01:26:00Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-dph0","title":"[web] Homepage sections for new features — Automations (flagship), Dashboards, Workspaces, Voice","description":"Add landing sections (matching existing Reveal/section style) to app/page.tsx showcasing the new things: durable Automations (build from chat, durable execution, live run-status), Dashboards, Workspaces/multi-tenant, Voice. Default: sections in the single scroll (not separate pages).","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-26T08:25:55Z","created_by":"HamChowderr","updated_at":"2026-06-26T08:36:04Z","closed_at":"2026-06-26T08:36:04Z","close_reason":"Homepage feature showcase done + verified live. Automations = full flagship section w/ live run-status demo (11ae5c0). Dashboards + Workspaces + Voice = one compact 3-card 'More in Foreman' section (avoids scroll bloat vs 3 more full sections). All four new capabilities now showcased on the landing page.","dependencies":[{"issue_id":"foreman-dph0","depends_on_id":"foreman-jy1w","type":"discovered-from","created_at":"2026-06-26T01:25:55Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-jy1w","title":"[web][marketing] Homepage feature showcase + Zapier Sidekick comparison + UI polish sweep","description":"User-directed marketing/UX batch (2026-06-26): (1) add homepage sections showcasing the new capabilities; (2) a fair, non-bashing Foreman-vs-Zapier-Sidekick comparison page; (3) apply the make-interfaces-feel-better skill across app surfaces.","status":"open","priority":2,"issue_type":"epic","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T08:25:50Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-pe0w","title":"[web][brand] Drop 'alpha', use Zapier logo as the mark, add not-affiliated disclaimer","description":"User-directed branding pass on the marketing site + auth: (1) remove every 'Alpha'/'alpha' label + stage copy across auth-shell, site-nav, site-footer, docs-banner, closing-cta, hosting; (2) replace the orange 'F' square mark with the Zapier logo (/zapier.svg) everywhere it appears (auth-shell desktop+mobile, site-nav, site-footer) to match brand-header; (3) add a footer disclaimer: Foreman is not affiliated with / endorsed by Zapier; it is an independent product built on the Zapier SDK. User accepts the Zapier-logo + disclaimer pairing (decided 2026-06-26).","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-26T07:41:23Z","created_by":"HamChowderr","updated_at":"2026-06-26T07:47:13Z","closed_at":"2026-06-26T07:47:13Z","close_reason":"Done + visually verified on the running dev server. Removed every Alpha/alpha label + stage copy (auth-shell, site-nav, site-footer, hosting ×4, docs-banner, closing-cta; internal STORAGE_KEY left as-is, not user-visible). Swapped the orange 'F' square in auth-shell (desktop+mobile) to /zapier.svg — nav/footer/brand-header already used it. Added footer disclaimer: not affiliated/endorsed/sponsored by Zapier; independent product built on the Zapier SDK; Zapier is a trademark of Zapier, Inc. Biome clean; login + footer screenshotted.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-nk7s","title":"[durable] Stuck-run give-up cap in reconcile (bounded, not blunt)","description":"reconcilePendingRuns re-polls non-terminal runs forever. Add a bounded give-up that fails GENUINELY-stuck runs without killing legit long-running durables (waits/callbacks run for days).","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-26T05:53:21Z","created_by":"HamChowderr","updated_at":"2026-06-26T05:53:33Z","closed_at":"2026-06-26T05:53:33Z","close_reason":"DONE. STUCK_RUN_TIMEOUT_MS (env FOREMAN_RUN_STUCK_TIMEOUT_MS, default 15min). reconcilePendingRuns now fails a run ONLY when genuinely stuck: (1) no trigger_id past timeout = claimed-but-never-dispatched (worker crash between claim and fire) — listPendingRuns broadened to include 'initialized' rows for this; (2) no durable_run_id past timeout = trigger never spawned a durable; (3) SDK/owner error (e.g. ZapierNotConnected) past timeout = reconcile gave up. A linked-and-still-running durable is NEVER capped (durables run for days; failures retry 5x over ~2-3min and reach 'failed' naturally — confirmed run-failed-probe.ts). Marks status='failed' with an error reason. Tests: 3 new cap cases (worker suite 12 green). biome+tsc clean.","dependencies":[{"issue_id":"foreman-nk7s","depends_on_id":"foreman-480k","type":"discovered-from","created_at":"2026-06-25T22:53:21Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-jc12","title":"[durable] Surface durable failure/retry detail (execution.operations) on runs","description":"A failing step RETRIES (engine default) and the run stays 'started' during retries; the real failure lives in getDurableRun.execution (summary.last_error, operations[].retry_count/error/next_retry_at), not the top-level status (proven by run-failed-probe.ts). Today Foreman only stores top-level status+error, so a retrying/failing run looks like a stalled 'started'. Consider: reconcile reads execution.summary.last_error / retry state and surfaces it (a 'retrying' substatus or last_error on the run) so users see WHY a run is stuck, not just that it is.","status":"open","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T05:50:52Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:55Z","dependencies":[{"issue_id":"foreman-jc12","depends_on_id":"foreman-l7xq","type":"discovered-from","created_at":"2026-06-25T22:50:52Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-dwf8","title":"[durable] Surface inbox initialization_failure on the automation","description":"When an inbox can't subscribe (missing/expired connection, bad inputs) it goes status=initialization_failure (seen in the spike). The worker's ensureInbox returns it but nothing marks the AUTOMATION as broken — the user sees an enabled automation that silently never fires. Fix: when runInboxCycleForAutomation sees inbox.status=initialization_failure, set automation.status='trigger_failed' (or similar) + surface in the /automations UI so the user knows to reconnect.","status":"open","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T05:50:45Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:55Z","dependencies":[{"issue_id":"foreman-dwf8","depends_on_id":"foreman-l7xq","type":"discovered-from","created_at":"2026-06-25T22:50:44Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-y4kc","title":"[durable] Cancel a running automation run (cancelDurableRun) — route + UI","description":"The SDK exposes cancelDurableRun({run}). Foreman has no way to cancel a long-running/stuck durable run. Add: lib/durable.cancelRun + service + DELETE/POST /automations/runs/:id/cancel + a Cancel action in the /automations Runs tab. On cancel, updateRun status='cancelled' (add to the vocabulary).","status":"open","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T05:50:38Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:55Z","dependencies":[{"issue_id":"foreman-y4kc","depends_on_id":"foreman-l7xq","type":"discovered-from","created_at":"2026-06-25T22:50:37Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-rm8z","title":"[durable] Human-approval callbacks: surface ctx.createCallback URL + resume endpoint","description":"Durables support ctx.createCallback (a callback URL + payloadSchema + timeoutSeconds up to days) for human-in-the-loop approval gates — the run pauses (execution.status=waiting) until the URL is POSTed. Foreman doesn't surface this yet: a paused automation_run needs its callback URL exposed (route + /automations UI 'approve/deny' action) and a way to resume. This is the big durable capability not yet wired. Reconcile already leaves waiting runs as 'started' (correct).","status":"open","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T05:50:28Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:55Z","dependencies":[{"issue_id":"foreman-rm8z","depends_on_id":"foreman-l7xq","type":"discovered-from","created_at":"2026-06-25T22:50:28Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-480k","title":"[durable] Worker run-status reconcile: poll trigger→durable_run_id to terminal status","description":"The live loop test (foreman-hnbx) showed the inbox worker records automation_run at TRIGGER time with status='started' and durable_run_id=null, because triggerWorkflow→durable_run_id is async (Zapier resolves it shortly after). So a run row never advances past 'started' in Foreman even though the durable finishes on Zapier — the /automations Runs tab would show stale status. FIX: a reconcile step (a later worker pass, or poll-with-backoff in dispatchMessage) that calls getTriggerRunStatus/getWorkflowRun until durable_run_id + terminal status resolve, then updateRun. Low-risk; the run DID fire (trigger_id recorded).","acceptance_criteria":"a completed durable run shows durable_run_id + terminal status (finished/failed) in automation_run, not 'started'.","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T05:18:11Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-06-26T05:24:38Z","closed_at":"2026-06-26T05:37:57Z","close_reason":"Run-status reconcile DONE + lifecycle fully mapped (empirically, scripts/run-status-probe.ts). REAL state machine: the TRIGGER run (getTriggerRun) status stays 'started' for the run's whole life — it only exposes durable_run_id (which lags the trigger ~4s). The DURABLE run (getDurableRun) is authoritative: started→finished/failed (execution.status: running→waiting→completed). So the worker was reading the wrong field. FIX: (1) dispatchMessage now fire-and-records (status='started' + trigger_id, NO blocking poll — durables can run for days). (2) new reconcilePendingRuns(): lists non-terminal fired runs (store.listPendingRuns), resolves each owner's SDK, follows trigger_id→(getTriggerRun)durable_run_id→(getDurableRun)→terminal status+output/error, updateRun. Runs every worker tick after the inbox cycle. (3) status vocabulary documented in store.ts: initialized→started→finished/failed. PROVEN LIVE (durable-loop-smoke + reconcile): run advanced started→finished in ~12s with the durable's real output captured in automation_run. Gates: vitest 349 (+3 reconcile tests), biome, tsc clean. Test-harness note: reconcile self-resolves SDK per owner; the fake-user smoke needs FOREMAN_MODE=dev for CLI-login fallback (real automations have a real owner connection).","dependencies":[{"issue_id":"foreman-480k","depends_on_id":"foreman-hnbx","type":"discovered-from","created_at":"2026-06-25T22:18:11Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-ut8n","title":"[durable] M4: web UI — /automations CRUD + trigger-inbox visibility","description":"Net-new web surface (parent foreman-l7xq; needs M2 routes). The entire old /workflows UI was removed with the engine (82b24fb) — nothing exists today. SCOPE: (1) /automations route — list, create, detail, run history (web-\u003eagent service_role pattern via data/ server actions + Bearer token, like data/workspaces.ts). (2) INBOX VISIBILITY view (explicitly requested): bound app/action/connection, inbox status (initializing/active/initialization_failure), recent leased messages with lease_count + possible_duplicate_data flags. (3) sidebar entry. Next.js 16 conventions (async createClient, Promise params, no react-hook-form — Field+useState).","acceptance_criteria":"next build passes with /automations route; create+list+inspect work end-to-end against the agent routes; inbox view renders live inbox state; biome green.","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T02:30:52Z","created_by":"HamChowderr","updated_at":"2026-06-26T04:03:52Z","started_at":"2026-06-26T03:46:56Z","closed_at":"2026-06-26T04:03:52Z","close_reason":"M4 shipped: web /automations + trigger-inbox visibility. BACKEND: lib/trigger-inbox.listInboxMessages; service.getInboxView (live getTriggerInbox + listTriggerInboxMessages for an automation's trigger_inbox_id, workspace-scoped); route GET /automations/:id/inbox. WEB (Next.js 16, web-\u003eagent pattern): data/automations.ts server actions (list/get/inbox/run/enable/rename/delete forwarding the Supabase Bearer) + data/automations-types.ts; app/automations/page.tsx (auth-gated); components/automations/automations-manager.tsx — master list + detail with enable Switch, Run-now, Delete (2-step), and Runs/Trigger-inbox tabs (inbox shows status + app/action subscription + recent messages with lease_count/possible_duplicate_data); sidebar Automations link. Creation is chat-driven (agent authors the durable source) so no create form. Gates: next build exit 0 (/automations page artifact built), agent vitest 346 pass, tsc clean on all M4 backend files, biome clean (agent+web).","dependencies":[{"issue_id":"foreman-ut8n","depends_on_id":"foreman-l7xq","type":"discovered-from","created_at":"2026-06-25T19:30:51Z","created_by":"HamChowderr","metadata":"{}"},{"issue_id":"foreman-ut8n","depends_on_id":"foreman-l23t","type":"blocks","created_at":"2026-06-25T19:31:28Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-37e6","title":"[durable] M3: trigger-inbox poll worker (lease -\u003e dedup -\u003e dispatch -\u003e ack)","description":"The runtime loop that turns inbox events into durable runs (parent foreman-l7xq; needs M1 lib + M2 schema). Replaces the removed cron-driver-server. SCOPE: a long-running worker (Mastra signal/cron or standalone loop, mirroring the old cron-driver-server lifecycle) that, per active automation: leases its trigger-inbox messages, dedups on lease_count/possible_duplicate_data + automation_run idempotency, dispatches each message to runWorkflow/triggerWorkflow (M1), records an automation_run, then acks (or releases on failure). Honor first-poll latency reality (the inbox spike showed \u003e7min cold-start). Wire into the same process model as the old cron-driver-server (review how it was started/registered before removal in 82b24fb).","acceptance_criteria":"worker leases+acks against a mocked inbox; dedup proven (a redelivered message with lease_count\u003e1 does not double-dispatch); failure path releases for retry; vitest green.","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T02:30:45Z","created_by":"HamChowderr","updated_at":"2026-06-26T03:39:14Z","started_at":"2026-06-26T03:30:35Z","closed_at":"2026-06-26T03:39:14Z","close_reason":"M3 shipped: trigger-inbox poll worker (replaces the removed cron-driver-server). DESIGN PIVOT: the automation trigger model is now a trigger-inbox subscription {app,action,connection,inputs} (the locked design — Foreman owns the lease/ack loop), NOT the Zapier --trigger claim. Durables deploy as MANUAL workflows; the worker fires them via triggerWorkflow. (1) lib/automations/types.ts: InboxTriggerSpec + inboxNameFor. (2) lib/automations/worker.ts: dispatchMessage (claimInboxMessage dedup → triggerWorkflow → getTriggerRunStatus → updateRun; skip on already-claimed redelivery; failed→record+release), runInboxCycleForAutomation (ensureInbox idempotent + persist trigger_inbox_id → lease → dispatch batch → ack done+skipped / release failed), runInboxCycle (cross-workspace, per-owner SDK, isolates per-automation failures), startInboxWorker (interval, non-overlapping). (3) store.listActiveInboxAutomations (enabled + trigger has app/action). (4) service.provisionAutomation pivoted: deploy manual (no --trigger), store inbox spec; worker arms lazily. (5) create_automation tool trigger schema → inbox shape. (6) standalone src/inbox-worker-server.ts + npm start:inbox-worker (single instance, no distributed lock, FOREMAN_INBOX_WORKER_INTERVAL_MS). Dedup is a DB constraint (automation_run UNIQUE) so at-least-once redelivery can't double-fire. Gates: vitest 346 pass/0 fail (12 new worker tests + updated service test), biome clean, tsc clean on all M3 files. Trigger loop now closes end-to-end. Only M4 (ut8n, web UI) remains.","dependencies":[{"issue_id":"foreman-37e6","depends_on_id":"foreman-cjg5","type":"blocks","created_at":"2026-06-25T19:31:16Z","created_by":"HamChowderr","metadata":"{}"},{"issue_id":"foreman-37e6","depends_on_id":"foreman-l7xq","type":"discovered-from","created_at":"2026-06-25T19:30:45Z","created_by":"HamChowderr","metadata":"{}"},{"issue_id":"foreman-37e6","depends_on_id":"foreman-l23t","type":"blocks","created_at":"2026-06-25T19:31:23Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":2,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-l7xq","title":"Durable/workflow rebuild on Zapier Next-Gen Zaps (PoC -\u003e platform)","description":"Now that next-gen-Zaps/durable early access is GRANTED + the full durable+workflow API is confirmed usable (foreman-13mw: read+write proven, createWorkflow/deleteWorkflow round-trip OK), rebuild Foreman triggers/workflows on Zapier durables instead of the removed hand-rolled engine. SETUP (getting-started guide, Kenyon Sparks email 2026-06-25): Step3 install = paste into agentic harness (Claude Code) -\u003e 'npx skills add zapier/agent-skills --skill workflows-install' then run the workflows-install skill. It installs the Zapier SDK + zapier-sdk-cli + a set of agentic skills into the workspace AND prompts an interactive Zapier OAuth login (account auth path). Step4 connect apps at https://zapier.com/app/assets/connections. Step6 review deployed durables at https://zapier.com/durables-editor. Capabilities (durable engine): uncapped loops (process whole lists in batches to respect app rate limits), error-catch-and-continue, branch split/rejoin, nested loops, durable waits (pause/resume, cancelable). CAVEATS: (1) The installer changes the workspace Zapier SDK/cli + adds skills — Foreman pins @zapier/zapier-sdk@0.79.0 and enforces dep-uniqueness (@mastra pins), so do the PoC in a SCRATCH dir first, NOT the Foreman repo/branch, to avoid disrupting pinned deps; fold into Foreman deliberately afterward (proof-of-concept-then-platform). (2) Zapier security caution: start low-risk, do not connect sensitive accounts, consider a dedicated test workspace. (3) Interactive Zapier OAuth login required (user completes in browser). ALSO: foreman-13mw stability/sunset question still open -\u003e raise on the Tim Jones call next week before betting Foreman's trigger story fully on this beta.","notes":"SETUP POC COMPLETE 2026-06-25 (scratch dir ~/code/zapier-nextgen-poc, NOT the Foreman repo, to protect pinned deps). Ran the workflows-install recipe end-to-end: (1) env Node v24.16/npm 11.13/git 2.50 OK; (2) installed @zapier/zapier-sdk-cli@0.61.1 GLOBALLY (provides zapier-sdk + experimental binaries); (3) verified Code Workflows experimental commands + required flags (create-workflow --private, publish-workflow-version --connections/--trigger, run-durable --connections/--private, list-triggers, get-workflow-run, trigger-workflow --input); (4) auth = cached browser-login userJwt as admin@otakusolutions.io (NOT client-creds; the Infisical client-creds path returned 403 mid-session on an org-selection mismatch); (5) EA access confirmed via CLI: list-workflows -\u003e {data:[],errors:[]}; (6) installed 5 companion skills (workflows-doctor/create/list/history/modify) into scratch .agents/skills/. Toolchain ready + working. NOT YET DONE: build/publish/run a real workflow via workflows-create (the authoring format + source_files shape for publishWorkflowVersion lives in that skill -- KEY reference for the Foreman rebuild). Capstone build/deploy deferred pending go-ahead (creates real cloud state).\nCAPSTONE PROVEN 2026-06-25: full durable workflow loop works END-TO-END on admin@otakusolutions.io (account 16517571), then cleaned up (list-workflows back to []). Built a minimal no-connection manual workflow (defineDurable + one ctx.step echo + export default). FLOW: run-durable (ephemeral test) -\u003e finished; create-workflow --private -\u003e id; publish-workflow-version --enabled -\u003e version + get-workflow enabled:true; trigger-workflow --input -\u003e run finished (trigger_id -\u003e durable_run_id -\u003e workflow_version_id all linked); delete-workflow -\u003e clean. KEY AUTHORING FACTS for the rebuild: (1) deps must be AGED-pinned \u003e=24h because the run/publish sandbox uses pnpm minimumReleaseAge=1440; aged versions on 2026-06-25: @zapier/zapier-sdk 0.79.0, @zapier/zapier-durable 0.6.1, zod 4.4.3. (2) EVERY import in workflow.ts must appear in --dependencies (aged-pinned); @zapier/zapier-durable goes via --zapier-durable-version. (3) shape = defineDurable(name, async (ctx,input)=\u003e{...}) + export default; one ctx.step(name, async ()=\u003e sdk.runAction({appKey,actionType,actionKey,connection,inputs})) per app action, plain code outside steps. (4) manual input arrives as a JSON STRING -\u003e normalizeInput(JSON.parse) before zod (confirmed: echoed input came back double-encoded). (5) connections = nested {alias:{connectionId}} via --connections on run-durable AND publish. (6) trigger-backed publish uses --trigger JSON with a version-pinned selected_api (implementation_id e.g. GoogleSheetsAPI@2.3.0) or the trigger claim fails SILENTLY (enabled stays false); omit --trigger for manual/webhook. (7) editor link: https://zapier.com/durables-editor/\u003cid\u003e. Toolchain + 6 skills live in ~/code/zapier-nextgen-poc/.agents/skills/ (workflows-create SKILL.md = full authoring reference).\nDESIGN LOCKED 2026-06-25 (user, post-meeting): (1) TRIGGER-INBOX IS THE CHOSEN TRIGGER SUBSTRATE — confirmed will-be-used per the Zapier meeting. So Foreman owns the lease/ack loop (ensureTriggerInbox -\u003e lease -\u003e dedup via lease_count/possible_duplicate_data -\u003e dispatch -\u003e ack), NOT the Zapier-owns-everything durable --trigger path. Durables = the EXECUTION substrate (createWorkflow/publishWorkflowVersion/runDurable). (2) DEPLOY MECHANISM = SDK-PROGRAMMATIC, not CLI: @zapier/zapier-sdk@^0.79.0 is ALREADY pinned in packages/agents and carries the durable+inbox experimental surface; getSdkForUser currently builds from the STABLE import, so the one SDK-layer change is to build the client from '@zapier/zapier-sdk/experimental'. @zapier/zapier-durable + aged-pinned zod are NOT Foreman runtime deps — they go as call arguments (dependencies{}/--zapier-durable-version) into publish/run and install only in Zapier's Vercel sandbox; dep-uniqueness (@mastra pins) untouched. (3) NO STABILITY GATING — built fully on the SDK; if Zapier sunsets/changes the experimental surface we adjust. foreman-13mw stays a Zapier-feedback touchpoint, NOT a blocker. (4) UI GAP CONFIRMED: the entire /workflows web surface + components/workflows/* + workflows-client were removed with the engine (82b24fb); NOTHING in the UI shows inbox/triggers/runs today. Rebuild needs an inbox-visibility view (bound app/action/connection, inbox status, recent leased messages + dup flags) — net-new operational UI.\nAGENT-AUTHORING CONFIRMED 2026-06-25 (user): the foreman agent MUST be able to author + deploy automations from chat (generate the durable source from NL intent per the workflows-create SKILL format, create the Zapier workflow, ensure the trigger-inbox, deploy). So M1 includes an agent tool surface (create/deploy/run/inspect automation tools via createTool, registered through the ToolSearchProcessor like the other custom tools), not just a lib. Web UI is the second authoring path, not the only one.","status":"closed","priority":2,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-06-26T00:55:19Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-06-26T04:04:01Z","close_reason":"Durable/workflow rebuild COMPLETE on Zapier Next-Gen Zaps — all 4 milestones shipped + verified, end-to-end. M1 (cjg5): durable + trigger-inbox lib on @zapier/zapier-sdk/experimental + agent authoring tools. M2 (l23t): workspace-scoped automation+automation_run schema (dedup as a DB UNIQUE) + routes, one deploy+persist service path. M3 (37e6): trigger-inbox poll worker (lease→dedup→triggerWorkflow→ack/release) replacing the removed cron-driver-server; trigger model = inbox subscription (Foreman owns the loop, the locked design). M4 (ut8n): web /automations + live inbox-visibility view. Net result: the agent authors+deploys a durable automation from chat, it's a shared workspace resource, the worker fires it on real events with at-least-once dedup, and the web surfaces runs + inbox state. Built fully on the SDK, no stability gating (bd memory zapier-sdk-commitment). Remaining: foreman-13mw (Zapier stability/roadmap touchpoint for the Tim Jones call) stays open — it's feedback, not a build blocker.","dependencies":[{"issue_id":"foreman-l7xq","depends_on_id":"foreman-13mw","type":"discovered-from","created_at":"2026-06-25T17:55:19Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-w4uo","title":"[durable][marketing] Explain trigger-inbox + durable + SDK surfaces -\u003e artifacts -\u003e marketing copy","description":"LATER (owner-requested). Deep-dive what each Zapier SDK surface IS and DOES — start with trigger-inboxes (watchTriggerInbox/lease/ack/drain, the unwalled event-subscription API), then durable runs (runDurable), durable workflows, the ./define authoring DSL, connections, tables/records. Produce reference ARTIFACTS (vault/docs explainers, diagrams) for each, then translate into MARKETING COPY for Foreman positioning ('build automations from an agentic coding tool, deploy to Zapier; multi-channel; durable runtime'; ties to the next-gen-zaps beta). Source of truth: docs/zapier-sdk-capability-map.md (live-introspected this session) + sdk-surface-sweep.ts. Discovered-from the durable removal epic foreman-bazc.","status":"open","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-25T18:09:05Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:55Z","dependencies":[{"issue_id":"foreman-w4uo","depends_on_id":"foreman-bazc","type":"discovered-from","created_at":"2026-06-25T11:09:05Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-xjyx","title":"[zapier] Relay SDK api:deprecation_notice events to logs/users (0.79.0)","description":"SDK 0.79.0 added the DEPRECATION_NOTICE_EVENT ('api:deprecation_notice') — the SDK sniffs zapier-sdk-deprecation-* response headers and emits an event once per notice id per process. Subscribe at SDK init (generateZapierTools/createZapierSdk in zapier-sdk-tools.ts) and surface: at minimum console.warn to server logs; optionally bubble to the user via the output processor. Keeps Foreman ahead of Zapier-side deprecations instead of finding out when an endpoint breaks.","status":"closed","priority":2,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-06-25T16:11:48Z","created_by":"HamChowderr","updated_at":"2026-06-25T16:22:26Z","closed_at":"2026-06-25T16:22:26Z","close_reason":"Shipped: lib/zapier/deprecation.ts onZapierSdkEvent handler wired into every createZapierSdk (zapier-sdk-tools, zapier/sdk x3, connect-zapier). Logs api:deprecation_notice once per id with [zapier:deprecation] prefix + getZapierDeprecations() registry. 4 unit tests; live read tier confirms no false positives.","dependencies":[{"issue_id":"foreman-xjyx","depends_on_id":"foreman-9t9g","type":"discovered-from","created_at":"2026-06-25T09:11:47Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-9t9g","title":"Bump @zapier/zapier-sdk 0.69.3 -\u003e 0.79.0 + CLI 0.54.3 -\u003e 0.60.0","description":"Both packages 21-23 releases behind (latest 2026-06-24). Carries behavior changes: triggerWorkflow output shape (0.77.0), listWorkflowRuns drops output (0.75.0), listWorkflows paginates (0.72.0), kitcore plugin-model refactor removes sdk.addPlugin chain + no-arg createSdk (0.78.0), new deprecation-notice machinery (0.79.0). More deprecated input aliases since 0.69.3 (createWorkflow is_private-\u003eprivate 0.71.1; runDurable/publishWorkflowVersion camelCase 0.73.1). Unblocks foreman-mcwn (createConnection needs \u003e=0.71).","notes":"Bumped: zapier-sdk 0.79.0, cli 0.60.0, mcp 0.16.0. Lockfile had orphan nested 0.70.4 pin under packages/agents; regenerated lockfile to dedupe to hoisted 0.79.0. Mocked suite green (352 pass/10 skip/0 fail) — 10 skips are env-gated (7 protocols + 1 api-routes need live AGENT_URL; 1 provider-swap needs PG-tier foreman-z0kn; 1 devserver-startup needs RUN_DEVSERVER_STARTUP=1), NOT bump-related. Surface sweep 0.79.0: main mcp registry 37-\u003e40 — generator now AUTO-EMITS 3 connection tools (createConnection/getConnectionStartUrl/waitForNewConnection) but UNCATEGORIZED in READ_ONLY/APPROVAL_REQUIRED; createConnection blocks up to 5min waiting -\u003e needs categorization + background-task handling (ties foreman-7am4, unblocks foreman-mcwn). New export DEPRECATION_NOTICE_EVENT + api:deprecation_notice event. Fixed sdk-surface-sweep.ts pkg resolution (was hard-coded nested path). FOLLOW-UP: capability-map doc still 0.70.4 snapshot.","status":"closed","priority":2,"issue_type":"chore","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-25T14:40:05Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-06-25T14:40:55Z","closed_at":"2026-06-25T15:05:21Z","close_reason":"Bumped sdk 0.79.0 / cli 0.60.0 / mcp 0.16.0; excluded 3 in-flow connection methods from auto-gen (createConnection blocks 5min + overlaps connect_zapier; adoption deferred to foreman-mcwn); mocked suite green; sweep script fixed; capability-map doc regenerated. Committed fb50b4b.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-b8b1","title":"Evaluate createConnection() (SDK 0.71.0) vs home-grown connect.ts -- adopt vs keep","description":"SDK 0.71.0 shipped createConnection() + getConnectionStartUrl() + waitForNewConnection() -- a first-class end-to-end OAuth flow w/ browser integration. Foreman hand-rolls ~240 lines of PKCE OAuth in src/lib/zapier/connect.ts that mints the ACCOUNT-LEVEL user JWT (public PKCE client grwWZD..., scope 'internal credentials offline_access') stored in zapier_identity -- the token that authorizes the SDK on behalf of the user. KEY UNKNOWN deciding adopt-vs-keep: does createConnection() create an APP-LEVEL connection (the 'connect your Gmail' step, same noun as listConnections/getConnection) or mint the account-level user JWT? If app-level, it COMPLEMENTS rather than replaces connect.ts. NOTE: createConnection does NOT unblock durable (needs internal scope, walled -- foreman-8bh9).","acceptance_criteria":"Documented decision: what createConnection authenticates (app vs account level), whether it replaces or complements connect.ts, and a concrete action (adopt / keep / both) with follow-up issues filed.","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-22T22:38:23Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-06-22T22:40:19Z","closed_at":"2026-06-22T22:52:14Z","close_reason":"EVALUATED on SDK 0.76.0 via type signatures + zod schema. VERDICT: createConnection() is APP-LEVEL — options {app, browser:never|auto|always, timeoutMs?, pollIntervalMs?} -\u003e {data:{id, app, title}} (same noun as listConnections/getConnection). The plugin requires an ALREADY-AUTHENTICATED sdk (depends on getConnectionStartUrl/waitForNewConnection/getApp), so it CANNOT mint the account-level user JWT. DECISION: KEEP connect.ts (mints the account user JWT — no SDK equivalent); createConnection COMPLEMENTS it for in-flow 'connect your \u003capp\u003e' OAuth UX. Adoption needs SDK bump to \u003e=0.71 (repo on 0.70.4). Follow-up filed.","dependencies":[{"issue_id":"foreman-b8b1","depends_on_id":"foreman-xb68","type":"discovered-from","created_at":"2026-06-22T15:38:23Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-xfof","title":"Onboarding demo: Foreman builds a real, tailored table (approval + rendered result)","description":"Replace the onboarding Step 3 'query' demo with a 'build' demo: based on the user's selected use-case, Foreman creates a real Zapier Table (tailored name + columns + sample rows) in their connected account. The demo surfaces the approval card (user clicks Approve — teaches the safety loop), streams the tool calls, then renders the created table with its rows + an 'Open in Zapier' link. Fallback to a simulated preview if Zapier isn't connected. Test with haiku to minimize spend. Per-use-case table specs needed (Leads/Deals/Contacts/etc).","design":"Real create with approval card in the mini-chat (StepTry currently has no approval handling — must replicate the main chat's addToolApprovalResponse + approval-card flow). Tailor table to use-case. Render result rows. Haiku for test.","status":"closed","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-20T20:38:46Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-06-20T20:39:00Z","closed_at":"2026-06-20T21:57:00Z","close_reason":"Built + verified live on haiku. Step 3 now creates a real, use-case-tailored Zapier Table (per-use-case build prompts), surfaces the approval card (one approval, then auto-approves the follow-up steps via toolCallId dedup), streams the tool calls, gates 'done' on rows actually added, Zapier-logo avatars. Clean after the tool-gap fix (dwq9).","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-4n9j","title":"Onboarding: Zapier logo in top bar + capture display name on Welcome step","description":"Onboarding top bar still used the old 'F' mark (rest of app uses the Zapier logo). And there was no name capture — signup collects only email+password (no name, no OAuth), so user_metadata.full_name was always empty and the chat greeting never had a name. Added: Zapier logo in onboarding top bar; a 'What should we call you?' name field on the Welcome step that persists to user_metadata.full_name via supabase.auth.updateUser (optional, non-blocking). This is child (c) of the ndwr greeting epic.","status":"closed","priority":2,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-06-20T20:21:46Z","created_by":"HamChowderr","updated_at":"2026-06-20T20:22:08Z","closed_at":"2026-06-20T20:22:08Z","close_reason":"Done + verified in browser: Zapier logo replaces the F mark in the onboarding top bar; Welcome step now has a 'What should we call you?' field that persists to user_metadata.full_name (optional). Greeting reads it.","dependencies":[{"issue_id":"foreman-4n9j","depends_on_id":"foreman-ndwr","type":"discovered-from","created_at":"2026-06-20T13:21:45Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-bf0q","title":"Search should match the generated thread title (and display it on results)","description":"During live verification, searching words that appear only in the Mastra-generated thread title (e.g. 'greeting', 'consistency') returned 0 — search covered conversation.title + message content but not the thread title the sidebar now shows. Also search results displayed 'New conversation' for thread-titled convos. Fix: load the user's mastra_threads titles once, match against them, include those threads' conversations, and coalesce the result title with the cleaned thread title.","status":"closed","priority":2,"issue_type":"bug","owner":"admin@otakusolutions.io","created_at":"2026-06-20T20:11:49Z","created_by":"HamChowderr","updated_at":"2026-06-20T20:12:12Z","closed_at":"2026-06-20T20:12:12Z","close_reason":"Fixed + verified live: search now loads the user's thread titles once, matches them (greeting/consistency/appreciate now return results), includes those conversations, and coalesces result titles with the cleaned thread title (results show 'Automation Assistant Initial Greeting' not 'New conversation').","dependencies":[{"issue_id":"foreman-bf0q","depends_on_id":"foreman-pphw","type":"discovered-from","created_at":"2026-06-20T13:11:49Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-7yha","title":"Sidebar conversation titles always show 'New conversation'","description":"generateTitle writes a title to the Mastra thread (mastra_threads.title) — the chat header reads it, but the sidebar list (GET /conversations) only returned conversation.title (never populated) so every item showed 'New conversation'. Also the generated titles were noisy (markdown '#', '**Title:**' labels, occasional full-response text). Fix: list endpoint batch-coalesces conversation.title with the cleaned thread title; GET /:id precedence corrected (user rename \u003e generated); added cleanTitle() to strip markdown/Title:/quotes and cap length; tightened generateTitle instructions (plain text, no markdown, don't answer).","status":"closed","priority":2,"issue_type":"bug","owner":"admin@otakusolutions.io","created_at":"2026-06-20T19:34:39Z","created_by":"HamChowderr","updated_at":"2026-06-20T19:34:58Z","closed_at":"2026-06-20T19:34:58Z","close_reason":"Fixed: sidebar list now coalesces conversation.title with cleaned Mastra thread title (batched mastra_threads query); GET /:id precedence = rename\u003egenerated; cleanTitle() strips markdown/Title:/quotes + caps length; generateTitle instructions tightened. Verified live: sidebar shows real titles ('Automation Assistant Initial Greeting', 'Brief Greetings Exchange', etc.).","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-4jbc","title":"Sidebar reads as out-of-place grey/black slab with hard divider","description":"In every theme preset the sidebar rendered as a distinct grey slab (its own --sidebar token, a few % off --background) with a near-black border-r divider (Tailwind v4 border-r with no color falls back to currentColor = dark foreground). User: 'out of place / black / doesn't bend.' Fix: derive --color-sidebar from --background so it blends into the canvas in every preset+mode; remove the sidebar border-r so the floating chat card's own border is the only separator.","status":"closed","priority":2,"issue_type":"bug","owner":"admin@otakusolutions.io","created_at":"2026-06-20T19:26:23Z","created_by":"HamChowderr","updated_at":"2026-06-20T19:26:45Z","closed_at":"2026-06-20T19:26:45Z","close_reason":"Fixed: --color-sidebar now derives from --background (blends in every preset+mode, verified bg-sidebar===bg-background across sunset-glow/underground/rose-garden/tangerine + dark); removed sidebar border-r divider (was currentColor near-black). Verified live in browser.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-pphw","title":"[feature] Search through conversations","description":"User wants to search across conversations from the sidebar. Today there's a chat history list (paginated) but no search. Options: client-side filter over loaded titles (quick) vs server-side search endpoint over conversation titles + message content (proper; agent route + index). Scope TBD with user.","notes":"Implemented + committed (7035f00). Server-side debounced search over conversation titles + mastra_messages content (scoped by resourceId), merged/deduped, snippet per result. PostgREST access to mastra_messages verified (200 + content ilike + 13 'hello' matches). Static-verified tsc/biome. Live HTTP+UI loop awaiting user test (browser ext down).","status":"closed","priority":2,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-06-20T17:09:17Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-06-20T19:57:43Z","close_reason":"Implemented + committed (7124559 archive, 7035f00 search); backend/DB/PostgREST verified. Live UI click-through still offered as a confidence check.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-9jlg","title":"[feature] Archive conversations (in addition to delete)","description":"User wants to archive conversations, not just delete. Today the sidebar history supports delete. Archive = a non-destructive hide: needs a conversation.archived_at (or status) column + migration, an Archive action in the sidebar-history item menu (alongside Delete), filtering archived out of the default list, and an 'Archived' view/section to restore. Cross-check agent /conversations routes for list/update.","notes":"Implemented + committed (7124559). Migration 20260620000000 applied non-destructively to local DB (archived_at col + partial index, verified in psql). Agent GET ?archived filter + PATCH {archived} toggle; web /api/history passthrough; sidebar Archive/Unarchive menu item (optimistic + Undo toast) + on-demand Archived section. Static-verified: web tsc 0 err, biome clean. Live UI loop NOT yet verified — browser extension timing out; awaiting user quick test.","status":"closed","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-20T17:09:11Z","created_by":"HamChowderr","updated_at":"2026-06-20T19:57:43Z","started_at":"2026-06-20T18:39:00Z","closed_at":"2026-06-20T19:57:43Z","close_reason":"Implemented + committed (7124559 archive, 7035f00 search); backend/DB/PostgREST verified. Live UI click-through still offered as a confidence check.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-jbtq","title":"Settings -\u003e Profile: set display name (user_metadata.full_name)","description":"Add a Profile settings section so users can set a display name, stored in Supabase user_metadata.full_name via supabase.auth.updateUser. Feeds the chat greeting (foreman-1k9u). New: app/settings/profile/page.tsx + components/settings/profile-form.tsx; add 'Profile' to settings-shell NAV; thread name into auth.ts SessionUser.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-20T16:59:21Z","created_by":"HamChowderr","updated_at":"2026-06-20T17:08:04Z","closed_at":"2026-06-20T17:08:04Z","close_reason":"Profile settings section live (/settings/profile): display-name input -\u003e supabase.auth.updateUser({data:{full_name}}); feeds the greeting. Verified page renders with input/Save/nav. User sets their own real name.","dependencies":[{"issue_id":"foreman-jbtq","depends_on_id":"foreman-ndwr","type":"discovered-from","created_at":"2026-06-20T09:59:21Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-1k9u","title":"Chat greeting: time-of-day + first name (display)","description":"Replace static 'What can I help with?' heading with a personalized time-based greeting ('Good morning/afternoon/evening, \u003cFirst\u003e' / 'Welcome back' late-night), keeping 'What can I help with?' as subtext. Read first name client-side from supabase user_metadata (full_name/name/given_name); graceful fallback to no-name greeting when absent. greeting.tsx becomes a client component using @/lib/client getUser in useEffect (no SSR hydration mismatch).","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-20T16:50:15Z","created_by":"HamChowderr","updated_at":"2026-06-20T16:53:45Z","closed_at":"2026-06-20T16:53:45Z","close_reason":"Greeting shows time-based + first name from user_metadata with graceful no-name fallback. Verified live ('Good morning' at 9am, no-name fallback since current account has no metadata name).","dependencies":[{"issue_id":"foreman-1k9u","depends_on_id":"foreman-ndwr","type":"discovered-from","created_at":"2026-06-20T09:50:15Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-ndwr","title":"[epic] Personalized chat greeting + user display name (storage, settings, onboarding)","description":"User wants the chat empty-state to greet by first name + time of day ('Good morning, \u003cName\u003e' / 'Welcome back, \u003cName\u003e'). Today greeting.tsx is static 'What can I help with?'. Findings: Foreman user table has NO name field; only user_metadata.avatar_url is read. Proposed storage = Supabase user_metadata.full_name (no migration; set via supabase.auth.updateUser). Children: (a) greeting display — time-based + first name from metadata, graceful fallback when absent; (b) Settings -\u003e Profile section to set display name (updateUser); (c) onboarding step to capture name; (d) thread name through auth.ts SessionUser + chat layout.","notes":"VERIFY: all 4 parts checked in source. (a) greeting.tsx — time-of-day buckets + firstNameFrom(full_name/name/given_name/first_name), clean fallback (no name -\u003e bare greeting + 'What can I help with?', no 'undefined'). (b) settings/profile-form.tsx — loads + saves full_name via updateUser, dirty-tracked. (c) step-welcome.tsx — writes full_name to user_metadata. (d) SessionUser threading NOT done but MOOT — greeting reads metadata directly client-side; SessionUser carries only id/email/image. Children 1k9u/4n9j/jbtq all closed + confirmed.","status":"closed","priority":2,"issue_type":"epic","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-20T16:48:33Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-06-20T16:50:19Z","closed_at":"2026-06-20T22:24:18Z","close_reason":"Greeting + Settings + onboarding all shipped and verified in code. Epic part (d) (name on SessionUser) superseded — greeting reads user_metadata.full_name directly client-side, so SessionUser threading wasn't required. Children 1k9u/4n9j/jbtq closed.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-r36j","title":"[feature] Context-window usage indicator in the chat composer (AI Elements Context)","description":"User wants a 'context in the chat bar' — a token/context-window usage indicator in the composer. Vercel AI Elements has a Context component (used/max tokens, % gauge, optional cost). Project ai-elements/ does NOT have it yet. Work: (1) add the Context AI Element (npx ai-elements add context; likely pulls tokenlens for model window sizes); (2) surface token usage + model context-window from the chat stream — the Mastra agent /chat SSE must emit usage (totalUsage) so useChat exposes it; (3) place it in prompt-input/multimodal-input toolbar. Verify model id -\u003e window-size mapping for the Foreman models.","status":"closed","priority":2,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-06-20T16:48:29Z","created_by":"HamChowderr","updated_at":"2026-06-20T18:37:11Z","closed_at":"2026-06-20T18:37:11Z","close_reason":"Context gauge confirmed rendering live + accurate. 16% on fresh haiku chat = ~32k tokens = system prompt + tool catalog floor, matches verified backend totalTokens 31872.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-mcla","title":"Landing: lock brand tokens to Foreman orange (presets washed out accent)","description":"Landing uses accent/text-accent/variant=accent for brand elements. Theme presets repurpose --accent as a light neutral and move the brand to --primary, so logged-in users with a preset see washed-out brand (Connect Zapier button, 'chat driver' badge, 'Drive the one...' heading, Builder-vs-driver badge). User chose: keep the home page on the fixed Foreman orange regardless of the in-app theme. Fix: .landing-brand-lock class re-pins --primary/--accent/--ring to orange on the landing root.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-20T16:45:06Z","created_by":"HamChowderr","updated_at":"2026-06-20T16:46:57Z","closed_at":"2026-06-20T16:46:57Z","close_reason":"Added .landing-brand-lock (re-pins --primary/--accent/--ring to Foreman orange, light+dark) on the landing root. Verified live under sunset-glow: brand elements render vivid orange again.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-nwpf","title":"Home page: replace the 'F' Foreman mark with the Zapier logo (nav + footer)","description":"The landing page still shows a legacy 'F'-in-accent-box brand mark in the top nav (site-nav.tsx ~L26) and the footer (site-footer.tsx ~L48). User wants the F sign gone entirely and the Zapier asterisk (/zapier.svg) used instead, matching the sidebar/dashboards brand. Keep the 'Foreman' wordmark + Alpha badge.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-20T05:46:46Z","created_by":"HamChowderr","updated_at":"2026-06-20T05:48:54Z","closed_at":"2026-06-20T05:48:54Z","close_reason":"Replaced the 'F' accent-box mark in site-nav.tsx + site-footer.tsx with the Zapier asterisk (/zapier.svg). Verified: nav/footer render the zapier img (computed 24x24, loaded), no 'F' boxes remain. Brand wordmark + Alpha badge kept.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-ltnn","title":"SlashCommandMenu -\u003e ui/Command (cmdk); SuggestionDialog -\u003e ui/Dialog","description":"chat/slash-commands.tsx hand-builds a command palette (filter + manual keyboard nav, no role=listbox/aria-selected) — ui/command.tsx (cmdk) already powers the model selector. chat/suggestion.tsx SuggestionDialog is a hand-rolled modal (custom backdrop, no focus-trap/Esc/scroll-lock) -\u003e ui/dialog.tsx. Both are real a11y wins.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-20T05:12:15Z","created_by":"HamChowderr","updated_at":"2026-06-20T05:35:56Z","closed_at":"2026-06-20T05:35:56Z","close_reason":"Done via 9 parallel area-agents; verified biome+tsc+next build all green (commit d34f451). NOTE: ltnn slash-commands took the conservative roles-only cmdk adoption (correct ARIA roles + selection) to preserve the composer's keyboard-nav contract; SuggestionDialog fully on ui/dialog. Also fixed a pre-existing build-breaker in model-selector-compact (467d43c).","dependencies":[{"issue_id":"foreman-ltnn","depends_on_id":"foreman-to5b","type":"discovered-from","created_at":"2026-06-19T22:12:15Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-sx4f","title":"Chat artifact/document subsystem: raw button -\u003e ui/Button, rename input -\u003e ui/Input","description":"Artifact/document controls hand-roll Button variants: chat/version-footer.tsx (prev/next/diff/restore/latest), artifact-actions.tsx, artifact-close-button.tsx, document.tsx (2 card triggers), multimodal-input.tsx (cancel). Also sidebar-history-item.tsx rename field -\u003e ui/input.tsx (+aria-label). Note: cursor-pointer typo in document.tsx already fixed separately.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-20T05:12:10Z","created_by":"HamChowderr","updated_at":"2026-06-20T05:35:56Z","closed_at":"2026-06-20T05:35:56Z","close_reason":"Done via 9 parallel area-agents; verified biome+tsc+next build all green (commit d34f451). NOTE: ltnn slash-commands took the conservative roles-only cmdk adoption (correct ARIA roles + selection) to preserve the composer's keyboard-nav contract; SuggestionDialog fully on ui/dialog. Also fixed a pre-existing build-breaker in model-selector-compact (467d43c).","dependencies":[{"issue_id":"foreman-sx4f","depends_on_id":"foreman-to5b","type":"discovered-from","created_at":"2026-06-19T22:12:10Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-33w6","title":"Settings/workflows/onboarding: raw button/input/checkbox/toggle -\u003e ui primitives","description":"These slices hand-roll form controls with inline styles. Swap: raw \u003cbutton\u003e -\u003e ui/button.tsx and raw \u003cinput\u003e -\u003e ui/input.tsx in settings/mcp-page, settings/channel-connect-page, workflows/workflow-detail-actions (rename input + 5 buttons), onboarding/step-connect. Also: enable/disable toggle in workflows/trigger-controls -\u003e ui/switch.tsx; native checkbox in editor/tools-picker -\u003e ui/checkbox.tsx.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-20T05:12:03Z","created_by":"HamChowderr","updated_at":"2026-06-20T05:35:56Z","closed_at":"2026-06-20T05:35:56Z","close_reason":"Done via 9 parallel area-agents; verified biome+tsc+next build all green (commit d34f451). NOTE: ltnn slash-commands took the conservative roles-only cmdk adoption (correct ARIA roles + selection) to preserve the composer's keyboard-nav contract; SuggestionDialog fully on ui/dialog. Also fixed a pre-existing build-breaker in model-selector-compact (467d43c).","dependencies":[{"issue_id":"foreman-33w6","depends_on_id":"foreman-to5b","type":"discovered-from","created_at":"2026-06-19T22:12:03Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-zo1e","title":"Standardize status pills on ui/Badge","description":"'Connected'/'Coming soon'/draft/published/archived pills are hand-rolled 3+ ways: settings/integrations-hub, settings/channel-connect-page, workflows/[id] StatusBadge, editor/version-history-panel, editor/editor-sidebar-agents. ui/badge.tsx already used for this exact purpose in agent-list-view/agent-editor — make the rest match.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-20T05:11:59Z","created_by":"HamChowderr","updated_at":"2026-06-20T05:35:56Z","closed_at":"2026-06-20T05:35:56Z","close_reason":"Done via 9 parallel area-agents; verified biome+tsc+next build all green (commit d34f451). NOTE: ltnn slash-commands took the conservative roles-only cmdk adoption (correct ARIA roles + selection) to preserve the composer's keyboard-nav contract; SuggestionDialog fully on ui/dialog. Also fixed a pre-existing build-breaker in model-selector-compact (467d43c).","dependencies":[{"issue_id":"foreman-zo1e","depends_on_id":"foreman-to5b","type":"discovered-from","created_at":"2026-06-19T22:11:58Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-wyhs","title":"Standardize error feedback on ui/Alert across the app","description":"Errors are hand-rolled ~6 ways (red \u003cp\u003e/\u003cdiv\u003e/\u003cspan\u003e inline colors, no role=alert): auth forms x3, chat/message.tsx x3, workflows/trigger-controls + workflow-detail-actions, onboarding/step-connect, app/dashboards/page.tsx. settings/mcp-page.tsx surfaces NO error UI at all (silent createKey/revokeKey failures). Consolidate on ui/alert.tsx (variant=destructive) + add missing error states.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-20T05:11:54Z","created_by":"HamChowderr","updated_at":"2026-06-20T05:35:56Z","closed_at":"2026-06-20T05:35:56Z","close_reason":"Done via 9 parallel area-agents; verified biome+tsc+next build all green (commit d34f451). NOTE: ltnn slash-commands took the conservative roles-only cmdk adoption (correct ARIA roles + selection) to preserve the composer's keyboard-nav contract; SuggestionDialog fully on ui/dialog. Also fixed a pre-existing build-breaker in model-selector-compact (467d43c).","dependencies":[{"issue_id":"foreman-wyhs","depends_on_id":"foreman-to5b","type":"discovered-from","created_at":"2026-06-19T22:11:53Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-to5b","title":"[epic] UI consistency: adopt vendored shadcn primitives across the app","description":"Audit (3 parallel readers, 2026-06-20) found the app splits cleanly: chat core, ai-elements/, auth forms, dashboard renderer, and landing are primitive-first and clean. Gaps cluster in settings/, workflows/, onboarding/, and the chat artifact/document subsystem, which hand-roll buttons/inputs/alerts/badges/empty-states/skeletons with inline styles instead of using the 55 vendored ui/ primitives. This epic tracks bringing those onto the design system. Net effect: consistent focus/disabled/a11y states, themeable (no inline hex), testable (no native confirm()).","status":"closed","priority":2,"issue_type":"epic","owner":"admin@otakusolutions.io","created_at":"2026-06-20T05:11:10Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-06-20T05:35:57Z","close_reason":"Done via 9 parallel area-agents; verified biome+tsc+next build all green (commit d34f451). NOTE: ltnn slash-commands took the conservative roles-only cmdk adoption (correct ARIA roles + selection) to preserve the composer's keyboard-nav contract; SuggestionDialog fully on ui/dialog. Also fixed a pre-existing build-breaker in model-selector-compact (467d43c).","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-9m7h","title":"Move Settings out of sidebar nav into the bottom-left user menu","description":"User wants the Settings entry removed from the left sidebar nav (Workflows/Dashboards/Settings group) and relocated into the bottom-left user dropdown (SidebarUserNav), alongside theme toggle / color theme / sign out. Links to /settings/integrations.","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-20T04:56:48Z","created_by":"HamChowderr","updated_at":"2026-06-20T05:03:15Z","started_at":"2026-06-20T04:56:58Z","closed_at":"2026-06-20T05:03:15Z","close_reason":"Implemented + visually verified in browser (default/sunset-glow theme). hkfg: chat title on left + visibility control pushed right (title plumbed via /api/messages -\u003e use-active-chat -\u003e ChatHeader). sinf: removed New-chat resting border (false-active), unified nav heights h-8, bumped header-\u003enav spacing pt-2. cbzv: shadow-sm on card (canvas oklab L 0.940 vs card 0.982, plus shadow = clear float). 9m7h: Settings moved from sidebar nav into bottom-left user dropdown -\u003e /settings/integrations (route verified loading).","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-hkfg","title":"Chat container: more defined/rounded outline + fix share-icon crowding","description":"User feedback: the chat outline can be more defined and rounded; the chat header/title is too close to the share icon (the private/public visibility control). Tighten the chat container border-radius/border and add spacing between the title and the share/visibility control. Files: components/chat-pane.tsx / chat header component. Verify visually.","notes":"UPDATE: the chat-container outline/rounding is DONE via the floating-card surface (11ef88c) — conversation is now a rounded bordered card with a gap. REMAINING (the header polish): the in-card header is sparse (just the share/visibility control floating at the left). Add the conversation TITLE and move the share/visibility control to the RIGHT with proper spacing (fixes the 'too close to the share icon' crowding). chat-header.tsx + visibility-selector.tsx.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-19T20:53:10Z","created_by":"HamChowderr","updated_at":"2026-06-20T05:03:15Z","closed_at":"2026-06-20T05:03:15Z","close_reason":"Implemented + visually verified in browser (default/sunset-glow theme). hkfg: chat title on left + visibility control pushed right (title plumbed via /api/messages -\u003e use-active-chat -\u003e ChatHeader). sinf: removed New-chat resting border (false-active), unified nav heights h-8, bumped header-\u003enav spacing pt-2. cbzv: shadow-sm on card (canvas oklab L 0.940 vs card 0.982, plus shadow = clear float). 9m7h: Settings moved from sidebar nav into bottom-left user dropdown -\u003e /settings/integrations (route verified loading).","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-82vf","title":"Chat header: proper model selector (Vercel AI Elements) replacing 'Foreman + star'","description":"Chat header currently shows a static 'Foreman' label with a star icon instead of a real model selector. User wants a proper model selector built from Vercel AI Elements. Locate the chat header component, wire a model dropdown. Confirm with user which models to expose (foreman agent is fixed to sonnet 4.6 server-side; selector may be cosmetic/future or pick agent personas).","status":"closed","priority":2,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-06-19T20:53:05Z","created_by":"HamChowderr","updated_at":"2026-06-20T04:42:20Z","closed_at":"2026-06-20T04:42:20Z","close_reason":"Done — real multi-model selector shipped (eca1ba8); model-selector cards spaced out (44a9fb8).","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-sinf","title":"Chat UI polish: sidebar borders/spacing + false-hover states","description":"User feedback: (1) sidebar nav options borders/spacing can be improved; (2) items appear hovered/active when they are NOT hovered (likely default vs data-[active] state styling in SidebarMenuButton); (3) the header icon (MessageSquare/PanelLeft) above the New chat nav group is not spaced properly above the nav options (SidebarHeader pt-3 pb-0 vs SidebarGroup pt-1). Files: components/chat/app-sidebar.tsx, components/ui/sidebar.tsx. Verify visually in browser.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-19T20:53:00Z","created_by":"HamChowderr","updated_at":"2026-06-20T05:03:15Z","closed_at":"2026-06-20T05:03:15Z","close_reason":"Implemented + visually verified in browser (default/sunset-glow theme). hkfg: chat title on left + visibility control pushed right (title plumbed via /api/messages -\u003e use-active-chat -\u003e ChatHeader). sinf: removed New-chat resting border (false-active), unified nav heights h-8, bumped header-\u003enav spacing pt-2. cbzv: shadow-sm on card (canvas oklab L 0.940 vs card 0.982, plus shadow = clear float). 9m7h: Settings moved from sidebar nav into bottom-left user dropdown -\u003e /settings/integrations (route verified loading).","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-v2i1","title":"Reconsider 'Delete all chats' placement in sidebar","description":"Delete all is a destructive permanent action (DELETE /api/history wipes every conversation) sitting as a always-visible primary sidebar item (app-sidebar.tsx:147-158), right under New chat/Workflows/Settings. User questioned why it is there. Proposal: remove from the primary nav and keep it as the /purge slash command (already exists) and/or move to settings or the user-nav menu. Decide with user.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-19T20:52:54Z","created_by":"HamChowderr","updated_at":"2026-06-19T21:34:59Z","closed_at":"2026-06-19T21:34:59Z","close_reason":"Removed Delete all from sidebar nav; /purge slash command retained. Verified in browser.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-gw5n","title":"mastra dev incremental rebuild crashes on hot-reload (Windows)","description":"On packages/agents, mastra dev's incremental rebuild crashes on nearly every file save with ERR_MODULE_NOT_FOUND (Cannot find package @/lib imported from .mastra/output/index.mjs) or 'generateZapierTools is not defined'. The server then crash-loops on the bad bundle. Workaround that reliably recovers: stop dev, rm -rf packages/agents/.mastra/output, restart via infisical run. Slows iteration significantly. Investigate the bundler alias/incremental-cache handling (rollup @/ alias on partial rebuilds).","notes":"REPRO + WORKAROUND confirmed 2026-06-20: adding a NEW source file (lib/dashboards/share.ts) while mastra dev runs breaks the incremental rebuild — ALL routes then 500 with 'Cannot find package @/lib imported from .mastra/output/index3.mjs' (the alias isn't re-resolved in the stale bundle). Editing existing files hot-reloads fine; NEW files are the trigger. Fix (no code change): kill the mastra dev tree + 'rm -rf .mastra/output' + relaunch. Clean rebuild resolves @/ aliases and the server is healthy (~12s).","status":"open","priority":2,"issue_type":"bug","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-19T19:29:21Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:55Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-ej41","title":"Delete dead Vercel canvas/artifacts scaffolding (careful refactor)","description":"Research flagged web canvas/artifacts (web/src/artifacts/*, chat/{artifact*,document*,create-artifact,data-stream-handler,version-footer,toolbar,text-editor,code-editor,suggestion}.tsx, hooks/use-artifact, Document/Vote/Suggestion stub types in lib/db/schema.ts) as DEAD: /api/document route doesn't exist (404s), no DB table/migration, no agent tool emits documents. User approved deletion (2026-06-19). CAUTION: my own grep shows it's woven across ~35 files into the WORKING chat render path (shell.tsx mounts \u003cArtifact\u003e; messages/message render document-preview/artifact-actions; data-stream-handler wired in chat). NOT a blind rm — trace every importer, strip the mount+wiring from chat, delete files, then VERIFY chat still renders + web builds before calling done. Frees the 'Artifact' name for the new agent-server artifact model.","notes":"CORRECTED PLAN (2026-06-27, supersedes sub-agent's): the data-stream is NOT artifact-only — it's LIVE shared infra. data-stream-provider + use-auto-resume.ts (reads dataStream to resume) + use-active-chat onData/setDataStream MUST STAY. data-stream-handler.tsx handles data-chat-title (live sidebar title) + drains the stream, alongside dead artifact deltas → SIMPLIFY it (keep data-chat-title + drain, strip artifactDefinitions/useArtifact imports), do NOT delete. message.tsx: KEEP data-preview-progress (line 261) + tool-preview_app (line 336) branches (LIVE preview) + useDataStream; REMOVE only the dead tool-createDocument/updateDocument/requestSuggestions branches + DocumentPreview/DocumentToolResult imports. Vote IS dead (no /api/vote) → remove Vote type + vote UI in message-actions + the votes SWR in use-active-chat. SAFE TO DELETE (pure artifact): src/artifacts/* (actions, text/code/image/sheet client), components/chat/{artifact,artifact-actions,artifact-close-button,create-artifact,document,document-preview,document-skeleton,version-footer,toolbar,text-editor,code-editor,image-editor,sheet-editor,suggestion,diffview,console}.tsx, hooks/use-artifact.ts; lib/editor/* (only used by text-editor). schema: remove Document/Suggestion/Vote types. EXECUTE as a focused effort: un-wire shell.tsx (Artifact mount + useArtifact) → simplify data-stream-handler → message.tsx dead branches → vote removal → delete files → tsc + RUN chat (verify preview/auto-resume/title still work). Partial progress this session: removed 28 unrelated orphan files (22 unused shadcn ui + 6 others) + integrated Fallow.","status":"in_progress","priority":2,"issue_type":"chore","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-19T18:43:22Z","created_by":"HamChowderr","updated_at":"2026-06-28T01:19:02Z","started_at":"2026-06-28T01:11:04Z","dependencies":[{"issue_id":"foreman-ej41","depends_on_id":"foreman-xl8m","type":"discovered-from","created_at":"2026-06-19T11:43:22Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-sjyc","title":"Dashboards Phase 3: public sharing (dashboard_share token, /dashboards routes, public page)","description":"dashboard_share table (share_token unique, dashboard_id, user_id, expires_at). New routes/dashboards.ts: private CRUD + POST :id/share; public GET /dashboards/public/:shareToken (no authMiddleware, validate token, return spec+snapshot). Register in routes/index.ts + add /dashboards to CUSTOM_ROUTE_PREFIXES in mastra/index.ts. web app/d/[shareToken]/page.tsx ISR reusing DashboardRenderer.","notes":"VERIFY: unit dashboards-share.test.ts (8 pass: ownership-gate, expiry, owner-scoped revoke) + integration api-routes (3: public 200 w/o auth, unknown 404, share 401) on the REAL @/routes/index app. next build green; biome clean. LIVE smoke on restarted 4111 (clean rebuild fixed gw5n): GET /dashboards/public/faketoken -\u003e 404 (route ran, auth bypassed); artifacts/share/shares no-auth -\u003e 401. Carve-out confirmed. NOT done live: full browser e2e with a real artifact (none exists; needs Phase1 snapshot + Phase2 create-dashboard first) — DashboardRenderer + page render covered by next build.","status":"closed","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-19T17:01:05Z","created_by":"HamChowderr","updated_at":"2026-06-20T23:37:24Z","started_at":"2026-06-20T22:48:08Z","closed_at":"2026-06-20T23:37:24Z","close_reason":"Phase 3 public sharing shipped (c868ed4) + verified (unit 8, integration 3, next build, live auth-carveout smoke: public 404 no-auth / private 401).","dependencies":[{"issue_id":"foreman-sjyc","depends_on_id":"foreman-c0p5","type":"discovered-from","created_at":"2026-06-19T10:01:04Z","created_by":"HamChowderr","metadata":"{}"},{"issue_id":"foreman-sjyc","depends_on_id":"foreman-xl8m","type":"blocks","created_at":"2026-06-19T10:01:17Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-xl8m","title":"Dashboards Phase 2: dashboard table + spec zod schema + create-dashboard tool + web DashboardRenderer + in-app view","description":"dashboard table (spec jsonb, visibility, user_id/workspace_id). zod spec schema in lib/validation.ts (blocks: kpi|table|chart). New agent tool create-dashboard.ts (sets poll trigger, builds spec, stores row) registered in foreman.ts (NO strict:true). web components/dashboard/dashboard-renderer.tsx mapping spec-\u003eui/chart.tsx(recharts)/react-data-grid/shadcn. app/dashboards list + [id] embedded view via /api proxy.","notes":"RE-SCOPED (user decision 2026-06-19): ARTIFACT-SHAPED FOUNDATION. Store as 'artifact' table (kind='dashboard'), discriminated-union spec; build dashboard kind ONLY now, generalize later. Zod spec schema in lib/validation.ts = security boundary (validate field refs vs snapshot columns; format enums currency/percent/date; no html/url/onClick; caps; .strict()). create-dashboard agent tool writes spec server-side (NO strict:true). Wire /dashboards to read stored artifact by id; keep defaultSpecFromRecords as fallback. Renderer slice DONE+verified live (commit 9329345).","status":"closed","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-19T17:01:01Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-06-19T18:09:58Z","closed_at":"2026-06-19T22:51:41Z","close_reason":"Done: dashboard table + spec zod schema + create-dashboard tool + DashboardRenderer + in-app /dashboards view all built and merged; the /dashboards route 500 (missing CUSTOM_ROUTE_PREFIXES entry) fixed and verified (401 JSON). Sidebar now links Dashboards.","dependencies":[{"issue_id":"foreman-xl8m","depends_on_id":"foreman-gnr0","type":"blocks","created_at":"2026-06-19T10:01:13Z","created_by":"HamChowderr","metadata":"{}"},{"issue_id":"foreman-xl8m","depends_on_id":"foreman-c0p5","type":"discovered-from","created_at":"2026-06-19T10:01:01Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"foreman-gnr0","title":"Dashboards Phase 1: app_data_snapshot table + poll-driven append-only refresh + read endpoints","description":"Migration for append-only app_data_snapshot (user_id, workspace_id?, app_key, source_config jsonb, records jsonb, row_count, refreshed_at; index user_id,app_key,refreshed_at DESC). Regenerate db:types. Add snapshot-save (INSERT, not upsert) step to zapier-poll-provider.ts after the runAction read. Read endpoints: GET latest + ?history/since for trends. Reuse workflow_trigger(type poll) + cron-driver-server; reads need no approval.","notes":"Poll wiring done: PollConfig.snapshot flag; pollOne saves full record set to app_data_snapshot each cycle (append-only, best-effort, additive to workflow firing). Lint + 308 tests green. REMAINING P1: read endpoint (latest + ?history/since) + unit test for snapshot lib.\nP1 COMPLETE: read endpoint added (routes/dashboards.ts → GET /dashboards/snapshots/:appKey, latest + ?history/\u0026since/\u0026limit), registered in routes/index.ts (dynamic mount, no prefix-list needed). Unit test tests/unit/dashboards-snapshot.test.ts (8 tests: save row-shape/defaults/error, latest parse/null/corrupt-json, history series/since/empty). Full suite 316 pass, Biome clean, new files typecheck clean.","status":"closed","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-19T17:00:58Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-06-19T17:01:25Z","closed_at":"2026-06-19T17:43:59Z","close_reason":"Phase 1 shipped: app_data_snapshot migration (applied), snapshot lib (save/getLatest/getHistory), poll-provider append-only snapshot wiring, read endpoint (GET /dashboards/snapshots/:appKey + history), 8 unit tests. 316 suite green.","dependencies":[{"issue_id":"foreman-gnr0","depends_on_id":"foreman-c0p5","type":"discovered-from","created_at":"2026-06-19T10:00:57Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":2,"comment_count":0}
+{"_type":"issue","id":"foreman-c0p5","title":"EPIC: Foreman data dashboards (pull connected-app data → generate, embed + share)","description":"Let a Foreman user (technical or non-technical) turn connected-app data (HubSpot/Airtable leads, etc.) into a dashboard that's embedded in-app and shareable via a public URL — no code, no hosting. Spec-driven (agent emits JSON spec; web renderer composes installed shadcn/recharts/react-data-grid). Stored snapshot (append-only Postgres). Plan: C:/Users/HamCh/.claude/plans/delightful-meandering-fog.md","status":"closed","priority":2,"issue_type":"epic","owner":"admin@otakusolutions.io","created_at":"2026-06-19T17:00:29Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-06-21T03:39:42Z","close_reason":"EPIC complete — all 4 dashboards phases shipped + verified.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-5xih","title":"Seed app catalog into local Postgres (app_catalog empty -\u003e app search returns nothing locally)","description":"Local app_catalog has 0 rows, so catalog semantic search returns nothing until seeded. Run 'npm run catalog:seed' (fetches Zapier catalog + embeds via fastembed at 384d). Heavy op (needs Zapier creds + embeds many apps). Not required for core chat; needed for app-discovery features locally.","status":"open","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-19T09:08:12Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","dependencies":[{"issue_id":"foreman-5xih","depends_on_id":"foreman-1fjd","type":"discovered-from","created_at":"2026-06-19T02:08:12Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-1fjd","title":"Verify local dev setup is complete + correct (fastembed, embeddings, vector, etc.)","description":"User wants confirmation that everything for LOCAL dev is set up correctly — fastembed (local embeddings), PgVector, RAG indexing, env vars, and any other local-only services. Audit the local stack and report gaps.","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-19T08:46:54Z","created_by":"HamChowderr","updated_at":"2026-07-05T04:52:45Z","closed_at":"2026-07-05T04:52:45Z","close_reason":"DONE (verify): fastembed bge-small 384-dim + PgVector + catalog_vectors all present/correct.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-f6s4","title":"Color theme presets render too light/washed-out when applied","description":"User reports colors in the color-theme selector (sidebar user-nav \u003e Color theme) are very light. Applied light presets (Lake View oklch 0.765, Underground/Forest Whisper low-chroma) + the subtle 3-7pct surface color-mix in globals.css @theme inline produce near-white, low-contrast UIs. Need user direction on scope (darken presets vs strengthen tinting vs swatch visibility) before changing colors. Files: app/globals.css, lib/theme-presets.ts","notes":"Global pass DONE (verified in browser): (1) tint strength bumped in globals.css @theme inline — bg 3-\u003e4, card/popover 5-\u003e8, secondary 7-\u003e12, muted 7-\u003e10, accent 20-\u003e25, border/input 10-\u003e16, sidebar 4-\u003e7pct — presets now visibly recolor UI (ocean-breeze shows clear blue, was near-white). (2) default light neutrals deepened: --muted-foreground #6b7280-\u003e#52525b, --border/--input #e5e7eb-\u003e#d4d4d8. (3) swatch dots size-3-\u003e3.5 + contrast ring. PENDING user review: per-preset darkening of pale presets (Lake View oklch 0.765 is the worst; Underground/Forest low-chroma) — holding for user to confirm which, to avoid blind palette rework.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-19T08:46:49Z","created_by":"HamChowderr","updated_at":"2026-06-19T09:07:51Z","closed_at":"2026-06-19T09:07:51Z","close_reason":"Theme refinement done+verified: (a) global tinting/neutrals/swatches; (b) normalized 3 washed-out presets — Lake View oklch 0.765-\u003e0.62, Underground chroma 0.069-\u003e0.15, Forest Whisper chroma 0.107-\u003e0.15, with matching swatch values in theme-presets.ts. Verified in browser. Biome clean.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-jmuu","title":"Homepage Toolbox search (ToolDiscovery) too faint/washed-out","description":"On the homepage 'Every action. Every table.' section: unmatched tool chips render at opacity 0.35 + text-foreground/50 (~17pct effective) and matched/typing chips at 0.45 — nearly invisible. The left checklist checkmarks use a faint bg-accent/10 circle. User wants the actions + checkmarks darker/more defined, esp. on mobile. Files: components/landing/demos/tool-discovery.tsx, components/landing/sections/tool-discovery-section.tsx","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-19T08:46:44Z","created_by":"HamChowderr","updated_at":"2026-06-19T08:56:22Z","closed_at":"2026-06-19T08:56:22Z","close_reason":"Toolbox contrast fixed: unmatched chips opacity 0.35-\u003e0.6 + text/50-\u003e/70 + border-border; checklist checkmarks now solid accent circle w/ white check. Verified at desktop, opacity-based so mobile matches. Biome clean.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-py1n","title":"Improve mobile responsiveness of Foreman web UI","description":"Several parts of the web frontend (chat shell, sidebar, message composer, approval cards, etc.) are not optimized for mobile viewports. Audit on real mobile viewport sizes via the agent browser and fix layout/sizing/overflow issues.","notes":"Homepage mobile fixes done+verified (Chrome agent browser at mobile-base breakpoint): channels.tsx grid-cols-3 -\u003e grid-cols-2 sm:grid-cols-3; tool-discovery.tsx grid-cols-3 -\u003e grid-cols-2 (long tool names were truncating); site-nav.tsx px-6 -\u003e px-4 sm:px-6. Both grids confirmed 2-col via computed styles; no horizontal overflow; biome clean. Chat suggested-actions left as-is (intentional horizontal carousel on mobile). Remaining optional: full sweep of authed app surfaces.\nUser approved FULL APP SWEEP. Surfaces to cover: chat thread (bubbles/code/approval cards/composer/sidebar), settings + settings/integrations/*, workflows + [id] + runs, editor. Method: per-surface runtime diagnostic (overflow scan + multi-col grid check + nowrap-wide) then fix confirmed offenders only.\nFULL SWEEP COMPLETE. Fixed: (1) homepage channels+tool-discovery grids 3-\u003e2 col, nav padding; (2) settings-shell.tsx now stacks nav rail above content on mobile (flex-col md:flex-row, horizontal scrollable nav, px-8/px-10 -\u003e responsive px-4); (3) dev-console.tsx w-[600px] -\u003e w-[min(100%,600px)] (dev-only, prevents narrow-viewport overflow). Verified clean (no overflow, no bad grids, biome): chat empty-state, chat thread components (code analysis - min(100%,X)/max-w patterns are mobile-safe; chat agent's 'critical' findings were false positives misreading min(100%,500px)), editor list+detail/[id], settings + all sub-pages (mcp/telegram), workflows list+detail code. All changes scoped to \u003c640px, no desktop regression. NOTE: changes UNCOMMITTED pending user OK.\nVERIFY (this session, Chrome agent browser live-DOM): homepage channels grid renders 'grid grid-cols-2 sm:grid-cols-3' (2-col base, 3-col \u003e=640); /settings live shell='flex flex-1 flex-col md:flex-row', nav='flex flex-row md:flex-col gap-1 overflow-x-auto', 0 horizontal-overflow offenders. NOTE: extension pins render viewport at 1920 so no true mobile screenshot — verified via applied classes + controlled live-DOM overflow measures (same method prior session used). Fixes committed 998a6a3 + c67333c. Only open child sse0 closed (321d6c3).","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-19T07:58:29Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-06-19T07:58:40Z","closed_at":"2026-06-20T22:42:29Z","close_reason":"Mobile sweep complete + committed (998a6a3 homepage grids/nav/dev-console width; c67333c settings-shell stack). Live-DOM verified this session: responsive classes applied, 0 overflow on settings. Stale 'UNCOMMITTED' note superseded — changes are in main tree. Child sse0 fixed+closed.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-aj6m","title":"Delete conversation: wrong endpoint (404) + navigates to landing","description":"Frontend handleDelete (sidebar-history.tsx) DELETEs to /api/chat?id= which does NOT exist (only /api/history exists) -\u003e 404 -\u003e row never deleted -\u003e reappears on revalidation. Also router.replace('/') sends user to marketing landing. FIX: DELETE to agents ${agentUrl}/conversations/:id with auth (like Rename), optimistic mutate with revalidate:false, navigate to /chat not /. Also noted: 'Delete all' button hits no-op /api/history DELETE (same class, still broken).","status":"closed","priority":2,"issue_type":"bug","owner":"admin@otakusolutions.io","created_at":"2026-06-18T18:47:20Z","created_by":"HamChowderr","updated_at":"2026-06-18T20:29:46Z","closed_at":"2026-06-18T20:29:46Z","close_reason":"Completed this session (commit ffc4837).","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-bk69","title":"Sidebar nav renders as solid-filled brand pills (data-active presence-match bug)","description":"app-sidebar nav items (New chat/Workflows/Settings/Delete all) rendered as solid saturated-colored pills at rest. Root cause: ui/sidebar.tsx sidebarMenuButtonVariants used Tailwind presence-form data-active:bg-sidebar-accent, but SidebarMenuButton renders data-active={isActive} with isActive=false default -\u003e data-active='false' attribute is PRESENT -\u003e presence variant fires on every inactive button. Template worked around it on history items (data-active:bg-transparent) but not nav items. Compounded by theme presets defining --sidebar-accent as a saturated brand color (shadcn expects a subtle hover gray). FIX: changed CVA to value-form data-[active=true]: (canonical shadcn). Verified: nav now clean ghost rows. Aligns with user's sidebar-07 preference.","status":"closed","priority":2,"issue_type":"bug","owner":"admin@otakusolutions.io","created_at":"2026-06-18T17:42:30Z","created_by":"HamChowderr","updated_at":"2026-06-18T17:42:41Z","closed_at":"2026-06-18T17:42:41Z","close_reason":"Fixed: ui/sidebar.tsx CVA changed data-active: -\u003e data-[active=true]:. Nav now renders clean ghost rows, verified in browser.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-fkoh","title":"Color theme presets: tint main chat surfaces, not just sidebar nav","description":"The bottom-left color theme switcher works (tokens change on \u003chtml\u003e) but only visibly repaints the left sidebar nav buttons + focus rings. The whole center conversation area (background, cards, input, message bubbles, history rows) stays neutral near-black across every preset because presets only saturate --primary/--ring/--sidebar-*/--chart-*, leaving --background/--card/--muted/--border neutral. Also a default-vs-preset inconsistency: default --accent is brand orange, every preset --accent is neutral gray. Make the preset hue reach the surfaces the user actually looks at: subtle brand tint on elevated surface tokens via @theme inline color-mix, plus targeted --primary on send button, user message bubble, active conversation row, suggested-card hover.","notes":"Implemented bolder surface tinting (user chose 'tint surfaces'). 6 edits: (1) globals.css @theme inline surface tokens color-mix toward --primary [bg 3%, card/popover 5%, secondary/muted 7%, accent 20%, border/input 10%, sidebar 4%] - one DRY change auto-scales to every preset incl default. (2) send button bg-foreground-\u003ebg-primary. (3) user bubble bg-secondary-\u003ebg-primary. (4) active history row dashed-underline -\u003e bg-primary/10 pill. (5) suggested cards hover:border-primary/40. Verified live: ocean-breeze blue nav/send/bubble; rose-garden -\u003e nav+bubble+bg-wash all rose. Biome clean. NOT committed (awaiting user reaction). Unrelated chat-500 persists.","status":"closed","priority":2,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-06-18T17:18:57Z","created_by":"HamChowderr","updated_at":"2026-06-18T20:29:46Z","closed_at":"2026-06-18T20:29:46Z","close_reason":"Completed this session (commit ffc4837).","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-v9z3","title":"Redesign bottom-left account menu (sidebar-user-nav) + fix nonsensical scroll","description":"DropdownMenuContent width pinned to narrow sidebar (w-(--radix-popper-anchor-width)), unpolished; Color theme preset submenu likely causes odd scroll. Fix: proper width (w-56), header row + icons, max-h on submenu.","status":"closed","priority":2,"issue_type":"bug","owner":"admin@otakusolutions.io","created_at":"2026-06-18T16:21:17Z","created_by":"HamChowderr","updated_at":"2026-06-18T20:29:46Z","closed_at":"2026-06-18T20:29:46Z","close_reason":"Completed this session (commit ffc4837).","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-shg7","title":"Settings sidebar double-highlights Integrations + API Keys","description":"settings-shell.tsx active logic uses pathname.startsWith(href); API Keys route /settings/integrations/mcp is a sub-path of /settings/integrations so both highlight. Fix: most-specific match wins.","status":"closed","priority":2,"issue_type":"bug","owner":"admin@otakusolutions.io","created_at":"2026-06-18T16:21:11Z","created_by":"HamChowderr","updated_at":"2026-06-18T20:29:46Z","closed_at":"2026-06-18T20:29:46Z","close_reason":"Completed this session (commit ffc4837).","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-x8rj","title":"CI: db-types Docker pull of postgres-meta hits AWS ECR rate-limit (toomanyrequests)","description":"The 'db types fresh' job runs 'supabase gen types --local', which pulls public.ecr.aws/supabase/postgres-meta unauthenticated. On shared runners this intermittently fails with 'docker: toomanyrequests: Rate exceeded' (exit 125), producing empty type output and a false diff failure. Distinct from foreman-fjl3 (the supabase-CLI GitHub-API rate-limit, fixed by pinning). Harden by authenticating Docker pulls (docker/login-action with a token) or pre-pulling/caching the postgres-meta image. Hit twice this session; a re-run currently clears it.","status":"open","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-18T04:06:29Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:56Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-fjl3","title":"CI: pin/auth Supabase CLI in db-types job to stop rate-limit flakes","description":"The 'db types fresh' job uses supabase/setup-cli which resolves the LATEST release via an unauthenticated GitHub API call. That got rate-limited on PR #18 ('Failed to resolve latest Supabase CLI release: rate limit exceeded'), failing the job in 9s with no real type drift. Pin the CLI to a fixed version (and/or pass GITHUB_TOKEN to the setup action) so the job is deterministic and not subject to anonymous API rate limits.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-18T02:10:09Z","created_by":"HamChowderr","updated_at":"2026-06-18T03:38:15Z","closed_at":"2026-06-18T03:38:15Z","close_reason":"Merged to main via PR #19 (squash); db-types verified green in CI with pinned supabase-cli 2.107.0.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-g0tf","title":"README: document Zapier SDK CLI, login methods, sdk:check + add .env.example","description":"Update README for Zapier-community newcomers: new 'Working with the Zapier SDK' section (two packages, four login methods, npm run sdk:check, explore-yourself docs links), fix stale tool count 34-\u003e28 (x6) and 17-\u003e16 read-only, repoint dead 'see CLAUDE.md for env vars' pointer, and add packages/agents/.env.example + packages/web/.env.example (no .env.example existed).","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-17T22:54:14Z","created_by":"HamChowderr","updated_at":"2026-06-17T22:57:31Z","closed_at":"2026-06-17T22:57:31Z","close_reason":"Applied: new 'Working with the Zapier SDK' README section (CLI, 4 login methods, sdk:check, explore-yourself docs links), 34-\u003e28 (x6) + 17-\u003e16 count fixes, env-var pointer repointed, and packages/agents+web/.env.example created. Uncommitted pending user's commit decision.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-0yra","title":"Re-verify Zapier durable 403 on latest SDK 0.70.4 before sending engineer brief","description":"Bump @zapier/zapier-sdk 0.69.3 -\u003e 0.70.4 and re-run scripts/durable-pkce-probe.ts to confirm the runDurable userJwt 403 still reproduces on the latest SDK. Closes the 'are you on latest?' gap in docs/zapier-durable-questions-for-engineers.md. Changelog review (0.70.0-0.70.4) showed no durable-auth changes; this is the empirical confirmation.","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-16T16:58:24Z","created_by":"HamChowderr","updated_at":"2026-06-16T17:02:57Z","started_at":"2026-06-16T16:58:47Z","closed_at":"2026-06-16T17:02:57Z","close_reason":"Durable 403 reproduced on latest SDK 0.70.4; brief tightened. Version gap + endpoint-coverage honesty both addressed.","dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-sg23","title":"Vercel preview build fails (module_not_found) on alpha branch — align install with CI","description":"PR #17 Vercel preview deploy errors at buildStep with errorCode module_not_found ('cd packages/web \u0026\u0026 npm run build' exit 1), while all 5 GHA gating jobs (incl. web next build via npm ci) are GREEN on the same commit, and a clean local build passes. Install succeeds; .source self-regenerates via withMDX so it is not the cause. Build-log API is 403 (CLI token lacks build-log scope), so the exact module is dashboard-only. Divergence: Vercel installCommand 'npm install' (+ possible stale cached node_modules on a fresh branch) vs GHA 'npm ci'. Non-gating (main production deploys are Ready), does not block merge. Fix: set vercel.json installCommand to 'npm ci' to force a clean lockfile-exact install matching the proven-green CI path.","notes":"FIXED properly: root cause was a duplicated react in the alpha-regenerated lockfile — root node_modules/react 19.2.7 (ecosystem ^19.2.0) + nested packages/web/node_modules/react 19.2.4 (web's exact pin). next (hoisted to root) could not resolve react on Vercel's npm. Fix: root overrides react/react-dom=19.2.7 → clean reinstall dedupes to a SINGLE root react 19.2.7 (no nested copy), verified locally (lockfile single entry + web next build exit 0). Reverted the two wrong guesses (npm ci 3e8a5ec, rm -rf a5bb049); installCommand back to npm install.","status":"in_progress","priority":2,"issue_type":"bug","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-12T17:14:15Z","created_by":"HamChowderr","updated_at":"2026-06-12T17:59:22Z","started_at":"2026-06-12T17:14:36Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-sg23","title":"Vercel preview build fails (module_not_found) on alpha branch — align install with CI","description":"PR #17 Vercel preview deploy errors at buildStep with errorCode module_not_found ('cd packages/web \u0026\u0026 npm run build' exit 1), while all 5 GHA gating jobs (incl. web next build via npm ci) are GREEN on the same commit, and a clean local build passes. Install succeeds; .source self-regenerates via withMDX so it is not the cause. Build-log API is 403 (CLI token lacks build-log scope), so the exact module is dashboard-only. Divergence: Vercel installCommand 'npm install' (+ possible stale cached node_modules on a fresh branch) vs GHA 'npm ci'. Non-gating (main production deploys are Ready), does not block merge. Fix: set vercel.json installCommand to 'npm ci' to force a clean lockfile-exact install matching the proven-green CI path.","notes":"FIXED properly: root cause was a duplicated react in the alpha-regenerated lockfile — root node_modules/react 19.2.7 (ecosystem ^19.2.0) + nested packages/web/node_modules/react 19.2.4 (web's exact pin). next (hoisted to root) could not resolve react on Vercel's npm. Fix: root overrides react/react-dom=19.2.7 → clean reinstall dedupes to a SINGLE root react 19.2.7 (no nested copy), verified locally (lockfile single entry + web next build exit 0). Reverted the two wrong guesses (npm ci 3e8a5ec, rm -rf a5bb049); installCommand back to npm install.","status":"closed","priority":2,"issue_type":"bug","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-12T17:14:15Z","created_by":"HamChowderr","updated_at":"2026-06-21T03:37:19Z","started_at":"2026-06-12T17:14:36Z","closed_at":"2026-06-21T03:37:19Z","close_reason":"Root cause (duplicate react: root 19.2.7 vs nested web 19.2.4) is gone from the tree — web react is ^19.2.0 (caret), no nested react copy, single lockfile entry. Fix landed via the caret dedupe; bead was just never closed. Was non-gating (production deploys stayed Ready).","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-hlh0","title":"[web] Surface run fired_by/error_message + fix failed-status badge","description":"The agent API (GET /workflows/:id/runs) now returns fired_by/error_message/trigger_id (foreman-2afc), but the web doesn't render them, and there's a pre-existing display bug: the engine writes status 'failed' but workflows-client WorkflowRun.status + the StatusBadge map only know 'error', so failed runs render as 'running'. Fix: (1) WorkflowRun.status -\u003e 'running'|'success'|'failed' + add fired_by/error_message/trigger_id; (2) [id]/page.tsx StatusBadge map key error-\u003efailed + show how each run fired; (3) run detail page show fired_by + error_message. First visible slice of the broader 'surface new backend in UI' work (foreman-tbjb/7am4/ezsm).","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-12T16:30:49Z","created_by":"HamChowderr","updated_at":"2026-06-12T16:34:48Z","closed_at":"2026-06-12T16:34:48Z","close_reason":"Done (ada01c9): WorkflowRun type gains status=failed + fired_by/error_message/trigger_id; run list shows how each run fired + inline error on failure; run detail shows 'started by' + an error box. Fixed the pre-existing bug where failed runs rendered as 'running' (engine writes 'failed', web only knew 'error'). next build green.","dependencies":[{"issue_id":"foreman-hlh0","depends_on_id":"foreman-2afc","type":"discovered-from","created_at":"2026-06-12T09:30:48Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-tbjb","title":"[signals] notify() is inert — driving processes don't connect the providers","description":"The poll + channel SignalProviders are hosted on the foreman agent for notify(), but the processes that DRIVE them don't reliably CONNECT them, so notify() is a no-op (provider.agent undefined -\u003e notifyOwner returns early). (1) cron-driver-server drives zapierPollProvider.runDuePolls() but never calls getMastra()/builds the foreman agent, so poll notify() never fires. (2) channel: slack/bot.ts builds the agent lazily inside generateReply, AFTER matchAndFireChannelTriggers, so the channel provider isn't connected for trigger-only messages until the process first runs generateReply. (3) even when fired, notify targets synthetic threads (poll:\u003cid\u003e, channel:\u003cch\u003e:\u003croom\u003e) and no web UI consumes the notification store, so it's not user-visible. Workflow FIRING is unaffected/correct (doesn't need the agent). FIX: have the driving processes construct the agent at startup (cron-driver-server: getMastra() so the provider connects; webhook-server: build foreman at startup) + a web consumer of the notification store / thread to surface it. Until then notify() is scaffolding, not delivered.","notes":"CONNECT FIX DONE (commit 177c281): cron-driver-server + webhook-server now call getMastra() at startup -\u003e foreman agent built in-process -\u003e providers connected (+ notification storage available). Live-verified: cron logs 'poll provider connected: true'. So notify() now FIRES (writes to the notification store) on poll/channel trigger hits. REMAINING (the user-visible half): a web consumer of the notification store / agent thread to surface the notification in chat — bundles with the deferred background-tasks /background-tasks/stream consumer. Also: notify targets synthetic threads (poll:\u003cid\u003e, channel:\u003cch\u003e:\u003croom\u003e) — revisit thread targeting when wiring the UI.","status":"open","priority":2,"issue_type":"bug","owner":"admin@otakusolutions.io","created_at":"2026-06-12T05:22:51Z","created_by":"HamChowderr","updated_at":"2026-06-12T05:34:51Z","dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-7am4","title":"[agent] Adopt Mastra background tasks for long-running Zapier tools + web stream consumer","description":"backgroundTasks is enabled and /background-tasks/stream is built, but no tool opts in and nothing consumes the stream. Opt long-running read-only Zapier tools into background:{enabled:true} with a waitTimeoutMs so the agent loop proceeds (non-blocking chat). Add a web consumer of /background-tasks/stream to surface running-\u003edone + injected results. Keep approval-required write/delete tools synchronous (don't disturb the proposal flow). Live-verify on the dev server. 3rd Mastra primitive on its designed surface.","notes":"LIVE-VERIFIED (mastra dev). FINDING: backgrounding the read-only Zapier SDK tools HANGS mastra dev — enabling background injects a _background field into the tool input schema and Studio toJSONSchema over the Zapier zod schemas loops forever (same as lazy-init-zapier hang). mastra build is unaffected (no Studio). Bisected: no-flag binds :4111 in ~12s; flag-on-Zapier hangs. FIX (commit 0a20828): background search_history instead (simple 3-field schema) -\u003e dev binds in ~12s with flag on; /background-tasks/stream serves SSE 200 (manager live). lib/background.ts backgroundIfEnabled() gate, FOREMAN_BACKGROUND_TOOLS=1, OFF by default. REMAINING for full non-blocking UX (modest, search_history-only given the Zapier wall): waitTimeoutMs + web /background-tasks/stream consumer + end-to-end chat verify (LLM round-trip). Zapier tools blocked until alpha fixes toJSONSchema.","status":"in_progress","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-12T04:38:20Z","created_by":"HamChowderr","updated_at":"2026-06-12T05:05:59Z","started_at":"2026-06-12T04:42:18Z","dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-ueep","title":"[workflow] Live-verify the poll driver against a real Zapier read action","description":"poll-driver.ts (foreman-ld7s) is unit-tested only. Verify the real run path: bind a type=poll trigger to a real Zapier read action (e.g. gmail/new_email), run cron-driver-server, create a new record, assert exactly one workflow run fires and zero duplicates on re-poll; confirm baseline (first poll fires nothing) and intervalMinutes gating. Per verify-behavior-not-just-logic.","notes":"ORCHESTRATION LIVE-VERIFIED (commit 278246a): tests/live/poll-driver.test.ts, 4/4 green against real local Postgres. Proves attach_trigger(poll) -\u003e runDuePolls -\u003e executeWorkflow -\u003e real workflow_run row (fired_by=poll, trigger_id, status=success) + baseline (first poll no fire, cursor set) + dedup (no double-fire). Only the external Zapier read (runAction) is stubbed — DB was reset, no OAuth-connected app to create records in. REMAINING (thin, user-driven): smoke the literal real Zapier read by connecting an app (gmail) + creating a record while cron-driver-server runs; the SDK network call itself is covered by the tests/sdk live tier. The whole machinery around that call is now proven.","status":"open","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-12T00:35:12Z","created_by":"HamChowderr","updated_at":"2026-06-12T06:10:05Z","dependencies":[{"issue_id":"foreman-ueep","depends_on_id":"foreman-ld7s","type":"discovered-from","created_at":"2026-06-11T17:35:12Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-ld7s","title":"[workflow] Un-stub the poll trigger as a Foreman-native poll driver (tickPoll)","description":"Poll trigger type is documented in the migration and accepted by list/detach but hidden by attach-trigger and has no driver. Build src/workflows/poll-driver.ts mirroring cron-driver: read workflow_trigger type=poll, run the Zapier read action via runAction, diff results by config.dedupeKey field against last_dedupe_key cursor, fire executeWorkflow on new records, persist cursor. Un-stub attach_trigger (add poll + pollConfig). Wire into cron-driver-server. Rationale (explored alpha API hands-on): Mastra SignalProvider.poll() skips when zero in-memory subscriptions and notify() requires an in-process agent — it is built for provider-lives-in-agent/notify-thread, not a singleton worker firing DB workflows. SignalProvider will be adopted on the webhook/channel path instead. Keeps door open to Zapier watchTriggerInbox SSE later (iyq6).","status":"closed","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-12T00:27:10Z","created_by":"HamChowderr","updated_at":"2026-06-12T00:35:07Z","started_at":"2026-06-12T00:27:27Z","closed_at":"2026-06-12T00:35:07Z","close_reason":"Poll driver implemented + unit-tested; full agents suite green (288). Live Zapier integration tracked as follow-up.","dependencies":[{"issue_id":"foreman-ld7s","depends_on_id":"foreman-c63f","type":"discovered-from","created_at":"2026-06-11T17:27:10Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-22c3","title":"Evaluate Mastra signals/signal-providers/notifications vs Foreman's home-grown triggers","description":"Foreman is on @mastra/core 1.41 (post-bump). Mastra now ships native primitives that overlap with Foreman's hand-built trigger/workflow/notification system: (1) SignalProvider (poll OR webhook an external source -\u003e push notifications into agent threads) ~= Foreman's channel-trigger + cron-driver + the stubbed poll trigger (c63f); (2) built-in dedupeKey on notify() directly solves the dedup gap in tv5p (Foreman hand-rolls idempotency); (3) @mastra/github-signals is a production provider and Foreman already has a GitHub channel; (4) background-task suspend/resume for human approval + notification inbox ~= Foreman's proposal/approval flow. Sibling to iyq6 (Zapier-durable eval). Decide adopt-Mastra-native vs keep-own BEFORE building the v8k1 workflow epic. Confirmed code-side: backgroundTasks enabled in mastra/index.ts; pubsub is default in-process EventEmitter (no distributed backend — matters for 2-process + multi-instance); signals/signal-providers not used at all.","status":"open","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-11T22:33:47Z","created_by":"HamChowderr","updated_at":"2026-06-11T22:33:47Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-tbjb","title":"[signals] notify() is inert — driving processes don't connect the providers","description":"The poll + channel SignalProviders are hosted on the foreman agent for notify(), but the processes that DRIVE them don't reliably CONNECT them, so notify() is a no-op (provider.agent undefined -\u003e notifyOwner returns early). (1) cron-driver-server drives zapierPollProvider.runDuePolls() but never calls getMastra()/builds the foreman agent, so poll notify() never fires. (2) channel: slack/bot.ts builds the agent lazily inside generateReply, AFTER matchAndFireChannelTriggers, so the channel provider isn't connected for trigger-only messages until the process first runs generateReply. (3) even when fired, notify targets synthetic threads (poll:\u003cid\u003e, channel:\u003cch\u003e:\u003croom\u003e) and no web UI consumes the notification store, so it's not user-visible. Workflow FIRING is unaffected/correct (doesn't need the agent). FIX: have the driving processes construct the agent at startup (cron-driver-server: getMastra() so the provider connects; webhook-server: build foreman at startup) + a web consumer of the notification store / thread to surface it. Until then notify() is scaffolding, not delivered.","notes":"CONNECT FIX DONE (commit 177c281): cron-driver-server + webhook-server now call getMastra() at startup -\u003e foreman agent built in-process -\u003e providers connected (+ notification storage available). Live-verified: cron logs 'poll provider connected: true'. So notify() now FIRES (writes to the notification store) on poll/channel trigger hits. REMAINING (the user-visible half): a web consumer of the notification store / agent thread to surface the notification in chat — bundles with the deferred background-tasks /background-tasks/stream consumer. Also: notify targets synthetic threads (poll:\u003cid\u003e, channel:\u003cch\u003e:\u003croom\u003e) — revisit thread targeting when wiring the UI.","status":"closed","priority":2,"issue_type":"bug","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-12T05:22:51Z","created_by":"HamChowderr","updated_at":"2026-07-05T05:12:49Z","closed_at":"2026-07-05T05:12:49Z","close_reason":"SUPERSEDED by bazc: the signal providers this bug targets (notify() inert) were removed with the hand-rolled workflow/signals subsystem (82b24fb). App runs on trigger-inbox + durable now. File fresh against current arch if notify/signals is wanted.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-7am4","title":"[agent] Adopt Mastra background tasks for long-running Zapier tools + web stream consumer","description":"backgroundTasks is enabled and /background-tasks/stream is built, but no tool opts in and nothing consumes the stream. Opt long-running read-only Zapier tools into background:{enabled:true} with a waitTimeoutMs so the agent loop proceeds (non-blocking chat). Add a web consumer of /background-tasks/stream to surface running-\u003edone + injected results. Keep approval-required write/delete tools synchronous (don't disturb the proposal flow). Live-verify on the dev server. 3rd Mastra primitive on its designed surface.","notes":"RESOLVED + VERIFIED LIVE (2026-06-28). The non-blocking background path now actually works. KEY DISCOVERY via real e2e: tool-level `background` config is a SILENT NO-OP under Foreman's lazy `tools: () =\u003e buildForemanTools()` resolver — search_history ran synchronously (no task event, no onTaskComplete) despite the config. The AGENT-level `backgroundTasks.tools` map IS what dispatches. Final impl: (1) /chat switched stream()→streamUntilIdle(maxIdleMs=120s) so a bg result folds into the SAME response; (2) lib/background.ts backgroundToolsConfig() builds the agent-level opt-in from READ_ONLY_TOOL_IDS (kebab read-only Zapier ids, exported from zapier-sdk-tools) + search_history, waitTimeoutMs=30s; writes/destructive EXCLUDED (stay sync for approval flow); (3) manager config: backpressure='fallback-sync', concurrency 10/5, cleanup, onTaskComplete/Failed logging. NO env flag (removed FOREMAN_BACKGROUND_TOOLS entirely — user wanted no settings; hang is gone on alpha so no need). Verified: bg-task-running→completed on /background-tasks/stream + [bg-task] log + result injects; normal chat unaffected; lazy-init guard + unit tests + tsc green. NOTE: only search_history e2e'd (test user has no Zapier connection) — read-only Zapier tools use the identical agent-level opt-in by matching ids. UNCOMMITTED.","status":"in_progress","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-12T04:38:20Z","created_by":"HamChowderr","updated_at":"2026-06-28T16:30:55Z","started_at":"2026-06-12T04:42:18Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-ueep","title":"[workflow] Live-verify the poll driver against a real Zapier read action","description":"poll-driver.ts (foreman-ld7s) is unit-tested only. Verify the real run path: bind a type=poll trigger to a real Zapier read action (e.g. gmail/new_email), run cron-driver-server, create a new record, assert exactly one workflow run fires and zero duplicates on re-poll; confirm baseline (first poll fires nothing) and intervalMinutes gating. Per verify-behavior-not-just-logic.","notes":"ORCHESTRATION LIVE-VERIFIED (commit 278246a): tests/live/poll-driver.test.ts, 4/4 green against real local Postgres. Proves attach_trigger(poll) -\u003e runDuePolls -\u003e executeWorkflow -\u003e real workflow_run row (fired_by=poll, trigger_id, status=success) + baseline (first poll no fire, cursor set) + dedup (no double-fire). Only the external Zapier read (runAction) is stubbed — DB was reset, no OAuth-connected app to create records in. REMAINING (thin, user-driven): smoke the literal real Zapier read by connecting an app (gmail) + creating a record while cron-driver-server runs; the SDK network call itself is covered by the tests/sdk live tier. The whole machinery around that call is now proven.","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-12T00:35:12Z","created_by":"HamChowderr","updated_at":"2026-07-05T03:26:43Z","closed_at":"2026-07-05T03:26:43Z","close_reason":"Live poll-driver verification done: 278246a test(live) end-to-end poll driver against real Postgres.","dependencies":[{"issue_id":"foreman-ueep","depends_on_id":"foreman-ld7s","type":"discovered-from","created_at":"2026-06-11T17:35:12Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-ld7s","title":"[workflow] Un-stub the poll trigger as a Foreman-native poll driver (tickPoll)","description":"Poll trigger type is documented in the migration and accepted by list/detach but hidden by attach-trigger and has no driver. Build src/workflows/poll-driver.ts mirroring cron-driver: read workflow_trigger type=poll, run the Zapier read action via runAction, diff results by config.dedupeKey field against last_dedupe_key cursor, fire executeWorkflow on new records, persist cursor. Un-stub attach_trigger (add poll + pollConfig). Wire into cron-driver-server. Rationale (explored alpha API hands-on): Mastra SignalProvider.poll() skips when zero in-memory subscriptions and notify() requires an in-process agent — it is built for provider-lives-in-agent/notify-thread, not a singleton worker firing DB workflows. SignalProvider will be adopted on the webhook/channel path instead. Keeps door open to Zapier watchTriggerInbox SSE later (iyq6).","status":"closed","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-12T00:27:10Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-06-12T00:27:27Z","closed_at":"2026-06-12T00:35:07Z","close_reason":"Poll driver implemented + unit-tested; full agents suite green (288). Live Zapier integration tracked as follow-up.","dependencies":[{"issue_id":"foreman-ld7s","depends_on_id":"foreman-c63f","type":"discovered-from","created_at":"2026-06-11T17:27:10Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-22c3","title":"Evaluate Mastra signals/signal-providers/notifications vs Foreman's home-grown triggers","description":"Foreman is on @mastra/core 1.41 (post-bump). Mastra now ships native primitives that overlap with Foreman's hand-built trigger/workflow/notification system: (1) SignalProvider (poll OR webhook an external source -\u003e push notifications into agent threads) ~= Foreman's channel-trigger + cron-driver + the stubbed poll trigger (c63f); (2) built-in dedupeKey on notify() directly solves the dedup gap in tv5p (Foreman hand-rolls idempotency); (3) @mastra/github-signals is a production provider and Foreman already has a GitHub channel; (4) background-task suspend/resume for human approval + notification inbox ~= Foreman's proposal/approval flow. Sibling to iyq6 (Zapier-durable eval). Decide adopt-Mastra-native vs keep-own BEFORE building the v8k1 workflow epic. Confirmed code-side: backgroundTasks enabled in mastra/index.ts; pubsub is default in-process EventEmitter (no distributed backend — matters for 2-process + multi-instance); signals/signal-providers not used at all.","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-11T22:33:47Z","created_by":"HamChowderr","updated_at":"2026-07-05T05:12:52Z","closed_at":"2026-07-05T05:12:52Z","close_reason":"SUPERSEDED by bazc: evaluates Mastra signals vs home-grown triggers, but the home-grown signal/trigger system was removed (82b24fb); app now runs on trigger-inbox + durable. Re-scope if signals adoption is revisited.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-rpsr","title":"Fix flaky db-types CI job — 'supabase gen types --local' intermittently errors 'Access token not provided'","description":"CI job 'db types fresh' (.github/workflows/test.yml) is flaky: passes on some commits (4dd20ff, 25b1ed1), fails on others (51e2065, f677794, b1070ae, 040b6a6) with 'Access token not provided' from 'npx supabase gen types typescript --local', producing empty output → diff shows 0a1,4128 (empty vs committed 4128-line database.types.ts). NOT a stale-types problem and NOT caused by the SDK/mastra bump. Root cause: supabase/setup-cli@v1 uses version:latest (unpinned), and the drifted CLI intermittently requires an access token even for --local. Fix options: (1) pin setup-cli to a known-good supabase version; (2) ensure 'supabase start' is fully healthy before gen; (3) set SUPABASE_ACCESS_TOKEN (project avoids secrets). Verify locally by starting Foreman's own supabase (note: a different project's supabase '*_Zillow' was running during diagnosis).","status":"closed","priority":2,"issue_type":"bug","owner":"admin@otakusolutions.io","created_at":"2026-06-11T19:40:46Z","created_by":"HamChowderr","updated_at":"2026-06-11T20:18:52Z","closed_at":"2026-06-11T20:18:52Z","close_reason":"Fixed (379d9b4): added a placeholder SUPABASE_ACCESS_TOKEN to the CI db-types step. The latest supabase CLI demands a token's presence before local type-gen in Linux CI (value unused for --local). All 5 CI jobs green on main (run 27374657799). Also switched scripts to --local --workdir ../.. (cwd-independent) + documented the gotcha in CLAUDE.md.","dependencies":[{"issue_id":"foreman-rpsr","depends_on_id":"foreman-9zsp","type":"discovered-from","created_at":"2026-06-11T12:40:46Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-chxx","title":"Reskin README to myrp-build product-launch style (hero+badges, emoji sections, narrative, FAQ)","description":"Current README is content-complete but dry/dev-doc-toned. Rewrite to mirror hamchowderr/myrp-build README: centered hero + shields.io badges, emoji-prefixed sections split by ---, benefit-led narrative with example-prompt blockquotes, collapsible concrete example, ASCII pipeline diagram, dev-vs-self-hosted comparison table, annotated file-tree architecture, testing-tiers table, FAQ, acknowledgments, license stance. Preserve all factual content (5 agents, 34 Zapier tools, channel statuses, modes, testing tiers, deploy targets, live URLs, MIT license, contact). User-authorized.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-11T19:17:43Z","created_by":"HamChowderr","updated_at":"2026-06-11T19:28:04Z","closed_at":"2026-06-11T19:28:04Z","close_reason":"README reskinned to myrp-build product-launch style; committed b1070ae, pushed to origin/main, rendered + reviewed in Chrome.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-d8qq","title":"Durable auth proof — mint userJwt via standalone PKCE, confirm runDurable accepts it","description":"Replicate Foreman's PKCE OAuth flow (connect.ts: public client grwWZD..., login ports, scope 'internal credentials offline_access') in a standalone script to mint a real per-user userJwt, then call experimental runDurable with it. Goal: (1) prove a Foreman-style userJwt passes durable's userJwt security scheme (we've only confirmed client-creds FAILS); (2) capture the exact source_files/runtime contract error, since the entry-point contract is undocumented publicly (docs.zapier.com has zero durable refs; defineDurable is a Phase-2 stub). Output = precise question for Zapier engineers.","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-11T19:02:11Z","created_by":"HamChowderr","updated_at":"2026-06-11T19:09:27Z","started_at":"2026-06-11T19:02:21Z","closed_at":"2026-06-11T19:09:27Z","close_reason":"Auth proof complete: per-user PKCE userJwt 403s on durable (internal-scope wall). Disproved the 'usable via Foreman userJwt' claim; doc + 8bh9 corrected. Durable inaccessible to all public-SDK auth pending Zapier.","dependencies":[{"issue_id":"foreman-d8qq","depends_on_id":"foreman-8bh9","type":"discovered-from","created_at":"2026-06-11T12:02:11Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-0795","title":"Upgrade @mastra ecosystem to latest (core 1.32.1-\u003e1.41.0 + family) alongside Zapier SDK bump","description":"User requested everything on latest in one coordinated upgrade. Bump @mastra/core override 1.32.1-\u003e1.41.0 and the whole family to latest: memory 1.20.2, pg 1.12.1, observability 1.14.1, editor 0.11.1, ai-sdk 1.4.4, evals 1.2.4, loggers 1.1.2, duckdb 1.4.1, voice-openai 0.12.2, deployers 1.1.42/1.1.36, mastra CLI 1.12.2. Root cause this resolves: newer @mastra/pg requires core\u003e=1.34 and memory uses modelSupportsAttachments (core\u003e=~1.34) absent in pinned 1.32.1. Done jointly with foreman-8ujc (Zapier SDK 0.48-\u003e0.69.3) as a single clean-reinstall. Risk: core jumps 9 minors, expect breaking API changes -\u003e fix code, build+test must pass.","notes":"GREEN 2026-06-11 on branch chore/bump-zapier-mastra-latest. @mastra/core override 1.32.1→1.41.0 + family to latest (memory 1.20.2, pg 1.12.1, observability 1.14.1, editor 0.11.1, ai-sdk 1.4.4, evals 1.2.4, loggers 1.1.2, duckdb 1.4.1, voice-openai 0.12.2, deployers 1.1.42/1.1.36, mastra CLI 1.12.2). check:deps PASS (single core), mocked tests 276 passed/0 failed, mastra build exit 0 — no code changes needed, core 1.41 API back-compatible for Foreman's usage. Build's 'Invalid Mastra config' warning is the pre-existing lazy getMastra() pattern (index.ts:33), not a regression. NOT yet committed.","status":"closed","priority":2,"issue_type":"chore","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-11T15:21:53Z","created_by":"HamChowderr","updated_at":"2026-06-11T16:51:50Z","started_at":"2026-06-11T15:22:35Z","closed_at":"2026-06-11T16:51:50Z","close_reason":"@mastra ecosystem→latest (core 1.41.0), committed 5a89e66, on main via catch-up FF. check:deps/test/build green.","dependencies":[{"issue_id":"foreman-0795","depends_on_id":"foreman-2xdk","type":"discovered-from","created_at":"2026-06-11T08:21:52Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-7jn1","title":"[workflow] Decision: per-user Slack isolation sufficient vs build shared group-channel context","description":"Foreman already isolates per Slack user (resourceId per user; slack/bot.ts:58; foreman.ts memory scope resource). Mastra natively supports scope thread|resource but NO shared-group memory, and slack/bot.ts:137 never persists the channel thread to the conversation table. Decide: (A) per-user is enough (lock it), or (B) build shared group context = new channel_conversation table + group memory scope + thread persistence. If B, spawn the feature issue.","acceptance_criteria":"Decision recorded; if B, a scoped feature issue (channel_conversation table + group scope + persist channel thread) is filed.","status":"open","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:31:18Z","created_by":"HamChowderr","updated_at":"2026-06-11T08:31:18Z","dependencies":[{"issue_id":"foreman-7jn1","depends_on_id":"foreman-v8k1","type":"discovered-from","created_at":"2026-06-11T01:31:17Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-ezsm","title":"[workflow] Build the /workflows UI page (list saved automations + run history)","description":"foreman-v8k1 calls for a UI so users can see saved automations; it does not exist. Build a /workflows page in packages/web listing workflows + triggers + recent runs (status, error_message from the observability issue), using the existing /workflows/* API routes and the shadcn stack. Per-workflow run-history view.","acceptance_criteria":"/workflows lists the user's workflows + triggers; clicking shows run history incl. failed-run errors; reads from existing API routes.","status":"open","priority":2,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:31:13Z","created_by":"HamChowderr","updated_at":"2026-06-11T08:31:13Z","dependencies":[{"issue_id":"foreman-ezsm","depends_on_id":"foreman-v8k1","type":"discovered-from","created_at":"2026-06-11T01:31:13Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-8fcs","title":"[workflow] Tests: params.ts substitution + engine step-failure paths","description":"params.ts (extract/substitute/validate) and engine.ts step-failure handling (~80-122) are untested. Add unit tests: substituteParams (partial replace, unknown keys left as-is, nested/arrays), validateParams (missing detected), engine step failure (runAction throws -\u003e failed + error captured), generator-throw cleanup, empty-steps early-exit.","acceptance_criteria":"params + engine error paths covered; npm test green.","status":"open","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:31:09Z","created_by":"HamChowderr","updated_at":"2026-06-11T08:31:09Z","dependencies":[{"issue_id":"foreman-8fcs","depends_on_id":"foreman-v8k1","type":"discovered-from","created_at":"2026-06-11T01:31:08Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-2afc","title":"[workflow] Run-state \u0026 observability: orphaned 'running' rows on crash; persist error_message + trigger context","description":"engine.ts inserts workflow_run status=running (~line 56) and never sets failed if executeWorkflow throws before completing -\u003e rows orphaned forever. Wrap generator consumption in try/finally at each call site (routes/workflows.ts, channel-trigger.ts, cron-driver.ts) to mark failed with the error. Persist error_message + fired_by(manual/cron/channel) + trigger_id on workflow_run; trigger-fired runs only console.warn today and never appear in run history. Surface in GET /workflows/:id/runs.","acceptance_criteria":"A failed run shows status=failed + error_message within ~1s; cron/channel-fired runs appear in run history with trigger context; no rows stuck in running.","notes":"Part 1 DONE (4c5da4c): engine try/finally + settled flag = no run stuck in running; 3 unit tests. Part 2 GATED on user go: workflow_run migration (error_message, fired_by, trigger_id), thread trigger context through executeWorkflow + 3 driver sites, surface in GET /workflows/:id/runs, regen db types (needs Foreman local supabase up; a Zillow stack currently holds default ports).","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:31:04Z","created_by":"HamChowderr","updated_at":"2026-06-12T04:25:28Z","closed_at":"2026-06-12T04:25:28Z","close_reason":"Part 1 (4c5da4c): no run stuck in running. Part 2 (c039220): workflow_run migration + error_message/fired_by/trigger_id persisted + surfaced in GET runs. db:types:check clean, migration applies on clean reset, 300 tests green.","dependencies":[{"issue_id":"foreman-2afc","depends_on_id":"foreman-v8k1","type":"discovered-from","created_at":"2026-06-11T01:31:03Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-tv5p","title":"[workflow] BUG: trigger dedup/idempotency — channel-trigger has no dedup; cron can double-fire on same-minute restart","description":"channel-trigger.ts (matchAndFireChannelTriggers ~43-79) fires with NO dedup despite an unused workflow_trigger.last_dedupe_key column — a retried webhook = duplicate runs. Add a dedupe key (channel+sender+ts+text hash or delivery id) checked against last_dedupe_key before firing. Separately cron-driver.ts (~164-167) can double-fire if the process restarts mid-minute; add a guard/lock. runOne also swallows errors silently.","acceptance_criteria":"Duplicate webhook =\u003e 1 run not 2 (unit test); a new message =\u003e new run; cron fires once per minute even across a same-minute restart (unit test).","status":"closed","priority":2,"issue_type":"bug","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:30:59Z","created_by":"HamChowderr","updated_at":"2026-06-12T03:29:21Z","started_at":"2026-06-12T03:15:08Z","closed_at":"2026-06-12T03:29:21Z","close_reason":"Channel dedup + cron same-minute atomic claim implemented and unit-tested per acceptance criteria. Error-surfacing portion tracked under 2afc.","dependencies":[{"issue_id":"foreman-tv5p","depends_on_id":"foreman-v8k1","type":"discovered-from","created_at":"2026-06-11T01:30:58Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-7jn1","title":"[workflow] Decision: per-user Slack isolation sufficient vs build shared group-channel context","description":"Foreman already isolates per Slack user (resourceId per user; slack/bot.ts:58; foreman.ts memory scope resource). Mastra natively supports scope thread|resource but NO shared-group memory, and slack/bot.ts:137 never persists the channel thread to the conversation table. Decide: (A) per-user is enough (lock it), or (B) build shared group context = new channel_conversation table + group memory scope + thread persistence. If B, spawn the feature issue.","acceptance_criteria":"Decision recorded; if B, a scoped feature issue (channel_conversation table + group scope + persist channel thread) is filed.","status":"open","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:31:18Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:56Z","dependencies":[{"issue_id":"foreman-7jn1","depends_on_id":"foreman-v8k1","type":"discovered-from","created_at":"2026-06-11T01:31:17Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-ezsm","title":"[workflow] Build the /workflows UI page (list saved automations + run history)","description":"foreman-v8k1 calls for a UI so users can see saved automations; it does not exist. Build a /workflows page in packages/web listing workflows + triggers + recent runs (status, error_message from the observability issue), using the existing /workflows/* API routes and the shadcn stack. Per-workflow run-history view.","acceptance_criteria":"/workflows lists the user's workflows + triggers; clicking shows run history incl. failed-run errors; reads from existing API routes.","status":"closed","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:31:13Z","created_by":"HamChowderr","updated_at":"2026-07-05T03:26:50Z","closed_at":"2026-07-05T03:26:50Z","close_reason":"SUPERSEDED: the /workflows page + /workflows API routes it depended on were removed and replaced by /automations (foreman-v8k1/bazc). Not to be built as specced.","dependencies":[{"issue_id":"foreman-ezsm","depends_on_id":"foreman-v8k1","type":"discovered-from","created_at":"2026-06-11T01:31:13Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-8fcs","title":"[workflow] Tests: params.ts substitution + engine step-failure paths","description":"params.ts (extract/substitute/validate) and engine.ts step-failure handling (~80-122) are untested. Add unit tests: substituteParams (partial replace, unknown keys left as-is, nested/arrays), validateParams (missing detected), engine step failure (runAction throws -\u003e failed + error captured), generator-throw cleanup, empty-steps early-exit.","acceptance_criteria":"params + engine error paths covered; npm test green.","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:31:09Z","created_by":"HamChowderr","updated_at":"2026-07-05T04:52:45Z","closed_at":"2026-07-05T04:52:45Z","close_reason":"SUPERSEDED by bazc: workflow engine + params.ts these tests targeted were removed (82b24fb).","dependencies":[{"issue_id":"foreman-8fcs","depends_on_id":"foreman-v8k1","type":"discovered-from","created_at":"2026-06-11T01:31:08Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-2afc","title":"[workflow] Run-state \u0026 observability: orphaned 'running' rows on crash; persist error_message + trigger context","description":"engine.ts inserts workflow_run status=running (~line 56) and never sets failed if executeWorkflow throws before completing -\u003e rows orphaned forever. Wrap generator consumption in try/finally at each call site (routes/workflows.ts, channel-trigger.ts, cron-driver.ts) to mark failed with the error. Persist error_message + fired_by(manual/cron/channel) + trigger_id on workflow_run; trigger-fired runs only console.warn today and never appear in run history. Surface in GET /workflows/:id/runs.","acceptance_criteria":"A failed run shows status=failed + error_message within ~1s; cron/channel-fired runs appear in run history with trigger context; no rows stuck in running.","notes":"Part 1 DONE (4c5da4c): engine try/finally + settled flag = no run stuck in running; 3 unit tests. Part 2 GATED on user go: workflow_run migration (error_message, fired_by, trigger_id), thread trigger context through executeWorkflow + 3 driver sites, surface in GET /workflows/:id/runs, regen db types (needs Foreman local supabase up; a Zillow stack currently holds default ports).","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:31:04Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-06-12T04:25:28Z","close_reason":"Part 1 (4c5da4c): no run stuck in running. Part 2 (c039220): workflow_run migration + error_message/fired_by/trigger_id persisted + surfaced in GET runs. db:types:check clean, migration applies on clean reset, 300 tests green.","dependencies":[{"issue_id":"foreman-2afc","depends_on_id":"foreman-v8k1","type":"discovered-from","created_at":"2026-06-11T01:31:03Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-tv5p","title":"[workflow] BUG: trigger dedup/idempotency — channel-trigger has no dedup; cron can double-fire on same-minute restart","description":"channel-trigger.ts (matchAndFireChannelTriggers ~43-79) fires with NO dedup despite an unused workflow_trigger.last_dedupe_key column — a retried webhook = duplicate runs. Add a dedupe key (channel+sender+ts+text hash or delivery id) checked against last_dedupe_key before firing. Separately cron-driver.ts (~164-167) can double-fire if the process restarts mid-minute; add a guard/lock. runOne also swallows errors silently.","acceptance_criteria":"Duplicate webhook =\u003e 1 run not 2 (unit test); a new message =\u003e new run; cron fires once per minute even across a same-minute restart (unit test).","status":"closed","priority":2,"issue_type":"bug","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:30:59Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-06-12T03:15:08Z","closed_at":"2026-06-12T03:29:21Z","close_reason":"Channel dedup + cron same-minute atomic claim implemented and unit-tested per acceptance criteria. Error-surfacing portion tracked under 2afc.","dependencies":[{"issue_id":"foreman-tv5p","depends_on_id":"foreman-v8k1","type":"discovered-from","created_at":"2026-06-11T01:30:58Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-wzmx","title":"[aimock] Resolve declared-but-unfixtured MCP/A2A mocks (write fixtures or remove declarations)","description":"aimock.json declares 8 MCP tools + 5 A2A agents but tests/fixtures/aimock/ has no mcp/ or a2a/ fixtures — a declared-vs-real mismatch that 503s under strict mode. Either write minimal fixtures for the tools/agents tests actually exercise, or remove the unused declarations so config reflects reality.","acceptance_criteria":"Every MCP/A2A declaration has a fixture OR is removed; npm test passes under strict mode with no unmatched MCP/A2A requests.","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:30:27Z","created_by":"HamChowderr","updated_at":"2026-06-11T21:42:33Z","started_at":"2026-06-11T21:37:23Z","closed_at":"2026-06-11T21:42:33Z","close_reason":"MCP/A2A declarations made real; orphaned mcp/tools.json folded in and removed","dependencies":[{"issue_id":"foreman-wzmx","depends_on_id":"foreman-9zsp","type":"discovered-from","created_at":"2026-06-11T01:30:27Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-wrrd","title":"[aimock] Enable strict mode and tighten/remove the empty-match catch-all fixture","description":"@copilotkit/aimock supports strict:true (verified config-loader.d.ts:101) so unmatched requests 503 instead of silently matching z-catchall.json (match {}), which currently risks false-green tests. Enable strict in packages/agents/aimock.json and remove/convert z-catchall to a strict error, fixing any tests that relied on the fallback.","acceptance_criteria":"aimock.json has strict:true; z-catchall removed/converted; npm test passes with every test hitting an explicit fixture.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:30:22Z","created_by":"HamChowderr","updated_at":"2026-06-11T21:43:26Z","closed_at":"2026-06-11T21:43:26Z","close_reason":"strict:true enabled in aimock.json; z-catchall.json deleted; npm test 278 passed/10 skipped under strict; strict 503 verified via probe","dependencies":[{"issue_id":"foreman-wrrd","depends_on_id":"foreman-9zsp","type":"discovered-from","created_at":"2026-06-11T01:30:21Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-xnis","title":"[bump] Surface getProfile as an agent tool; confirm trash option auto-surfaces on table-list tools","description":"Post-bump, surface worthwhile new stable methods. Add getProfile to READ_ONLY in zapier-sdk-tools.ts (agent can answer who-am-I-on-Zapier). Confirm the 0.57 trash option (exclude/include/only) auto-surfaces in listTableRecords/listTableFields tool schemas via the registry (likely no code change). Keep client-credentials mgmt + listTriggers excluded (documented in capability map).","acceptance_criteria":"getProfile in READ_ONLY and callable; trash param present in table-list tool input schema; tests pass.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:30:17Z","created_by":"HamChowderr","updated_at":"2026-06-11T21:50:31Z","closed_at":"2026-06-11T21:50:31Z","close_reason":"getProfile already surfaced as a read-only tool (in READ_ONLY set, generated via sdk.getRegistry; added 7wks ago in 2092317) — agent can answer who-am-I-on-Zapier, no change needed. 'Trash option': no 'trash' field exists anywhere in @zapier/zapier-sdk@0.69.3; tool params auto-surface from SDK Zod schemas (mechanism verified) but there is nothing to surface — note is stale.","dependencies":[{"issue_id":"foreman-xnis","depends_on_id":"foreman-8ujc","type":"discovered-from","created_at":"2026-06-11T01:30:17Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-98j3","title":"[durable] Decision: keep home-grown workflow engine for v1; Zapier durable API is post-v1","description":"Exploration verdict: KEEP-OWN-ENGINE. Zapier durable workflows (createWorkflow/publishWorkflowVersion/runDurable/triggerWorkflow) are experimental, server-shape-passthrough, still churning (0.69.3 field-drop fix), and lack conversation-context linkage; Foreman's engine is stable, conversation-aware, full DB control. Record decision + revisit criteria (durable API stable AND need durable/async execution AND conversation linkage solvable).","acceptance_criteria":"Decision recorded (capability map or an ADR) with the what-Zapier-gives / what-we-give / revisit-criteria table.","notes":"NEEDS ENGINEER VALIDATION before locking — this is a real tradeoff, not a clean win. Adopting Zapier's durable API would OFFLOAD durability/retry, hosted execution, versioning, and real-time triggers that we otherwise build+maintain ourselves; keeping our own engine means carrying that burden. Ask engineering: (1) projected maintenance cost of our own engine's reliability over the next 6-12mo; (2) is the durable API stable enough to bet a core feature on, and can we bridge conversation-context into it; (3) incremental (a few steps) vs all-in vs not-yet. Recommendation (keep-own for v1) is reversible — revisit criteria in the description. Do not close without engineering sign-off.","status":"open","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:29:40Z","created_by":"HamChowderr","updated_at":"2026-06-11T08:47:44Z","dependencies":[{"issue_id":"foreman-98j3","depends_on_id":"foreman-iyq6","type":"discovered-from","created_at":"2026-06-11T01:29:40Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-c63f","title":"[trigger-inbox] Design + decide: implement the stubbed poll trigger via trigger-inbox vs build-own","description":"Foreman's poll trigger type is a stub (attach-trigger.ts, routes/workflows.ts) with no driver; the trigger-inbox API is the natural implementation (app-event subscriptions). After the spike, design: workflow_trigger schema additions (trigger_inbox_id, app/action), a TriggerInboxClient wrapper, attach_trigger extension to accept type=poll, and a poll-driver worker (drain/watch). Decide incremental (poll alongside cron/channel) vs full. Gate before implementation issues are spawned. Relates to foreman-v8k1.","acceptance_criteria":"Written design + decision (incremental/full/skip) with schema diff and the implementation issues it spawns. Blocked by the spike.","status":"open","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:29:29Z","created_by":"HamChowderr","updated_at":"2026-06-11T08:29:29Z","dependencies":[{"issue_id":"foreman-c63f","depends_on_id":"foreman-bdjp","type":"blocks","created_at":"2026-06-11T01:31:50Z","created_by":"HamChowderr","metadata":"{}"},{"issue_id":"foreman-c63f","depends_on_id":"foreman-iyq6","type":"discovered-from","created_at":"2026-06-11T01:29:29Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-bdjp","title":"[trigger-inbox] Spike: prototype a poll-driver against one app (ensure/lease/ack/drain)","description":"Access confirmed empirically 2026-06-11 (iyq6 notes: listTriggerInboxes-\u003e[], listTriggers(github)-\u003e23). Build a throwaway poll-trigger driver on the SDK /experimental trigger-inbox API: ensureTriggerInbox for one app (e.g. GitHub new-issue), lease messages with a timeout, run a workflow per message, ack on success / release on error, log lease+dup metrics. Goal: learn the real lifecycle (connection binding, input schema via getTriggerInputFieldsSchema, watchTriggerInbox SSE) before wiring it in. Needs SDK bumped or a local /experimental install.","acceptance_criteria":"Prototype creates an inbox, drains/acks \u003e=1 message, shows correct lease/ack/release; findings in docs/trigger-inbox-spike.md with a go/no-go rec.","status":"open","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:29:19Z","created_by":"HamChowderr","updated_at":"2026-06-11T08:29:19Z","dependencies":[{"issue_id":"foreman-bdjp","depends_on_id":"foreman-iyq6","type":"discovered-from","created_at":"2026-06-11T01:29:19Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"foreman-98j3","title":"[durable] Decision: keep home-grown workflow engine for v1; Zapier durable API is post-v1","description":"Exploration verdict: KEEP-OWN-ENGINE. Zapier durable workflows (createWorkflow/publishWorkflowVersion/runDurable/triggerWorkflow) are experimental, server-shape-passthrough, still churning (0.69.3 field-drop fix), and lack conversation-context linkage; Foreman's engine is stable, conversation-aware, full DB control. Record decision + revisit criteria (durable API stable AND need durable/async execution AND conversation linkage solvable).","acceptance_criteria":"Decision recorded (capability map or an ADR) with the what-Zapier-gives / what-we-give / revisit-criteria table.","notes":"NEEDS ENGINEER VALIDATION before locking — this is a real tradeoff, not a clean win. Adopting Zapier's durable API would OFFLOAD durability/retry, hosted execution, versioning, and real-time triggers that we otherwise build+maintain ourselves; keeping our own engine means carrying that burden. Ask engineering: (1) projected maintenance cost of our own engine's reliability over the next 6-12mo; (2) is the durable API stable enough to bet a core feature on, and can we bridge conversation-context into it; (3) incremental (a few steps) vs all-in vs not-yet. Recommendation (keep-own for v1) is reversible — revisit criteria in the description. Do not close without engineering sign-off.","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:29:40Z","created_by":"HamChowderr","updated_at":"2026-07-05T04:52:45Z","closed_at":"2026-07-05T04:52:45Z","close_reason":"SUPERSEDED by bazc: keep-home-grown-engine decision reversed; engine removed (82b24fb), rebuilt on durable.","dependencies":[{"issue_id":"foreman-98j3","depends_on_id":"foreman-iyq6","type":"discovered-from","created_at":"2026-06-11T01:29:40Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-c63f","title":"[trigger-inbox] Design + decide: implement the stubbed poll trigger via trigger-inbox vs build-own","description":"Foreman's poll trigger type is a stub (attach-trigger.ts, routes/workflows.ts) with no driver; the trigger-inbox API is the natural implementation (app-event subscriptions). After the spike, design: workflow_trigger schema additions (trigger_inbox_id, app/action), a TriggerInboxClient wrapper, attach_trigger extension to accept type=poll, and a poll-driver worker (drain/watch). Decide incremental (poll alongside cron/channel) vs full. Gate before implementation issues are spawned. Relates to foreman-v8k1.","acceptance_criteria":"Written design + decision (incremental/full/skip) with schema diff and the implementation issues it spawns. Blocked by the spike.","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:29:29Z","created_by":"HamChowderr","updated_at":"2026-07-05T04:52:45Z","closed_at":"2026-07-05T04:52:45Z","close_reason":"DONE: trigger-inbox decision recorded (docs/trigger-inbox-spike.md f01e9eb); acted on via worker.ts lease/ack loop.","dependencies":[{"issue_id":"foreman-c63f","depends_on_id":"foreman-iyq6","type":"discovered-from","created_at":"2026-06-11T01:29:29Z","created_by":"HamChowderr","metadata":"{}"},{"issue_id":"foreman-c63f","depends_on_id":"foreman-bdjp","type":"blocks","created_at":"2026-06-11T01:31:50Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-bdjp","title":"[trigger-inbox] Spike: prototype a poll-driver against one app (ensure/lease/ack/drain)","description":"Access confirmed empirically 2026-06-11 (iyq6 notes: listTriggerInboxes-\u003e[], listTriggers(github)-\u003e23). Build a throwaway poll-trigger driver on the SDK /experimental trigger-inbox API: ensureTriggerInbox for one app (e.g. GitHub new-issue), lease messages with a timeout, run a workflow per message, ack on success / release on error, log lease+dup metrics. Goal: learn the real lifecycle (connection binding, input schema via getTriggerInputFieldsSchema, watchTriggerInbox SSE) before wiring it in. Needs SDK bumped or a local /experimental install.","acceptance_criteria":"Prototype creates an inbox, drains/acks \u003e=1 message, shows correct lease/ack/release; findings in docs/trigger-inbox-spike.md with a go/no-go rec.","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:29:19Z","created_by":"HamChowderr","updated_at":"2026-07-05T03:26:31Z","closed_at":"2026-07-05T03:26:31Z","close_reason":"Trigger-inbox poll-driver spike executed (5 commits 1c5f995..f01e9eb); scripts/trigger-inbox-spike.ts present. Spike complete.","dependencies":[{"issue_id":"foreman-bdjp","depends_on_id":"foreman-iyq6","type":"discovered-from","created_at":"2026-06-11T01:29:19Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":1,"comment_count":0}
 {"_type":"issue","id":"foreman-x944","title":"SDK update watcher — detect new @zapier/zapier-sdk releases when working in Foreman","description":"Why: Foreman is a PRODUCT built on @zapier/zapier-sdk. We were 21 versions behind (0.48 vs 0.69) and nearly rebuilt durable-workflows + an 18-method trigger-inbox subsystem that Zapier already shipped. We need a standing mechanism so we never silently fall behind again — surfaced automatically when working in this project, not via manual luck. Build: (1) scripts/zapier-sdk-watch.mjs — compares the installed @zapier/zapier-sdk version against the npm 'latest', lists how many versions behind + release dates, and in full mode npm-packs latest to print the CHANGELOG delta tagged [NEW CAPABILITY]/[BEHAVIOR CHANGE]/[BUGFIX]/[DEPRECATION]; fail-safe (offline =\u003e exit 0, never blocks). (2) npm scripts sdk:check (full) + used by hook in --quiet mode. (3) SessionStart hook in .claude/settings.json running the quiet check (throttled ~once/day via a gitignored state file) so opening the project surfaces 'N new SDK versions since you last looked -\u003e run npm run sdk:check'. Phase 2 (optional): --file-issue flag to auto-open a bd issue, and/or a weekly CI job.","acceptance_criteria":"Running npm run sdk:check from repo root prints installed 0.48.0 vs latest 0.69.x, the version gap, and the changelog delta. The SessionStart quiet check prints a one-line notice only when a newer version exists, is throttled so it doesn't hit npm every session, and never blocks/errors session start (offline-safe). State file gitignored.","notes":"BUILT \u0026 TESTED (2026-06-11): scripts/zapier-sdk-watch.mjs watches BOTH @zapier/zapier-sdk (0.48.0 -\u003e 0.69.3, 28 behind) AND @zapier/zapier-sdk-cli (0.44.0 -\u003e 0.54.3, 33 behind — found pinned in root devDeps). Pure-fetch (npm registry + jsdelivr CHANGELOG), no child procs/tar, Node 18+ global fetch, offline-safe (always exit 0). Modes: full (per-pkg installed/latest/gap + changelog delta), --quiet (one-line per pkg, throttled ~once/day via gitignored scripts/.zapier-sdk-watch.json, only pings once per new latest), --json, --force, --no-changelog. Wired: root package.json scripts sdk:check + sdk:check:quiet; .gitignore for state file. BLOCKED: the SessionStart hook line in .claude/settings.json (node scripts/zapier-sdk-watch.mjs --quiet) was denied by the CC permission classifier as self-modification of startup config — needs explicit user approval to apply. Until then, run manually via npm run sdk:check.","status":"closed","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-11T07:59:42Z","created_by":"HamChowderr","updated_at":"2026-06-11T16:55:56Z","started_at":"2026-06-11T08:00:56Z","closed_at":"2026-06-11T16:55:56Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-iyq6","title":"Evaluate Zapier experimental durable-workflow API vs Foreman's own workflow engine","description":"MAJOR FINDING that contradicts foreman-v8k1's founding premise. v8k1 (filed 2026-05-09, verified against SDK 0.48) asserts 'the Zapier SDK/CLI is single-shot only — no API to create/save/trigger Zaps.' That WAS true at 0.48. As of 0.61-0.69, @zapier/zapier-sdk/experimental now exposes a full durable-workflow API (stable subpath still does NOT surface it): createWorkflow/updateWorkflow/enable/disable/deleteWorkflow, publish/list/getWorkflowVersion (publish source_files as a workflow version), runDurable/cancelDurableRun/list/getDurableRun, listWorkflowRuns/getWorkflowRun/getTriggerRun, triggerWorkflow (POSTs to a tokenized trigger_url), and watchTriggerInbox (0.69 SSE near-real-time trigger subscription). This is Zapier's 'durableworkflowzaps' / code-substrate product (durable hosted execution of published workflow code), NOT the classic Zap editor. Decision needed: Foreman already built its own workflow persistence + cron-driver + channel-trigger (works, full control). RECOMMENDATION: keep Foreman's engine as source of truth (the experimental API is /experimental-only, server-shape-authoritative, and a different execution model), but TRACK watchTriggerInbox + triggerWorkflow as a potential future replacement for the cron-driver polling loop (real-time vs minute-tick).","status":"open","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-11T07:49:50Z","created_by":"HamChowderr","updated_at":"2026-06-11T07:49:50Z","dependencies":[{"issue_id":"foreman-iyq6","depends_on_id":"foreman-v8k1","type":"discovered-from","created_at":"2026-06-11T00:49:50Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-8ujc","title":"Bump @zapier/zapier-sdk 0.48.0 -\u003e 0.69.3","description":"We are 21 minor versions behind (0.48.0 installed; 0.69.3 latest, released 2026-06-10). Foreman constructs the SDK via the stable createZapierSdk({...}) factory (lib/zapier/sdk.ts, lib/zapier-sdk-tools.ts, lib/catalog/seed.ts, tools/connect-zapier.ts) and calls sdk.runAction() (lib/zapier/execution.ts:86). Per the SDK changelog, createZapierSdk + every SDK method + the Zapier* error hierarchy keep their names across 0.61-0.69, so the bump is low-risk at the API surface. Foreman does NOT use the deprecated createSdk().addPlugin chain. Behavior changes to verify: (1) 0.67 normalizeError no longer wraps Error subclasses; (2) 0.69.1 pagination consume-once semantics. Value of the bump = action-layer hardening Foreman already depends on: FIFO concurrency semaphore (rate-limit safety), error-classification isPermanentHttpError (smarter retry: 4xx permanent vs 5xx/network/429 transient), staged polling backoff, 0.69.1 pagination truncation fix, stdout/stderr separation for clean CLI piping.","acceptance_criteria":"package.json bumped to ^0.69.x; npm install clean (dedup check passes); next build + full vitest (mocked tier) green; sdk.runAction call path verified working against a live action in test:sdk tier.","notes":"GREEN 2026-06-11 on branch chore/bump-zapier-mastra-latest (done jointly w/ foreman-0795 @mastra upgrade). @zapier/zapier-sdk ^0.69.3 (agents resolve 0.69.3), @zapier/zapier-sdk-cli ^0.54.3. Clean reinstall. check:deps PASS, mocked tests 276 passed/0 failed, mastra build exit 0. NOT yet committed; test:sdk (live) not run (awaiting consent).","status":"open","priority":2,"issue_type":"chore","owner":"admin@otakusolutions.io","created_at":"2026-06-11T07:49:45Z","created_by":"HamChowderr","updated_at":"2026-06-11T15:34:29Z","dependencies":[{"issue_id":"foreman-8ujc","depends_on_id":"foreman-2xdk","type":"blocks","created_at":"2026-06-11T01:31:55Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-iyq6","title":"Evaluate Zapier experimental durable-workflow API vs Foreman's own workflow engine","description":"MAJOR FINDING that contradicts foreman-v8k1's founding premise. v8k1 (filed 2026-05-09, verified against SDK 0.48) asserts 'the Zapier SDK/CLI is single-shot only — no API to create/save/trigger Zaps.' That WAS true at 0.48. As of 0.61-0.69, @zapier/zapier-sdk/experimental now exposes a full durable-workflow API (stable subpath still does NOT surface it): createWorkflow/updateWorkflow/enable/disable/deleteWorkflow, publish/list/getWorkflowVersion (publish source_files as a workflow version), runDurable/cancelDurableRun/list/getDurableRun, listWorkflowRuns/getWorkflowRun/getTriggerRun, triggerWorkflow (POSTs to a tokenized trigger_url), and watchTriggerInbox (0.69 SSE near-real-time trigger subscription). This is Zapier's 'durableworkflowzaps' / code-substrate product (durable hosted execution of published workflow code), NOT the classic Zap editor. Decision needed: Foreman already built its own workflow persistence + cron-driver + channel-trigger (works, full control). RECOMMENDATION: keep Foreman's engine as source of truth (the experimental API is /experimental-only, server-shape-authoritative, and a different execution model), but TRACK watchTriggerInbox + triggerWorkflow as a potential future replacement for the cron-driver polling loop (real-time vs minute-tick).","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-11T07:49:50Z","created_by":"HamChowderr","updated_at":"2026-07-05T04:52:45Z","closed_at":"2026-07-05T04:52:45Z","close_reason":"DONE: durable-vs-own eval recorded in docs/durable-workflow-spike.md; acted on (migrated to lib/durable/).","dependencies":[{"issue_id":"foreman-iyq6","depends_on_id":"foreman-v8k1","type":"discovered-from","created_at":"2026-06-11T00:49:50Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-8ujc","title":"Bump @zapier/zapier-sdk 0.48.0 -\u003e 0.69.3","description":"We are 21 minor versions behind (0.48.0 installed; 0.69.3 latest, released 2026-06-10). Foreman constructs the SDK via the stable createZapierSdk({...}) factory (lib/zapier/sdk.ts, lib/zapier-sdk-tools.ts, lib/catalog/seed.ts, tools/connect-zapier.ts) and calls sdk.runAction() (lib/zapier/execution.ts:86). Per the SDK changelog, createZapierSdk + every SDK method + the Zapier* error hierarchy keep their names across 0.61-0.69, so the bump is low-risk at the API surface. Foreman does NOT use the deprecated createSdk().addPlugin chain. Behavior changes to verify: (1) 0.67 normalizeError no longer wraps Error subclasses; (2) 0.69.1 pagination consume-once semantics. Value of the bump = action-layer hardening Foreman already depends on: FIFO concurrency semaphore (rate-limit safety), error-classification isPermanentHttpError (smarter retry: 4xx permanent vs 5xx/network/429 transient), staged polling backoff, 0.69.1 pagination truncation fix, stdout/stderr separation for clean CLI piping.","acceptance_criteria":"package.json bumped to ^0.69.x; npm install clean (dedup check passes); next build + full vitest (mocked tier) green; sdk.runAction call path verified working against a live action in test:sdk tier.","notes":"GREEN 2026-06-11 on branch chore/bump-zapier-mastra-latest (done jointly w/ foreman-0795 @mastra upgrade). @zapier/zapier-sdk ^0.69.3 (agents resolve 0.69.3), @zapier/zapier-sdk-cli ^0.54.3. Clean reinstall. check:deps PASS, mocked tests 276 passed/0 failed, mastra build exit 0. NOT yet committed; test:sdk (live) not run (awaiting consent).","status":"closed","priority":2,"issue_type":"chore","owner":"admin@otakusolutions.io","created_at":"2026-06-11T07:49:45Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-06-25T16:09:27Z","close_reason":"Superseded by foreman-9t9g — bumped straight to 0.79.0 (past the 0.69.3 target) on 2026-06-25.","dependencies":[{"issue_id":"foreman-8ujc","depends_on_id":"foreman-2xdk","type":"blocks","created_at":"2026-06-11T01:31:55Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-5rph","title":"next dev --turbo OOM-storms on Windows (web dev server unusable)","description":"npm run dev (next dev --turbo, Next 16.2.4) reaches Ready then, while compiling '/', spawns 200+ node processes that each FATAL OOM at ~8MB heap — a spawn storm that hangs the machine. next build is FINE. ROOT CAUSE: known/open Turbopack-dev-on-Windows memory bug (vercel/next.js #81161, #88614, #66326, #91396; #91396 notes Tailwind CSS compilation can spawn infinite node processes). Aggravators on this box: only ~6GB free RAM of 15.4GB; Node v24 (very new); aggressive experimental stack in next.config.ts (cacheComponents:true + turbopackFileSystemCacheForDev:true + prefetchInlining/cachedNavigations/appNewScrollHandler/inlineCss); our large globals.css (8 theme presets) increases Tailwind work. Also harmless noise: 'Found lockfile missing swc dependencies, patching' -\u003e Next misdetects pnpm in the npm workspace -\u003e ENOWORKSPACES (silence with NEXT_IGNORE_INCORRECT_LOCKFILE=1). swc native binary IS present, so not a missing-binary issue. CANDIDATE FIXES (to test): webpack dev (next dev --webpack); disable turbopackFileSystemCacheForDev; preloadEntriesOnStart:false; NODE_OPTIONS heap bump. Goal: a working local dev so the real chat can be verified.","notes":"ROOT CAUSE CONFIRMED + Defender RULED OUT. Disabling experimental turbopackFileSystemCacheForDev (+ preloadEntriesOnStart:false) in next.config.ts ELIMINATES the storm: peak 3 node procs (was 200+), no OOM. Defender is NOT the cause — measured MsMpEng=0 CPU-sec during compile; node ~0.5 CPU-sec/25s. With the mitigation, dev is FAST for app routes: /auth/login first-compile 720ms, cached 85ms, HTTP 200. The only slow route is the heavy marketing landing '/' (many client demos + framer-motion + cacheComponents prerender) — not relevant to chat verification. FIX: keep turbopackFileSystemCacheForDev disabled; keep preloadEntriesOnStart:false; optionally add NEXT_IGNORE_INCORRECT_LOCKFILE=1 to the dev script to silence the harmless 'patching lockfile'-\u003epnpm ENOWORKSPACES noise. Do NOT disable Windows Defender. Upstream: vercel/next.js turbopack-dev-on-Windows memory bugs (#81161/#88614/#66326/#91396).","status":"closed","priority":2,"issue_type":"bug","owner":"admin@otakusolutions.io","created_at":"2026-06-02T10:11:28Z","created_by":"HamChowderr","updated_at":"2026-06-02T11:08:10Z","closed_at":"2026-06-02T11:08:10Z","close_reason":"Fixed + verified (committed 8d06637). Disabled experimental turbopackFileSystemCacheForDev (Windows OOM-storm trigger) + preloadEntriesOnStart:false; set turbopack.root to workspace root; dev script uses cross-env NEXT_IGNORE_INCORRECT_LOCKFILE=1 to silence the false-positive lockfile patch. Clean npm run dev: no noise, no storm, Ready ~0.5s, /auth/login 200 \u003c0.1s. outputFileTracingRoot recommended only if/when output:'standalone' is adopted (PM2 deploy doesn't need it now).","dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-te0c","title":"Re-skin web chat UI to match myrp-build (Cursor/ChatGPT style)","description":"Make Foreman web chat look + feel like myrp-build's chat. Streaming/tool/reasoning logic is already near-identical; this is a re-skin. Scope (user chose Full match + port 8 theme presets): (1) restyle messages — drop assistant bubble to plain text, keep subtle user bubble, add 7px Bot/User avatars; (2) restyle tool cards — bordered card not iMessage bubble, amber approval banner w/ Approve/Decline; (3) swap design tokens to OKLch palette + Sora/JetBrains Mono fonts; (4) port 8 OKLch theme presets + switcher; (5) port checkpoint (restore/undo) + conversation stick-to-bottom wrapper. Transport stays HTTP/SSE (web app), not Electron IPC. Source of truth: C:/Users/HamCh/code/myrp-build/src/renderer/src.","notes":"IMPLEMENTED + VERIFIED (not committed). Full re-skin done: globals.css token set in orange brand + dark variant + tw-animate-css + 8 presets; codemod text-muted-\u003etext-muted-foreground (33 files); tool.tsx bordered card; message.tsx avatars+plain assistant+subtle user bubble+amber approval; link color-\u003eprimary; checkpoint.tsx + conversation.tsx ported (+deps tw-animate-css, use-stick-to-bottom); theme-presets.ts + picker in sidebar-user-nav + no-flash bootstrap. next build PASS x2, tsc PASS. Browser-verified via temp /preview route (since removed): light + dark + ocean-breeze preset all correct; landing brand preserved. NOTE: dev server (next dev --turbo) OOMs on this Windows box (Next16 Cache Components) — used next start on the production build to verify. FOLLOW-UPS: (1) checkpoint restore needs a backend undo endpoint before wiring into live chat; (2) optionally wire Conversation stick-to-bottom into messages.tsx (kept existing scroll). Awaiting user review before commit/push.","status":"closed","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-02T09:03:13Z","created_by":"HamChowderr","updated_at":"2026-06-02T10:04:19Z","started_at":"2026-06-02T09:03:45Z","closed_at":"2026-06-02T10:04:19Z","close_reason":"Chat re-skin complete + verified (light/dark/preset, landing brand preserved, clean next build). Conversation wrapper wired (foreman-u5j7). Checkpoint restore skipped (foreman-9hoq). Committing to feature/chat-ui-myrp-reskin.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-te0c","title":"Re-skin web chat UI to match myrp-build (Cursor/ChatGPT style)","description":"Make Foreman web chat look + feel like myrp-build's chat. Streaming/tool/reasoning logic is already near-identical; this is a re-skin. Scope (user chose Full match + port 8 theme presets): (1) restyle messages — drop assistant bubble to plain text, keep subtle user bubble, add 7px Bot/User avatars; (2) restyle tool cards — bordered card not iMessage bubble, amber approval banner w/ Approve/Decline; (3) swap design tokens to OKLch palette + Sora/JetBrains Mono fonts; (4) port 8 OKLch theme presets + switcher; (5) port checkpoint (restore/undo) + conversation stick-to-bottom wrapper. Transport stays HTTP/SSE (web app), not Electron IPC. Source of truth: C:/Users/HamCh/code/myrp-build/src/renderer/src.","notes":"IMPLEMENTED + VERIFIED (not committed). Full re-skin done: globals.css token set in orange brand + dark variant + tw-animate-css + 8 presets; codemod text-muted-\u003etext-muted-foreground (33 files); tool.tsx bordered card; message.tsx avatars+plain assistant+subtle user bubble+amber approval; link color-\u003eprimary; checkpoint.tsx + conversation.tsx ported (+deps tw-animate-css, use-stick-to-bottom); theme-presets.ts + picker in sidebar-user-nav + no-flash bootstrap. next build PASS x2, tsc PASS. Browser-verified via temp /preview route (since removed): light + dark + ocean-breeze preset all correct; landing brand preserved. NOTE: dev server (next dev --turbo) OOMs on this Windows box (Next16 Cache Components) — used next start on the production build to verify. FOLLOW-UPS: (1) checkpoint restore needs a backend undo endpoint before wiring into live chat; (2) optionally wire Conversation stick-to-bottom into messages.tsx (kept existing scroll). Awaiting user review before commit/push.","status":"closed","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-02T09:03:13Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-06-02T09:03:45Z","closed_at":"2026-06-02T10:04:19Z","close_reason":"Chat re-skin complete + verified (light/dark/preset, landing brand preserved, clean next build). Conversation wrapper wired (foreman-u5j7). Checkpoint restore skipped (foreman-9hoq). Committing to feature/chat-ui-myrp-reskin.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-rqvj","title":"Capture Mastra runtime tables in migrations","description":"Mastra creates these tables at runtime that aren't in supabase/migrations/: mastra_channel_config, mastra_channel_installations, mastra_schedule_triggers, mastra_schedules. They appeared in the local DB during normal dev and caused database.types.ts drift in PR #14 — see commit 25b1ed1. Capture their exact DDL (via npx supabase db dump --local) into a new migration so CI's clean DB matches local and db:types:check stays meaningful locally. Also worth auditing 20260426000019_mastra.sql for any other Mastra tables that have been added in newer @mastra/core versions.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-05-14T07:41:54Z","created_by":"HamChowderr","updated_at":"2026-05-14T14:45:57Z","closed_at":"2026-05-14T14:45:57Z","close_reason":"Resolved by commit 4dd20ff on feature/workflow-tools-crud — new migration 20260514000000_mastra_channels_and_schedules.sql captures all four @mastra/pg@1.10.0 runtime tables (mastra_channel_config, mastra_channel_installations, mastra_schedules, mastra_schedule_triggers). CI db types fresh passes; foreman-9zsp PR #14 fully green.","dependencies":[{"issue_id":"foreman-rqvj","depends_on_id":"foreman-9zsp","type":"discovered-from","created_at":"2026-05-14T00:41:53Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-8ktu","title":"Fix self_hosted mode description — should mirror cloud, not share single account","description":"Current text describing FOREMAN_MODE=self_hosted in code or docs claims it 'uses shared Zapier client credentials for all users (single account). Ideal for personal/team deployments where everyone shares one Zapier connection.'\n\nThis is wrong. Self-hosted is just cloud running on the user's own infra. Each user still gets their own per-user Zapier OAuth, same as cloud. The 'shared single account' description is from an earlier design that was reversed.\n\nScope:\n1. Find every occurrence describing self_hosted (probably in agents/src/lib/env.ts, mode docs in CLAUDE.md/AGENTS.md, prompt template, README).\n2. Update text to reflect: self_hosted = same per-user OAuth flow as cloud, just self-deployed infra.\n3. Verify code paths actually behave that way — env.ts, providers.ts, anywhere FOREMAN_MODE is branched on.\n4. If any code path actually treats self_hosted as 'shared single account', fix that to match docs.\n\nAcceptance: 'self_hosted' is documented as 'cloud, but on your own infra — same per-user auth model'. Code does not branch differently between cloud and self_hosted for connection ownership.","status":"closed","priority":2,"issue_type":"bug","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-05-09T22:23:46Z","created_by":"HamChowderr","updated_at":"2026-05-09T22:27:56Z","started_at":"2026-05-09T22:24:30Z","closed_at":"2026-05-09T22:27:56Z","close_reason":"Docs + code fixed. README and zapier-sdk.mdx now describe self_hosted as 'same per-user OAuth as production, on your own infra'. Removed the special-case getSharedSdk branch in zapier/sdk.ts — self_hosted now falls through to the same per-user OAuth path as production. Dev fallback narrowed to mode==='dev'.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-0cvh","title":"Install all shadcn/ui components in packages/web","description":"Bulk-install every shadcn component into packages/web/src/components/ui so upcoming /workflows UI work (foreman-1oxu) and dashboards (foreman-8yff) have everything available without piecemeal adds.\n\nVerify with shadcn CLI before running — registry changes; do not assume from training data. Use 'npx shadcn@latest add --help' first to find the official 'all' or registry-wide flag.\n\nFiles affected: packages/web/src/components/ui/*.tsx, packages/web/package.json (peer deps), components.json untouched.\n\nAcceptance: every component listed in 'npx shadcn@latest registry' (or equivalent) is present in src/components/ui, build still passes ('npm run build' in packages/web).","status":"closed","priority":2,"issue_type":"chore","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-05-09T22:15:20Z","created_by":"HamChowderr","updated_at":"2026-05-09T22:31:05Z","started_at":"2026-05-09T22:15:28Z","closed_at":"2026-05-09T22:31:05Z","close_reason":"All 55 shadcn components installed. Restored custom 'accent' variant on button + badge that the overwrite dropped. Removed dead 'table:' classNames key in calendar.tsx that was never valid in react-day-picker (verified v9 and v10 use identical strict { [key in UI | SelectionState | DayFlag | Animation]: string } typing — table is not in any of those enums). Build passes.","dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-8yff","title":"Data sinks — persist pulled data to queryable tables for dashboards","description":"Why this exists: Zapier read actions can pull data from any of 9000+ apps, but the result currently only lands in workflow_run.output as a JSON blob. That is fine as an audit log but useless as a dashboard source — you cannot 'SELECT pulled_at, count(*) GROUP BY week' against a JSONB column at scale.\n\nTo support the planned UI dashboards (revenue, leads-over-time, channel activity, anything that pulls from connected apps), workflows need a 'sink' concept — a typed destination where each row of pulled data lands as its own queryable record.\n\nScope:\n\n1. **New table: pulled_record** (or per-domain tables — TBD).\n   Schema sketch:\n     id uuid PK\n     workflow_id uuid FK\n     workflow_run_id uuid FK\n     source_app text (e.g. 'hubspot')\n     source_action text (e.g. 'list_deals')\n     external_id text (dedupe key, e.g. HubSpot deal ID)\n     payload jsonb (full row)\n     pulled_at timestamptz\n     UNIQUE(workflow_id, external_id) for upsert-on-rerun\n   RLS: per-user via existing patterns.\n\n2. **Workflow step extension**.\n   Add a step type 'persist' that takes a previous step's output + a dedupe key path and upserts into pulled_record. e.g., step 1 = run_action HubSpot.list_deals, step 2 = persist with dedupeKey='id'.\n   In schema: workflow_step.kind enum gains 'persist' alongside 'run_action' / future kinds.\n\n3. **Agent tools**.\n   - persist_to_sink — agent-facing helper that the agent inserts into a workflow's step list when the user wants ongoing data collection. Examples in prompt.\n   - query_sink — agent-facing read tool: SELECT against pulled_record by source_app/source_action/date range. Lets the agent answer 'how many deals did I close this month?' without re-pulling.\n\n4. **Dashboard primitives**.\n   Web UI: a /dashboards page or per-workflow analytics tab that queries pulled_record. Charts via whatever the web stack uses (Recharts is fine if not already chosen).\n\n5. **Migration to per-domain tables (optional, post-v1)**.\n   pulled_record(payload jsonb) is fine for v1 but will get slow at volume. v2 can typed-shred frequently-queried sources into their own tables (hubspot_deal, gcal_event, etc.) generated from action schemas. Defer.\n\nAcceptance:\n- User says 'every morning sync my HubSpot deals so I can chart them later' — agent calls save_workflow with run_action + persist steps + cron trigger\n- Next morning's run leaves N rows in pulled_record\n- Re-running the workflow upserts (no duplicates) by external_id\n- A simple /dashboards page renders 'deals pulled per day' from pulled_record without re-hitting Zapier\n\nDepends on: foreman-8k0g (save_workflow), foreman-8dyy (run_workflow), foreman-caqf (cron trigger). Without those, the persist step has no caller.","notes":"UI stack decision: stay on shadcn. Web package already has full shadcn setup (components.json style=radix-maia, 23 components, Tailwind v4, Lucide). Charts via 'npx shadcn add chart' — zero new runtime deps, wraps Recharts but reads our CSS variables for theming. Tables via existing react-data-grid plus shadcn data-table recipe. Tremor explicitly rejected — would clash with shadcn design language. Realtime via SWR + Supabase postgres_changes when added.","status":"open","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-05-09T22:05:00Z","created_by":"HamChowderr","updated_at":"2026-05-09T22:10:30Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-8yff","title":"Data sinks — persist pulled data to queryable tables for dashboards","description":"Why this exists: Zapier read actions can pull data from any of 9000+ apps, but the result currently only lands in workflow_run.output as a JSON blob. That is fine as an audit log but useless as a dashboard source — you cannot 'SELECT pulled_at, count(*) GROUP BY week' against a JSONB column at scale.\n\nTo support the planned UI dashboards (revenue, leads-over-time, channel activity, anything that pulls from connected apps), workflows need a 'sink' concept — a typed destination where each row of pulled data lands as its own queryable record.\n\nScope:\n\n1. **New table: pulled_record** (or per-domain tables — TBD).\n   Schema sketch:\n     id uuid PK\n     workflow_id uuid FK\n     workflow_run_id uuid FK\n     source_app text (e.g. 'hubspot')\n     source_action text (e.g. 'list_deals')\n     external_id text (dedupe key, e.g. HubSpot deal ID)\n     payload jsonb (full row)\n     pulled_at timestamptz\n     UNIQUE(workflow_id, external_id) for upsert-on-rerun\n   RLS: per-user via existing patterns.\n\n2. **Workflow step extension**.\n   Add a step type 'persist' that takes a previous step's output + a dedupe key path and upserts into pulled_record. e.g., step 1 = run_action HubSpot.list_deals, step 2 = persist with dedupeKey='id'.\n   In schema: workflow_step.kind enum gains 'persist' alongside 'run_action' / future kinds.\n\n3. **Agent tools**.\n   - persist_to_sink — agent-facing helper that the agent inserts into a workflow's step list when the user wants ongoing data collection. Examples in prompt.\n   - query_sink — agent-facing read tool: SELECT against pulled_record by source_app/source_action/date range. Lets the agent answer 'how many deals did I close this month?' without re-pulling.\n\n4. **Dashboard primitives**.\n   Web UI: a /dashboards page or per-workflow analytics tab that queries pulled_record. Charts via whatever the web stack uses (Recharts is fine if not already chosen).\n\n5. **Migration to per-domain tables (optional, post-v1)**.\n   pulled_record(payload jsonb) is fine for v1 but will get slow at volume. v2 can typed-shred frequently-queried sources into their own tables (hubspot_deal, gcal_event, etc.) generated from action schemas. Defer.\n\nAcceptance:\n- User says 'every morning sync my HubSpot deals so I can chart them later' — agent calls save_workflow with run_action + persist steps + cron trigger\n- Next morning's run leaves N rows in pulled_record\n- Re-running the workflow upserts (no duplicates) by external_id\n- A simple /dashboards page renders 'deals pulled per day' from pulled_record without re-hitting Zapier\n\nDepends on: foreman-8k0g (save_workflow), foreman-8dyy (run_workflow), foreman-caqf (cron trigger). Without those, the persist step has no caller.","notes":"UI stack decision: stay on shadcn. Web package already has full shadcn setup (components.json style=radix-maia, 23 components, Tailwind v4, Lucide). Charts via 'npx shadcn add chart' — zero new runtime deps, wraps Recharts but reads our CSS variables for theming. Tables via existing react-data-grid plus shadcn data-table recipe. Tremor explicitly rejected — would clash with shadcn design language. Realtime via SWR + Supabase postgres_changes when added.","status":"open","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-05-09T22:05:00Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:56Z","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-vld2","title":"Prompt v3 — point existing workflow offers at new tools, drop zapier.com fallback","description":"Once save/run/trigger tools exist, the prompt rewrite is small: replace the dangling 'Want me to save this as a workflow?' line with concrete tool examples, and add a hard rule that the agent NEVER tells a user to go to zapier.com — instead it offers save_workflow + attach_trigger.\n\nScope:\n1. agents/src/lib/prompt-template.ts:\n   - Replace the existing 'save as workflow' offers (lines 127, 243) with multishot examples showing save_workflow + attach_trigger calls.\n   - Add a new \u003cdo_not_redirect\u003e section: 'You never instruct the user to use zapier.com. If a request is multi-step or event-triggered, propose save_workflow + attach_trigger.'\n   - Strengthen Phase 4 read-execution: example of running a read without confirmation.\n   - Add anti-exploration-loop rule: 'If you have already called list-connections + list-apps once in this turn, stop discovering and propose run-action or save_workflow.'\n2. Re-run npm run datasets:experiment -- --full + npm run datasets:analyze.\n3. Compare per-category averages against the 0.094 trajectory / 0.264 judge baseline. Per-category targets:\n   - channel-triggered-workflow: 0.226 → 0.50+\n   - save-as-workflow: 0.150 → 0.55+\n   - scheduled-workflow: 0.208 → 0.45+\n   - data-question: 0.117 → 0.50+\n   - overall judge: 0.264 → 0.45+\n\nDepends on the workflow tool tasks landing first — without those, the agent still cannot deliver on the prompt's offers.","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-05-09T22:03:10Z","created_by":"HamChowderr","updated_at":"2026-05-10T20:15:22Z","started_at":"2026-05-10T20:12:02Z","closed_at":"2026-05-10T20:15:22Z","close_reason":"Prompt v3 shipped: \u003cdo_not_redirect\u003e, \u003cno_exploration_loops\u003e, sharper Phase 4 read example, Phase 5 chained save+trigger guidance, new scheduled-workflow + channel-triggered-workflow examples. 4 new unit tests cover the additions. Eval re-run (datasets:experiment --full) deferred since it costs credits — run when ready to compare against the 0.094/0.264 baseline.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-1oxu","title":"Web UI: /workflows page + /workflows/:id detail + run history","description":"So users can see, rename, run, and disable their saved automations from the dashboard. This is also the 'pulling data into UI/dashboards' surface you mentioned wanting.\n\nScope:\n1. packages/web/src/app/workflows/page.tsx — list view: name, description, last run, enabled toggle, run-now button.\n2. packages/web/src/app/workflows/[id]/page.tsx — detail view: step list (read-only or editable), trigger list, run history panel.\n3. packages/web/src/app/workflows/[id]/runs/[runId]/page.tsx — single run detail: per-step inputs, outputs, errors, duration. Mirrors the SSE stream from run_workflow.\n4. packages/web/src/lib/api-client.ts — typed client methods for /workflows/* routes.\n5. Server components fetch via fetch() with the user's Supabase JWT; client components use SWR for the toggles/run-now interactions.\n6. Add a 'Workflows' nav entry to the existing layout.\n\nOut of scope here: workflow editor (drag-drop step builder). Editing happens via agent chat for now — UI is read-mostly for v1.\n\nAcceptance:\n- New workflow saved via agent appears on /workflows within seconds\n- Clicking through to detail shows steps and any run history\n- Disable toggle persists and prevents future runs\n- Run-now button kicks off /workflows/:id/run and surfaces stream output\n- Mobile layout works (this is a primary UI for non-power users)","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-05-09T22:02:47Z","created_by":"HamChowderr","updated_at":"2026-05-10T20:26:55Z","started_at":"2026-05-10T20:16:55Z","closed_at":"2026-05-10T20:26:55Z","close_reason":"Web /workflows pages shipped: list, detail (steps/triggers/runs), and run detail. Agent server gained PATCH for workflow name + PATCH for trigger.enabled. Same-origin /api/workflows/* proxy keeps the Supabase JWT off the browser. Sidebar entry added. Per-step run trace is the only roadmap item left for a v2.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-caqf","title":"Workflow triggers — attach_trigger tool + cron driver + channel-binding","description":"Triggers are the 'when Y happens' half of 'make X happen when Y happens'. Without them, saved workflows are just on-demand scripts. With them, Foreman closes the loop — exactly what users go to zapier.com for today.\n\nThree trigger types to support, in order:\n\n1. **Channel webhook trigger** (cheapest — handlers already exist).\n   - Bind a saved workflow to a channel event (e.g., 'when I get a Slack DM in #ops, run workflow X')\n   - New table: workflow_trigger { id, workflow_id, type: 'channel'|'cron'|'poll', config jsonb, enabled bool }\n   - Channel handlers (slack/discord/telegram/webhook-handler.ts) look up matching triggers and dispatch to /workflows/:id/run\n   - Agent tool: attach_trigger({ workflowId, type: 'channel', config: { channel: 'slack', match: { ... } } })\n   - DB migration in supabase/migrations/\n\n2. **Cron trigger** (for 'every morning at 9 am send me my GCal').\n   - New service: agents/src/lib/triggers/cron-runner.ts — long-running node-cron-style worker that polls workflow_trigger WHERE type='cron' AND enabled=true and fires runs on schedule.\n   - On VPS: PM2 process. On Vercel: deferred (cron jobs there have a 60s wall-clock limit unsuitable for chained Zapier actions).\n   - Agent tool extension: attach_trigger({ workflowId, type: 'cron', config: { schedule: '0 9 * * *' } })\n\n3. **Polling trigger** (for 'when a new row appears in this Sheet').\n   - Until Zapier's Triggers API ships (May 2026), Foreman polls a Zapier 'read' action periodically and diffs against last-seen state to detect new items.\n   - Same cron-runner infrastructure, type='poll', config: { app, action, connection, inputs, dedupeKey }.\n   - This is the only sketchy part — relies on Zapier read actions being deterministic and orderable. Can defer until v2 of triggers.\n\nAcceptance:\n- 'When someone DMs me on Slack starting with !standup, run my standup workflow' works end-to-end\n- 'Every weekday at 8am email me my GCal' works end-to-end\n- workflow_trigger has soft-delete or enable/disable so users can pause without losing config\n- Polling trigger explicitly out-of-scope for v1 if it adds risk","notes":"Bookkeeping layer landed: workflow_trigger table (cron|channel|poll), POST/GET/DELETE /:id/triggers routes, attach_trigger + list_workflow_triggers + detach_trigger tools wired into Foreman, prompt updated, 9 unit tests + 3 live tests pass. Next: cron driver process + channel webhook integration.","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-05-09T22:02:33Z","created_by":"HamChowderr","updated_at":"2026-05-10T20:06:05Z","started_at":"2026-05-10T19:37:22Z","closed_at":"2026-05-10T20:06:05Z","close_reason":"Workflow triggers shipped: workflow_trigger table + 3 routes + 3 agent tools (attach/list/detach) + cron driver worker (timezone-aware 5-field cron, last-fired dedup) + channel-trigger matcher wired into all 8 chat bots (slack/discord/telegram/linear/github/gchat/teams/whatsapp). 27 new unit tests + 3 new live tests.","dependency_count":0,"dependent_count":0,"comment_count":0}
@@ -135,12 +271,12 @@
 {"_type":"issue","id":"foreman-ol1e","title":"Upgrade Foreman dependencies one-by-one","description":"Methodical dep upgrade pass on packages/agents — apply each bump independently, build + test after each, stop on first regression. Order: chat-adapter family, ai, hono, supabase-js, mastra side-deps (evals/observability/pg/memory/editor/deployers), then coordinated mastra core+CLI, then zod override bump. Skip majors (hono/node-server 2.x, types/node 25, typescript 6, zapier-sdk 0.48) — those need explicit decisions.","notes":"Completed upgrade pass: chat-adapter family 4.26→4.28.1 (9 pkgs + chat), ai 6.0.168→6.0.177, hono 4.12.14→4.12.18, supabase-js 2.104→2.105.4, @mastra/evals 1.2.1→1.2.2, @mastra/observability 1.10→1.11.1. Caught conflict at @mastra/pg 1.10 (peer requires core\u003e=1.32) — pivoted to coordinated mastra core+CLI bump: @mastra/core 1.26→1.32.1, mastra CLI 1.6→1.8.1, @mastra/memory 1.16→1.17.5, @mastra/pg 1.10.0, @mastra/editor 0.7.23, @mastra/deployer-* 1.1.32/1.1.26. Also bumped zod override 4.3.6→4.4.3 and Zapier SDK 0.41.2→0.48.0 + CLI 0.39.11→0.44.0 (after changelog read). Discovered hoisting issue: workspace root node_modules pinned old core via subpackage transitive deps; fixed with @mastra/core override to 1.32.1. mastra dev boots in 2.6-5.6s. All 224 tests pass (incl. 7 new regression tests in foreman-854t). Skipped majors: @hono/node-server 2.x, @types/node 25, typescript 6 — need explicit decisions.","status":"closed","priority":2,"issue_type":"chore","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-05-08T22:48:40Z","created_by":"HamChowderr","updated_at":"2026-05-09T00:14:12Z","started_at":"2026-05-08T22:48:50Z","closed_at":"2026-05-09T00:14:12Z","close_reason":"Upgrade pass complete; all bumps verified, regression tests added in foreman-854t.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-g8pl","title":"Upgrade @mastra/* stack and mastra CLI to fix Studio toJSONSchema error","description":"Even with Zapier SDK removed, mastra dev errors with [toJSONSchema]: Non-representable type encountered: optional from a Mastra Studio internal route schema. mastra@1.6.0 + @mastra/core@1.26.0 + zod 4.3.6 is the broken combo. mastra@1.8.1 bundles past the previous failure point but @mastra/core@1.26 lacks the agent/durable/index.js that 1.8.1 expects — needs a coordinated upgrade. Bump to mastra@1.8+ and @mastra/core@1.32+ together (matches blank-mastra-test which boots cleanly).","notes":"No longer needed — zod dedup (foreman-iibc) resolves the toJSONSchema issue without requiring a Mastra core upgrade. The 'Non-representable type' error was triggered by inconsistent zod state across 9 copies, not an actual @mastra/core 1.26 bug. With single zod 4.3.6 in node_modules, mastra@1.6.0 + @mastra/core@1.26 + zod 4.3.6 boots cleanly. Defer this upgrade until there's a concrete need (security, new feature).","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-05-08T07:59:58Z","created_by":"HamChowderr","updated_at":"2026-05-08T22:44:18Z","closed_at":"2026-05-08T22:44:18Z","close_reason":"Obsolete after zod dedup — see notes.","dependencies":[{"issue_id":"foreman-g8pl","depends_on_id":"foreman-i2se","type":"discovered-from","created_at":"2026-05-08T00:59:58Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-iibc","title":"Deduplicate zod across packages/agents workspace","description":"5 copies of zod exist in node_modules: 4.2.1 inside @zapier/zapier-sdk-*, 4.3.6 in packages/agents and various mastra deps, 3.25.76 at repo root. Multiple zod copies share state via Symbol(_zod) which can cause toJSONSchema hangs/loops when packages disagree on schema internals. Pin a single zod version via npm overrides in root package.json and verify mastra dev no longer hangs even without lazy-init fix.","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-05-08T07:59:54Z","created_by":"HamChowderr","updated_at":"2026-05-08T22:43:29Z","started_at":"2026-05-08T22:39:24Z","closed_at":"2026-05-08T22:43:29Z","close_reason":"Combined fix: lazy-init Zapier SDK (foreman-dt3u) + zod dedup via npm override to 4.3.6 (foreman-iibc) unblocks mastra dev. Verified: builds clean, all 221 unit tests pass, mastra dev boots in 3.3s with API at :4111/api and Studio at :4111. Single zod copy (4.3.6) consolidates from 9 versions across @zapier/* and other deps.","dependencies":[{"issue_id":"foreman-iibc","depends_on_id":"foreman-i2se","type":"discovered-from","created_at":"2026-05-08T00:59:54Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-i2se","title":"Bisect mastra dev hang in packages/agents init","description":"Hypothesis confirmed: bug is Foreman-specific (blank Mastra works). Bisect packages/agents/src/mastra/index.ts by stripping pieces (5 agents, workflow, observability, custom middleware, apiRoutes, validateAgentCapabilities) until mastra dev boots, then re-add to find the trigger. Reference: vault note reference_foreman_mastra_dev_hang.md","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-05-08T07:33:44Z","created_by":"HamChowderr","updated_at":"2026-05-08T07:59:46Z","started_at":"2026-05-08T07:33:54Z","closed_at":"2026-05-08T07:59:46Z","close_reason":"Bisect complete. Trigger: createZapierSdk() called before new Mastra() during mastra dev. Filed follow-ups for fix paths. Findings written to vault note reference_foreman_mastra_dev_hang.md.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-i2se","title":"Bisect mastra dev hang in packages/agents init","description":"Hypothesis confirmed: bug is Foreman-specific (blank Mastra works). Bisect packages/agents/src/mastra/index.ts by stripping pieces (5 agents, workflow, observability, custom middleware, apiRoutes, validateAgentCapabilities) until mastra dev boots, then re-add to find the trigger. Reference: vault note reference_foreman_mastra_dev_hang.md","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-05-08T07:33:44Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","started_at":"2026-05-08T07:33:54Z","closed_at":"2026-05-08T07:59:46Z","close_reason":"Bisect complete. Trigger: createZapierSdk() called before new Mastra() during mastra dev. Filed follow-ups for fix paths. Findings written to vault note reference_foreman_mastra_dev_hang.md.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-j391","title":"Parallel tool calls for bulk operations","description":"Added instruction to system prompt telling the agent to issue all run-action calls in a single response step for bulk operations (e.g., adding 5 contacts). Claude supports parallel tool calls natively — the agent just wasn't instructed to use them. Also updated confirmation to summarize all items at once instead of per-item.","status":"closed","priority":2,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-04-29T17:52:07Z","created_by":"HamChowderr","updated_at":"2026-04-29T17:52:16Z","closed_at":"2026-04-29T17:52:16Z","close_reason":"Implemented","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-1isf","title":"Seed app catalog for semantic app suggestions","description":"The app catalog vector search is fully wired into the contextInjector input processor but the app_catalog table has never been seeded. Running seedCatalog() will pull 9,000+ Zapier apps, store them in app_catalog, and embed them into catalog_vectors PgVector index. Until seeded, the app suggestion hints injected on every message return nothing. Need to run the seed script once against the production DB.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-29T17:51:52Z","created_by":"HamChowderr","updated_at":"2026-04-29T18:22:38Z","closed_at":"2026-04-29T18:22:38Z","close_reason":"Seeded 6,243 apps from Zapier SDK, all embedded into catalog_vectors PgVector index. Fixed Supabase 1000-row pagination cap in seed.ts.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-c2ke","title":"Update CLAUDE.md: remove Clerk refs, add Supabase auth/env docs","description":"CLAUDE.md Auth section still documents Clerk JWT + @mastra/auth-clerk. Env vars section lists Clerk keys. Both need updating to reflect Supabase Auth (SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY on agents; NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY on web).","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-26T07:32:11Z","created_by":"HamChowderr","updated_at":"2026-04-26T07:34:02Z","started_at":"2026-04-26T07:32:25Z","closed_at":"2026-04-26T07:34:02Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-mmsw","title":"Workflow template sharing across users","description":"Today the workflow table is hard user-scoped (schema.ts:89-101, userId NOT NULL, no template/public flag). Steps embed raw connection IDs tied to the owner's Zapier account (engine.ts:92, save.ts:109). To support sharing:\\n\\n1. Schema: add is_template flag (or separate workflow_template table) + share/clone mechanism\\n2. Depends on foreman-qv24 (named connections) so step JSON is portable across users\\n3. UI: template browse/clone flow; on clone, prompt importer to map each named connection to their own Zapier connection\\n4. API routes: /workflows/templates list, /workflows/:id/clone\\n5. Decide scope: org-shared only, or public marketplace-style","status":"closed","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-22T07:27:09Z","created_by":"HamChowderr","updated_at":"2026-04-22T17:44:12Z","closed_at":"2026-04-22T17:44:12Z","close_reason":"Phase 1 done: workflow template sharing implemented. Schema: added is_template and cloned_from columns (migration 0002). Routes: GET /workflows/templates (public list), PATCH /workflows/:id (toggle isTemplate), POST /workflows/:id/clone (copy to caller; strips numeric connectionIds, preserves alias strings). Verified server boots and routes respond (401 = auth working). Root cause of earlier Mastra boot hang was @mastra/core@1.26.0 observability schema bug — pinned core to 1.25.0 + mastra CLI to 1.6.0 as part of this fix. Phase 2 (UI for browse/clone/publish) separate work.","dependencies":[{"issue_id":"foreman-mmsw","depends_on_id":"foreman-qv24","type":"blocks","created_at":"2026-04-22T00:27:15Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-qv24","title":"Named connections in workflow step definitions","description":"Workflow steps currently embed raw numeric connection IDs (e.g. 12345) in proposalTemplate JSON, tying workflows to a specific user's Zapier account. Named connections let step JSON reference aliases like 'slack_work', with per-user/per-env mapping supplied via createZapierSdk({ manifest: { connections: {...} } }). Only worth it if we plan to share workflow definitions across users/environments or want human-readable JSON.","status":"closed","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-22T07:14:46Z","created_by":"HamChowderr","updated_at":"2026-04-22T07:35:15Z","closed_at":"2026-04-22T07:35:15Z","close_reason":"Phase 1 done: added connection_alias table (migration 0001), resolveConnection() helper in lib/zapier/aliases.ts, wired into runAction + rawFetch in execution.ts. Numeric IDs pass through unchanged (backward compatible); alias strings are looked up per-user. Phase 2 (auto-create aliases on connect, API routes, UI for mapping) is separate work — file a new bead if/when needed, this ticket unblocks the workflow sharing dependency.","dependencies":[{"issue_id":"foreman-qv24","depends_on_id":"foreman-blmn","type":"blocks","created_at":"2026-04-22T00:14:55Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"foreman-qv24","title":"Named connections in workflow step definitions","description":"Workflow steps currently embed raw numeric connection IDs (e.g. 12345) in proposalTemplate JSON, tying workflows to a specific user's Zapier account. Named connections let step JSON reference aliases like 'slack_work', with per-user/per-env mapping supplied via createZapierSdk({ manifest: { connections: {...} } }). Only worth it if we plan to share workflow definitions across users/environments or want human-readable JSON.","status":"closed","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-22T07:14:46Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-04-22T07:35:15Z","close_reason":"Phase 1 done: added connection_alias table (migration 0001), resolveConnection() helper in lib/zapier/aliases.ts, wired into runAction + rawFetch in execution.ts. Numeric IDs pass through unchanged (backward compatible); alias strings are looked up per-user. Phase 2 (auto-create aliases on connect, API routes, UI for mapping) is separate work — file a new bead if/when needed, this ticket unblocks the workflow sharing dependency.","dependencies":[{"issue_id":"foreman-qv24","depends_on_id":"foreman-blmn","type":"blocks","created_at":"2026-04-22T00:14:55Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
 {"_type":"issue","id":"foreman-4j9","title":"Refactor getSharedSdk to use native SDK client_credentials","description":"sdk.ts:16-58 manually POSTs to zapier.com/oauth/token with grant_type=client_credentials and caches expiry. The SDK natively supports this via createZapierSdk({ credentials: { clientId, clientSecret } }) and handles refresh internally. Removing the manual flow deletes ~40 lines with no behavior change.","status":"closed","priority":2,"issue_type":"chore","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-22T07:13:30Z","created_by":"HamChowderr","updated_at":"2026-04-22T07:18:00Z","closed_at":"2026-04-22T07:18:00Z","close_reason":"Replaced manual client_credentials POST + cache (sdk.ts:13-58) with native createZapierSdk({ credentials: { clientId, clientSecret } }). SDK handles token exchange and refresh internally. ~40 lines removed, dev server hot-reloaded cleanly.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-mh4","title":"Port maxSteps to stopWhen(stepCountIs(N)) — AI SDK v6 migration","description":"AI SDK v6 removed maxSteps. Linter flags it on packages/agents/src/mastra/index.ts line ~189 (the /chat/:agentId handler calling agent.stream with { maxSteps: 15 }). Migration: import { stepCountIs } from 'ai'; change maxSteps: 15 to stopWhen: stepCountIs(15). Also appears in channel bots (discord/slack/telegram/teams/gchat/imessage/github/linear/whatsapp) — verify all sites. Blocks clean builds on newer ai-sdk releases.","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-21T15:43:28Z","created_by":"HamChowderr","updated_at":"2026-04-25T20:50:08Z","started_at":"2026-04-25T20:42:57Z","closed_at":"2026-04-25T20:50:08Z","close_reason":"Replaced maxSteps with stopWhen(stepCountIs(N)) across all 10 call sites (9 bots + mastra/index.ts). tsc clean, 18 SDK tests pass.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-d2o","title":"Duplicate ChatShell render in web chat layout","description":"/chat route renders the AppSidebar + ChatShell twice — both ref_22 and ref_46 \u003cmain\u003e regions in the a11y tree show the same empty state ('What can I help with?'), same sample prompt buttons, same input textbox. Root cause is likely the layout.tsx rendering ChatShell inside SidebarInset while the page.tsx (which returns null) still mounts something via its route tree. Needs investigation into whether shadcn sidebar is rendering both desktop + mobile Sheet (expected, hidden via CSS) or a genuine duplicate. Either remove the duplicate, or add 'hidden md:flex' / 'md:hidden' gating so only one renders at each breakpoint.","status":"closed","priority":2,"issue_type":"bug","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-21T07:40:13Z","created_by":"HamChowderr","updated_at":"2026-04-25T22:29:01Z","started_at":"2026-04-25T20:43:02Z","closed_at":"2026-04-25T22:29:01Z","close_reason":"False positive / stale. Static analysis confirms only one SidebarInset (\u003cmain\u003e) in the chat route, one ChatShell render, and both page.tsx files return null. No duplicate found. Issue was filed the day after the AI Elements restructure commit — likely saw a transient state during initial development or a11y tool mis-identification.","dependency_count":0,"dependent_count":0,"comment_count":0}
@@ -154,7 +290,7 @@
 {"_type":"issue","id":"foreman-ogo","title":"Replace custom SSE streaming layer with Mastra built-in streaming","description":"After research: Mastra MastraModelOutput does NOT have toUIMessageStreamResponse() or similar helpers — only fullStream and textStream getters. The custom SSE encoding (encodeSSE, sseHeaders) is therefore necessary for HTTP streaming. However the transformer can be improved: 1) Import and reference Mastra's actual ChunkType instead of assuming shapes 2) Remove the duplicated AppChunk type from packages/web (use a shared types package or generate from the server) 3) The transformer correctly handles chunk.payload.text, chunk.type etc — these match Mastra's real chunk format. Priority lowered since this is more of a cleanup than a bug.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T23:57:17Z","created_by":"HamChowderr","updated_at":"2026-04-19T00:11:34Z","closed_at":"2026-04-19T00:11:34Z","close_reason":"After research: Mastra MastraModelOutput does NOT have HTTP response helpers — only fullStream and textStream getters. The custom SSE encoding layer (encodeSSE, sseHeaders, createChunkTransformer) is necessary and correct. Chunk shapes (chunk.type, chunk.payload, chunk.runId) match Mastra's actual ChunkType. The duplicated AppChunk type between packages is a minor cleanup, not a functional issue. No changes needed — the custom streaming layer is the right approach for Mastra.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-370","title":"Voice input/output — OpenAI + Google","description":"Voice I/O: STT via OpenAI Whisper, TTS via ElevenLabs (OpenAI fallback). Channels: Web UI (mic button), Telegram (voice messages), Discord (voice messages), WhatsApp (ready, test later). Skip Slack and Google Chat. Optional per-user via capability flag. Env: ELEVENLABS_API_KEY, ELEVENLABS_VOICE_ID.","status":"closed","priority":2,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-18T17:51:37Z","created_by":"HamChowderr","updated_at":"2026-04-18T17:59:45Z","closed_at":"2026-04-18T17:59:45Z","close_reason":"Done: Whisper STT + ElevenLabs TTS (OpenAI fallback), voice routes, capability flag, web UI mic button + speaker playback on agent messages.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-a6c","title":"iMessage channel setup","description":"Configure iMessage adapter, test locally. Requires macOS with Messages app access.","status":"deferred","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T16:21:12Z","created_by":"HamChowderr","updated_at":"2026-06-11T08:32:58Z","defer_until":"2026-12-11T08:00:00Z","dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-dtn","title":"WhatsApp channel setup","description":"Set up Meta Business account, WhatsApp Business API, configure webhook, test locally via ngrok","status":"open","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T16:20:00Z","created_by":"HamChowderr","updated_at":"2026-04-18T16:20:00Z","defer_until":"2026-12-11T08:00:00Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-dtn","title":"WhatsApp channel setup","description":"Set up Meta Business account, WhatsApp Business API, configure webhook, test locally via ngrok","status":"closed","priority":2,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-18T16:20:00Z","created_by":"HamChowderr","updated_at":"2026-07-05T04:52:45Z","closed_at":"2026-07-05T04:52:45Z","close_reason":"DONE: WhatsApp channel fully built — whatsapp/bot.ts, webhook, env, identity, docs; 81a3dd5.","defer_until":"2026-12-11T08:00:00Z","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-6qm","title":"Complete Teams setup — need M365 license or developer program","description":"Teams bot is registered in Azure (foreman-bot, foreman-rg), endpoint set, Teams channel enabled. Blocked on M365 license — admin@otakusolutions.io has Azure sub but no M365. Options: join M365 dev program (free 90-day sandbox) or add M365 Business Basic. Manifest zip ready at packages/agents/foreman-teams-app.zip.","status":"deferred","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T15:09:28Z","created_by":"HamChowderr","updated_at":"2026-06-11T08:33:08Z","defer_until":"2026-12-11T08:00:00Z","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-x1b","title":"Zapier connect flow for non-web channels","description":"For Telegram/MCP users who need to connect Zapier: generate a one-time connect URL that links to the OAuth flow. Bot sends the URL, user clicks, completes OAuth in browser, tokens stored against their Foreman user ID. Works for any channel.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-18T05:12:49Z","created_by":"HamChowderr","updated_at":"2026-04-18T05:31:45Z","closed_at":"2026-04-18T05:31:45Z","close_reason":"Connect flow: one-time token URL, Zapier OAuth round-trip, encrypted token storage. connect_zapier tool for agents. Telegram/MCP users click link to connect.","dependencies":[{"issue_id":"foreman-x1b","depends_on_id":"foreman-53m","type":"blocks","created_at":"2026-04-17T22:13:07Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-eii","title":"Add HTTP trigger workflows (Zapier webhooks)","description":"Accept incoming Zapier webhooks and process events via Mastra workflow steps. Complement existing cron workflows.","status":"closed","priority":2,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-04-18T04:23:56Z","created_by":"HamChowderr","updated_at":"2026-04-18T05:31:46Z","closed_at":"2026-04-18T05:31:46Z","close_reason":"POST /webhooks/zapier route, webhook-handler workflow (validate → process by event type), optional secret, fire-and-forget pattern.","dependency_count":0,"dependent_count":0,"comment_count":0}
@@ -215,15 +351,41 @@
 {"_type":"issue","id":"foreman-c9y","title":"Set up LibSQL + Drizzle ORM","description":"Single LibSQL database for app + Mastra data. Migrations runnable via script. AC: npm run db:migrate creates BetterAuth tables. Connection string in .env.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-17T18:25:48Z","created_by":"HamChowderr","updated_at":"2026-04-17T18:28:37Z","closed_at":"2026-04-17T18:28:37Z","close_reason":"Completed in Phase 1 and Phase 2 (T1-T31 done)","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-s46","title":"Install and configure BetterAuth","description":"Email/password auth. Session stored in LibSQL. AC: /sign-up and /sign-in pages work. Authenticated session persists across reloads.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-17T18:25:46Z","created_by":"HamChowderr","updated_at":"2026-04-17T18:28:37Z","closed_at":"2026-04-17T18:28:37Z","close_reason":"Completed in Phase 1 and Phase 2 (T1-T31 done)","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-5ld","title":"Initialize Next.js 15 project","description":"Scaffold Next.js 15 with App Router, TypeScript, Tailwind. AC: npm run dev serves a blank page at /. Project committed to git under C:\\Users\\HamCh\\code\\foreman.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-17T18:25:38Z","created_by":"HamChowderr","updated_at":"2026-04-17T18:28:37Z","closed_at":"2026-04-17T18:28:37Z","close_reason":"Completed in Phase 1 and Phase 2 (T1-T31 done)","dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-hflh","title":"Add .gitattributes to normalize line endings (kill CRLF phantom diffs)","description":"Repo has no .gitattributes; on Windows (autocrlf=true) the working tree is CRLF while git stores LF, producing ~170 phantom modified files each session and blocking clean fast-forwards. Add .gitattributes '* text=auto eol=lf' (+ binary markers).","status":"open","priority":3,"issue_type":"chore","owner":"admin@otakusolutions.io","created_at":"2026-06-12T19:11:26Z","created_by":"HamChowderr","updated_at":"2026-06-12T19:11:26Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-t09r","title":"Right-click actions on chat-history + document rows (context-menu)","description":"Use the restored context-menu for right-click rename/delete/share on sidebar chat-history items and document rows (currently action buttons / none).","acceptance_criteria":"Right-clicking a chat or document row opens a context menu with rename/delete/share.","status":"open","priority":3,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-28T05:19:55Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:56Z","dependencies":[{"issue_id":"foreman-t09r","depends_on_id":"foreman-25f4","type":"discovered-from","created_at":"2026-06-27T22:19:55Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-8zqj","title":"Pagination for automation runs / action history tables (pagination)","description":"Use the restored pagination component on the automation runs list and action history once they grow beyond a page.","acceptance_criteria":"Runs/history lists paginate with the pagination component.","status":"open","priority":3,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-28T05:19:48Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:56Z","dependencies":[{"issue_id":"foreman-8zqj","depends_on_id":"foreman-25f4","type":"discovered-from","created_at":"2026-06-27T22:19:47Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-97mv","title":"Progress bars for preview build feed + file import (progress)","description":"Use the restored progress component for the live preview build feed (preview-app data-preview-progress stages) and the Documents file-import flow, instead of text/skeleton-only.","acceptance_criteria":"Preview build + file import show a real progress bar.","status":"open","priority":3,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-28T05:19:42Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:56Z","dependencies":[{"issue_id":"foreman-97mv","depends_on_id":"foreman-25f4","type":"discovered-from","created_at":"2026-06-27T22:19:42Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-pdfm","title":"Standardize keyboard-shortcut hints with the kbd component","description":"The command palette Search button uses a hand-rolled \u003ckbd\u003e for the GBP K hint. Replace with the restored ui/kbd component, and use it for any other shortcut hints.","acceptance_criteria":"Command-palette shortcut hint (and any others) use ui/kbd instead of raw \u003ckbd\u003e.","status":"open","priority":3,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-28T05:19:35Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:56Z","dependencies":[{"issue_id":"foreman-pdfm","depends_on_id":"foreman-25f4","type":"discovered-from","created_at":"2026-06-27T22:19:35Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-3f1v","title":"User avatars in members table, user menu, and chat (avatar)","description":"Use the restored avatar component: workspace Members table (currently shows name??id.slice(0,8)), the sidebar user menu (sidebar-user-nav), and optionally chat message authorship. Falls back to initials.","acceptance_criteria":"Members table + user menu render an avatar (image or initials).","status":"open","priority":3,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-28T05:19:29Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:56Z","dependencies":[{"issue_id":"foreman-3f1v","depends_on_id":"foreman-25f4","type":"discovered-from","created_at":"2026-06-27T22:19:29Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-d2na","title":"Use Skeleton loaders for content loading states (consistency)","description":"App mixed 'Loading…' text with the Skeleton component. Replace text loaders with Skeleton in the main content areas. DONE: DocumentsBrowser (list + viewer), workspaces-manager, knowledge-panel content. REMAINING (minor/transient inline loaders, follow-up): share-button popover, knowledge-panel share popover, sidebar-history inline, editor Suspense fallback, editor-sidebar-agents, workspace-switcher span.","acceptance_criteria":"Main content loaders use Skeleton; remaining minor inline loaders tracked.","status":"closed","priority":3,"issue_type":"chore","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-28T00:17:29Z","created_by":"HamChowderr","updated_at":"2026-07-05T03:26:37Z","closed_at":"2026-07-05T03:26:37Z","close_reason":"Shipped: 0a3d7fe feat(web) Skeleton loaders; document-skeleton.tsx + skeletons in use.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-ufo3","title":"Automation digests and scheduling","description":"Add (a) a daily digest automation that scans recent results, decides what mattered, and feeds a curated summary into the inbox, and (b) user-facing scheduled/cron triggers. Audit: automations are event/poll-driven only and the prompt states scheduled automation is not available yet; there is no digest/summary synthesis.","design":"Cron-driver scheduling + a synthesis step over recent runs; reuse trigger-inbox + worker.","acceptance_criteria":"A scheduled daily digest runs and populates the inbox with a prioritized summary.","status":"open","priority":3,"issue_type":"epic","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-27T02:02:43Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:57Z","dependencies":[{"issue_id":"foreman-ufo3","depends_on_id":"foreman-2vpb","type":"discovered-from","created_at":"2026-06-26T19:02:43Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-5498","title":"[web] make-interfaces-feel-better polish sweep across app surfaces","description":"Apply the installed make-interfaces-feel-better skill checklist (concentric radii, optical alignment, shadows\u003eborders, staggered enter anims, tabular-nums, scale-on-press, 40x40 hit areas, no transition:all) surface by surface — /automations first, then chat, dashboards, settings, landing. Output the skill's Before/After review table per surface.","status":"open","priority":3,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T08:26:05Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:57Z","dependencies":[{"issue_id":"foreman-5498","depends_on_id":"foreman-jy1w","type":"discovered-from","created_at":"2026-06-26T01:26:05Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-b8k2","title":"[durable] Event-level dedup: honor possible_duplicate_data (not just message.id)","description":"Current dedup is the automation_run UNIQUE(automation_id, inbox_message_id) — bulletproof for redelivery of the SAME message id. But Zapier also flags possible_duplicate_data when the underlying EVENT may be a duplicate even with a new message id. We don't use that flag. Consider skipping/flagging messages with possible_duplicate_data=true (the trigger-inbox lib already exposes it) for stronger idempotency on flaky triggers.","status":"open","priority":3,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-26T05:51:01Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:57Z","dependencies":[{"issue_id":"foreman-b8k2","depends_on_id":"foreman-l7xq","type":"discovered-from","created_at":"2026-06-25T22:51:00Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-mcwn","title":"Adopt createConnection() for in-flow app-connection UX (needs SDK \u003e=0.71)","description":"createConnection()/getConnectionStartUrl()/waitForNewConnection() (SDK 0.71.0) give a first-class, browser-driven per-app OAuth flow returning {id, app, title}. Foreman currently has no in-flow way for the agent to create an app connection — users connect apps in Zapier's UI. Adopting createConnection would let Foreman drive 'connect your \u003capp\u003e' inline (browser:'auto') under the user's authed SDK. Prereq: bump @zapier/zapier-sdk to \u003e=0.71 (repo on 0.70.4; latest 0.76.0 — see foreman-8ujc). Keep connect.ts for account-level user-JWT auth (createConnection does NOT replace it — foreman-b8b1).","acceptance_criteria":"Agent can initiate an app connection in-conversation; new connection appears in listConnections; connect.ts account-auth flow unchanged.","notes":"Verified live on SDK 0.79.0 (client-creds via Infisical): getConnectionStartUrl({app}) works, returns { data: { url, expiresAt, startedAt, app } } — a 5-min signed zapier.com/sdk/connect URL. Non-blocking, so adoptable as a custom tool (mint URL -\u003e hand to user) without the 5-min block that getscreateConnection/waitForNewConnection excluded. This unblocks the SDK-native path for in-flow connection UX.","status":"open","priority":3,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-22T22:52:18Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:57Z","dependencies":[{"issue_id":"foreman-mcwn","depends_on_id":"foreman-b8b1","type":"discovered-from","created_at":"2026-06-22T15:52:18Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-1zvk","title":"Onboarding demo: batch row inserts into one create-table-records call","description":"Demo prompts list 3 rows but never instruct the model to batch them, so haiku fires a separate create-table-records call per row. All succeed (post tool-gap fix) but it's slower and shows redundant work. Add a single-call hint to the demo prompt centrally in getDemo().","notes":"VERIFY: biome check clean on step-try.tsx; hint appended centrally in getDemo() so all 9 use-case prompts inherit it. Live behavior (single batched call vs per-row) not re-run — low risk, cosmetic, and the per-row path already succeeds post tool-gap fix.","status":"closed","priority":3,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-20T22:08:58Z","created_by":"HamChowderr","updated_at":"2026-06-21T03:45:51Z","closed_at":"2026-06-21T03:45:51Z","close_reason":"Demo batching tweak shipped (bbe69fe) + verified.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-faml","title":"a11y: add aria-pressed/aria-selected to bespoke selector buttons","description":"Selector \u003cbutton\u003es drive a visible 'selected' state with no aria-pressed/aria-selected, so SR users can't perceive the active item: landing/demos/five-things.tsx (scene selector), landing/demos/guardrail-cards.tsx (desktop cards; mobile accordion DOES set aria-expanded -\u003e inconsistent), plus onboarding selection grids. Semantic buttons already, just add the aria state.","status":"closed","priority":3,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-20T05:13:01Z","created_by":"HamChowderr","updated_at":"2026-06-20T05:35:57Z","closed_at":"2026-06-20T05:35:57Z","close_reason":"Done via 9 parallel area-agents; verified biome+tsc+next build all green (commit d34f451). NOTE: ltnn slash-commands took the conservative roles-only cmdk adoption (correct ARIA roles + selection) to preserve the composer's keyboard-nav contract; SuggestionDialog fully on ui/dialog. Also fixed a pre-existing build-breaker in model-selector-compact (467d43c).","dependencies":[{"issue_id":"foreman-faml","depends_on_id":"foreman-to5b","type":"discovered-from","created_at":"2026-06-19T22:13:01Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-wltd","title":"Auth forms: adopt ui/Field + extract shared FieldError (dedupe 3x)","description":"The four auth forms correctly use ui/button/input/label but bypass ui/field.tsx (Field/FieldGroup/FieldError), the shadcn-intended form grouping. The inline destructive error \u003cp\u003e block is copy-pasted verbatim in login-form, sign-up-form, forgot-password-form. Adopt ui/field + one shared FieldError.","status":"closed","priority":3,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-20T05:12:53Z","created_by":"HamChowderr","updated_at":"2026-06-20T05:35:57Z","closed_at":"2026-06-20T05:35:57Z","close_reason":"Done via 9 parallel area-agents; verified biome+tsc+next build all green (commit d34f451). NOTE: ltnn slash-commands took the conservative roles-only cmdk adoption (correct ARIA roles + selection) to preserve the composer's keyboard-nav contract; SuggestionDialog fully on ui/dialog. Also fixed a pre-existing build-breaker in model-selector-compact (467d43c).","dependencies":[{"issue_id":"foreman-wltd","depends_on_id":"foreman-to5b","type":"discovered-from","created_at":"2026-06-19T22:12:53Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-rqsy","title":"Dashboards pages: replace legacy 'F' brand header with shared Zapier brand header","description":"app/dashboards/page.tsx (L39-56) and app/dashboards/[id]/page.tsx (L24-45) hardcode the legacy orange 'F' box header, duplicated verbatim AND out of step with the Zapier mark adopted elsewhere in the shell (2bc96cc/44a9fb8). Extract one shared brand header component using /zapier.svg.","status":"closed","priority":3,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-20T05:12:33Z","created_by":"HamChowderr","updated_at":"2026-06-20T05:35:57Z","closed_at":"2026-06-20T05:35:57Z","close_reason":"Done via 9 parallel area-agents; verified biome+tsc+next build all green (commit d34f451). NOTE: ltnn slash-commands took the conservative roles-only cmdk adoption (correct ARIA roles + selection) to preserve the composer's keyboard-nav contract; SuggestionDialog fully on ui/dialog. Also fixed a pre-existing build-breaker in model-selector-compact (467d43c).","dependencies":[{"issue_id":"foreman-rqsy","depends_on_id":"foreman-to5b","type":"discovered-from","created_at":"2026-06-19T22:12:33Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-jrab","title":"Adopt ui/Empty for empty states + ui/Skeleton for loading shimmers","description":"ui/empty.tsx used nowhere despite hand-rolled empty states in settings/mcp-page, app/dashboards/page, editor/agent-list-view, app/workflows/page. Loading shimmers hand-rolled (animate-pulse) in chat/sidebar-history, document-preview, document-skeleton -\u003e ui/skeleton.tsx. Consolidate.","status":"closed","priority":3,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-20T05:12:28Z","created_by":"HamChowderr","updated_at":"2026-06-20T05:35:57Z","closed_at":"2026-06-20T05:35:57Z","close_reason":"Done via 9 parallel area-agents; verified biome+tsc+next build all green (commit d34f451). NOTE: ltnn slash-commands took the conservative roles-only cmdk adoption (correct ARIA roles + selection) to preserve the composer's keyboard-nav contract; SuggestionDialog fully on ui/dialog. Also fixed a pre-existing build-breaker in model-selector-compact (467d43c).","dependencies":[{"issue_id":"foreman-jrab","depends_on_id":"foreman-to5b","type":"discovered-from","created_at":"2026-06-19T22:12:27Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-dwga","title":"Shared CopyButton component (dedupe 3 implementations)","description":"Same copy+'Copied!'-2s-reset behavior built independently in settings/mcp-page.tsx (L20-36), settings/channel-connect-page.tsx (L38-55), plus inline copy logic elsewhere. Extract one shared CopyButton on ui/button.tsx.","status":"closed","priority":3,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-20T05:12:23Z","created_by":"HamChowderr","updated_at":"2026-06-20T05:35:56Z","closed_at":"2026-06-20T05:35:56Z","close_reason":"Done via 9 parallel area-agents; verified biome+tsc+next build all green (commit d34f451). NOTE: ltnn slash-commands took the conservative roles-only cmdk adoption (correct ARIA roles + selection) to preserve the composer's keyboard-nav contract; SuggestionDialog fully on ui/dialog. Also fixed a pre-existing build-breaker in model-selector-compact (467d43c).","dependencies":[{"issue_id":"foreman-dwga","depends_on_id":"foreman-to5b","type":"discovered-from","created_at":"2026-06-19T22:12:22Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-pcmm","title":"Zapier sidebar mark: refine the collapsed (sidebar-closed) state","description":"The Zapier brand mark in the sidebar (shipped in 2bc96cc/44a9fb8) reads well when the sidebar is open, but looks slightly off when the sidebar is collapsed/closed. Polish the collapsed-state rendering (sizing/alignment/spacing of the asterisk mark).","status":"closed","priority":3,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-20T04:42:24Z","created_by":"HamChowderr","updated_at":"2026-06-20T05:45:06Z","closed_at":"2026-06-20T05:45:06Z","close_reason":"Collapsed mark now renders 16x16 square (group-data-[collapsible=icon]:size-4); root cause was the icon-button p-2! padding capping img width. Verified live in browser.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-cbzv","title":"Floating-card chat surface: increase contrast so it reads as a card","description":"The subtle floating-card chat surface (commit 11ef88c) is defined only by gap+1px border; in the light (ocean-breeze) theme the card bg is nearly identical to the canvas, so it barely 'pops'. Make it read clearly as a floating surface — preferred: make the canvas behind the card a touch darker than the card (keeps it shadow-free); alternative: a hair of soft shadow (shadow-sm). shell.tsx (column bg vs card bg) / theme tokens.","status":"closed","priority":3,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-19T23:02:27Z","created_by":"HamChowderr","updated_at":"2026-06-20T05:03:15Z","started_at":"2026-06-20T04:44:07Z","closed_at":"2026-06-20T05:03:15Z","close_reason":"Implemented + visually verified in browser (default/sunset-glow theme). hkfg: chat title on left + visibility control pushed right (title plumbed via /api/messages -\u003e use-active-chat -\u003e ChatHeader). sinf: removed New-chat resting border (false-active), unified nav heights h-8, bumped header-\u003enav spacing pt-2. cbzv: shadow-sm on card (canvas oklab L 0.940 vs card 0.982, plus shadow = clear float). 9m7h: Settings moved from sidebar nav into bottom-left user dropdown -\u003e /settings/integrations (route verified loading).","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-33ht","title":"Dashboards: time-series/trend block from snapshot history","description":"Add line/area chart block reading ?history=true series (count/sum per refreshed_at) — trends over time, the differentiator the snapshot table can't show. app_data_snapshot already stores append-only history.","status":"open","priority":3,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-19T18:43:27Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:57Z","dependencies":[{"issue_id":"foreman-33ht","depends_on_id":"foreman-xl8m","type":"discovered-from","created_at":"2026-06-19T11:43:26Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-34nm","title":"Dashboards: snapshot retention/prune policy (append-only growth)","description":"app_data_snapshot is append-only; add a prune policy (keep last N per user/app or last 90d) so it doesn't grow unbounded. Small follow-up after Phase 1.","status":"closed","priority":3,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-19T17:01:09Z","created_by":"HamChowderr","updated_at":"2026-06-21T03:38:56Z","started_at":"2026-06-20T23:42:54Z","closed_at":"2026-06-21T03:38:56Z","close_reason":"Retention prune shipped (127dd6c) + verified.","dependencies":[{"issue_id":"foreman-34nm","depends_on_id":"foreman-c0p5","type":"discovered-from","created_at":"2026-06-19T10:01:09Z","created_by":"HamChowderr","metadata":"{}"},{"issue_id":"foreman-34nm","depends_on_id":"foreman-gnr0","type":"blocks","created_at":"2026-06-19T10:01:21Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-sse0","title":"Workflow run-history row can overflow on mobile with long error_message","description":"In app/workflows/[id]/page.tsx run-history list, the left content div is min-w-0 but the failed-run error_message is an inline span with 'truncate' (truncate needs block/inline-block + overflow to engage, so it won't clip inline). With a long error_message on a ~360px screen the row can push the StatusBadge (no shrink-0). Minor; needs a failed run with a long error to manifest. Fix: wrap error in a block/inline-block truncate container or add overflow-hidden to the left div + shrink-0 on the badge.","status":"closed","priority":3,"issue_type":"bug","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-19T08:31:38Z","created_by":"HamChowderr","updated_at":"2026-06-20T22:41:11Z","started_at":"2026-06-20T22:39:25Z","closed_at":"2026-06-20T22:41:11Z","close_reason":"Run-history row now flex with error min-w-0 flex-1 truncate (ellipsizes instead of overflowing); detail block got break-words. Verified via live-DOM overflow measure (old +565px, new 0px at 360px). 321d6c3","dependencies":[{"issue_id":"foreman-sse0","depends_on_id":"foreman-py1n","type":"discovered-from","created_at":"2026-06-19T01:31:37Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-321i","title":"Prototype: replace action_proposal approval flow with Harness tool-approval","description":"First, lowest-risk slice of the Harness eval. Wire one approval-required tool (e.g. run-action or a workflow write tool) through the Harness's built-in tool-approval / human-in-the-loop instead of Foreman's action_proposal table + /proposals routes + approval cards. Compare DX, the approve/decline round-trip, and how it surfaces to the web client vs the current SSE proposal flow. Sources (mastra.ai): /workshops/agent-harness-what-it-is-why-it-matters-and-what-it-enables-2026-03-19, /blog/anatomy-of-a-coding-agent, /blog/introducing-sdk-subagents.","status":"open","priority":3,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-18T20:25:00Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:57Z","dependencies":[{"issue_id":"foreman-321i","depends_on_id":"foreman-mh2q","type":"discovered-from","created_at":"2026-06-18T13:24:59Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-mh2q","title":"Evaluate \u0026 prototype Mastra Agent Harness (@mastra/core/harness) for Foreman","description":"Mastra shipped a generic Harness (the control layer around an Agent: modes, shared state, threading, tool approval / human-in-the-loop, subagents, built-in task tracking, memory, model discovery, events). It is ALREADY available in our installed @mastra/core 1.42.0-alpha.3 via the '@mastra/core/harness' subpath (exports: Harness, askUserTool, submitPlanTool, taskWrite/Update/Complete/CheckTool, assignTaskIds, parseSubagentMeta, HarnessStorage/InMemoryHarness). Foreman has hand-built almost exactly this plumbing — the custom /chat/:agentId route, the action_proposal/approval system + /proposals routes + approval cards, supervisor-\u003ediscovery/execution/history subagent routing, field-choice clarification, workflow/task tracking. The Harness could replace much of it and reduce custom failure points (cf. this session's getStudio/route-dispatch debugging). Goal: evaluate on a throwaway branch, feel the API + alpha churn, decide whether to migrate.","design":"Prototype on a branch (feat/harness-eval), one slice at a time; do NOT migrate wholesale. Start with the tool-approval slice (lowest risk, highest plumbing-replacement value). Read the actual API in node_modules/@mastra/core/dist (subpath @mastra/core/harness) + Mastra changelogs since the docs are preview-level. Caveat: Harness is alpha / 'actively shaping' — expect method renames + positional-\u003eobject param churn.","acceptance_criteria":"A branch with a working Harness-driven prototype of at least one Foreman flow (chat loop or tool-approval), a written assessment of API churn risk, and a go/no-go recommendation on migrating.","status":"open","priority":3,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-18T20:24:56Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-t6wc","title":"Persist chat uploads to Supabase Storage (follow-up to image upload)","description":"Optional enhancement after AI-Elements data-URL image upload works: add /api/files route (model on agents/routes/voice.ts) + chat-files bucket for history/audit/cross-channel persistence.","status":"open","priority":3,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-18T16:21:23Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:57Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-mhxy","title":"Chat polish: screenshot capture + drag-drop + file-type icons","description":"Port from storycraft/myrp-build ai-elements: screenshot-button.tsx (captureScreenshot), drag-drop on input, file-type icons in preview-attachment, revoke blob URLs on remove.","status":"open","priority":3,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-18T16:21:20Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:57Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-3due","title":"F2: handleSdkError covers 12/19 exported Zapier error classes","description":"Live sweep (foreman-xb68): SDK main entrypoint exports 19 error/signal classes; handleSdkError instanceof-checks 12. Uncovered real errors (ZapierApiError, ZapierBundleError, ZapierConflictError, ZapierUnknownError) fall through to the ZapierError catch-all (degrades fine, no crash). 3 are control-flow signals (ZapierSignal, ZapierAbortDrainSignal, ZapierReleaseTriggerMessageSignal), not errors to surface. Low priority. Only ZapierConflictError (409) plausibly warrants a specific user-facing message. No action required unless we want finer-grained messages.","status":"open","priority":3,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-17T04:11:51Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:57Z","dependencies":[{"issue_id":"foreman-3due","depends_on_id":"foreman-xb68","type":"discovered-from","created_at":"2026-06-16T21:11:51Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-hflh","title":"Add .gitattributes to normalize line endings (kill CRLF phantom diffs)","description":"Repo has no .gitattributes; on Windows (autocrlf=true) the working tree is CRLF while git stores LF, producing ~170 phantom modified files each session and blocking clean fast-forwards. Add .gitattributes '* text=auto eol=lf' (+ binary markers).","status":"closed","priority":3,"issue_type":"chore","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-12T19:11:26Z","created_by":"HamChowderr","updated_at":"2026-07-05T03:26:46Z","closed_at":"2026-07-05T03:26:46Z","close_reason":".gitattributes LF normalization committed + merged (PR #18, 6f50a12).","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-c8fo","title":"[zapier] Poll-trigger connection resolution: normalizeAppKey + numeric-id/alias vs SDK uuid mismatch","description":"Live e2e (foreman-ueep) surfaced this. A poll trigger config storing a raw Zapier app_key (e.g. 'GitHubCLIAPI') fails the real read: runAction does normalizeAppKey('GitHubCLIAPI')='github', then auto-discover findFirstConnection({app:'github'}) does NOT match the connection whose app_key is 'GitHubCLIAPI' -\u003e no connection -\u003e 'access_token missing'. Separately, resolveConnection expects a numeric connection_id or a registered connection_alias, but sdk.findFirstConnection returns a UUID id (e.g. 0206dbe8-...), so passing that id as config.connection throws 'Unknown connection alias'. Net: for a poll trigger to read for real, the app key must be the normalized form AND the user's connection must be discoverable/aliased under it. CONFIRMED WORKING in isolation: sdk.runAction({app:'GitHubCLIAPI', connection:'\u003cuuid\u003e'}) returns {data:[100 repos]} and the poll driver's extractRecords parses it. So this is connection-resolution plumbing, not poll-driver logic (logic proven by tests/live/poll-driver.test.ts). Decide: normalize app keys at attach time, store the resolved connection id, and/or make auto-discover tolerant of raw app_key suffixes.","notes":"RESOLVED / MISDIAGNOSED earlier. There is NO poll-driver or connection-model bug. Proven: the full real poll fire works end-to-end (real Postgres + real Zapier GitHub read) when the poll config uses the CATALOG app key 'github' — baseline sets cursor from the real read, a new record fires one workflow_run (status=success, fired_by=poll, trigger_id set), and dedup prevents a second. Earlier failures were entirely my test input: I used the raw Zapier app_key 'GitHubCLIAPI', and normalizeAppKey('GitHubCLIAPI')='git-hub' (dashed), which Zapier doesn't match. normalize/resolveConnection/findFirstConnection are all fine. RESIDUAL (latent, low priority, NOT poll-specific): normalizeAppKey turns the raw Zapier key 'GitHubCLIAPI' into 'git-hub' rather than 'github', so feeding a raw Zapier app_key into any runAction breaks. Only matters if a caller uses raw Zapier keys instead of catalog keys; the agent/catalog uses normalized keys. Reduce to P3 / hardening.","status":"closed","priority":3,"issue_type":"bug","owner":"admin@otakusolutions.io","created_at":"2026-06-12T06:29:32Z","created_by":"HamChowderr","updated_at":"2026-06-12T16:18:06Z","closed_at":"2026-06-12T16:18:06Z","close_reason":"FIXED (37e324d): added catalog-backed resolveAppSlug (app_key OR slug -\u003e canonical slug; pass-through unchanged when not in catalog), wired into runAction + workflow-step save, replacing the buggy normalizeAppKey at both call sites. Live-verified: the raw 'GitHubCLIAPI' key (previously broke with 'No current_implementation_id') now fires a real workflow_run (status=success) against real Zapier + real Postgres. 5 unit tests; full suite 308 green.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-m9f6","title":"[channels] Thread real platform message ids into ChannelMessage.dedupeKey","description":"ChannelTriggerSignalProvider dedup falls back to a content hash (channel|room|from|text) when ChannelMessage.dedupeKey is absent, which coalesces a user sending the exact same text back-to-back. Pass each adapter's stable message id as dedupeKey from the ~10 channel-bot call sites (slack/discord/telegram/teams/whatsapp/gchat/github/linear onDirectMessage + onNewMention) where the Chat SDK message exposes one. Removes the false-positive edge; true per-delivery idempotency.","status":"closed","priority":3,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-12T03:31:07Z","created_by":"HamChowderr","updated_at":"2026-06-12T16:46:33Z","started_at":"2026-06-12T16:39:12Z","closed_at":"2026-06-12T16:46:33Z","close_reason":"Threaded normalized Chat SDK message.id into ChannelMessage.dedupeKey across all 8 channel bots (16 call-sites). Provider now dedupes on the real platform message id; content-hash is fallback only. Type-clean, 308 mocked tests green, committed c942a92.","dependencies":[{"issue_id":"foreman-m9f6","depends_on_id":"foreman-tv5p","type":"discovered-from","created_at":"2026-06-11T20:31:07Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-l8ev","title":"Document Zapier SDK auth model in README (client-creds vs userJwt per surface)","description":"Discovered during SDK exploration: the Zapier SDK surfaces need DIFFERENT auth. Trigger inboxes + discovery + runAction accept app-level client-credentials (ZAPIER_CLIENT_ID/SECRET). Durable-workflow endpoints (runDurable/publishWorkflowVersion) require a per-user userJwt (PKCE OAuth token), NOT client-creds. The new zapier-sdk-cli (0.54) login yields client-creds only; ~/.zapierrc deployKey is a legacy 32-char non-JWT (invalid as SDK creds). Document in README: which surfaces need which auth, how Foreman obtains each (env client-creds vs lib/zapier/sdk.ts PKCE per-user token), and the open question for Zapier (server-side path to per-user durable). Come back to this later. See docs/durable-workflow-spike.md + docs/trigger-inbox-spike.md.","status":"open","priority":3,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-11T18:39:52Z","created_by":"HamChowderr","updated_at":"2026-06-11T18:39:52Z","dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-z0kn","title":"Port provider-routing generate() test to a PG-enabled tier (storage injection)","description":"provider-swap.test.ts 'returns text' sub-test calls agent.generate() which now needs PostgresStore-backed Memory (foreman migrated LibSQL-\u003e@mastra/pg). It can't run in the no-external-services mocked tier (agents CI job has no PG), so it's it.skip'd. Proper fix: either inject a test storage into createForemanAgent (let tests use an in-memory/file store), or run this sub-test in a PG-enabled tier (test:live or a CI job with a postgres service). Discovered during the catch-up integration of claude/add-multiple-providers.","status":"open","priority":3,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-11T16:40:19Z","created_by":"HamChowderr","updated_at":"2026-06-11T16:40:19Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-l8ev","title":"Document Zapier SDK auth model in README (client-creds vs userJwt per surface)","description":"Discovered during SDK exploration: the Zapier SDK surfaces need DIFFERENT auth. Trigger inboxes + discovery + runAction accept app-level client-credentials (ZAPIER_CLIENT_ID/SECRET). Durable-workflow endpoints (runDurable/publishWorkflowVersion) require a per-user userJwt (PKCE OAuth token), NOT client-creds. The new zapier-sdk-cli (0.54) login yields client-creds only; ~/.zapierrc deployKey is a legacy 32-char non-JWT (invalid as SDK creds). Document in README: which surfaces need which auth, how Foreman obtains each (env client-creds vs lib/zapier/sdk.ts PKCE per-user token), and the open question for Zapier (server-side path to per-user durable). Come back to this later. See docs/durable-workflow-spike.md + docs/trigger-inbox-spike.md.","status":"closed","priority":3,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-11T18:39:52Z","created_by":"HamChowderr","updated_at":"2026-07-05T03:26:40Z","closed_at":"2026-07-05T03:26:40Z","close_reason":"docs/zapier-auth-model.md committed (218912f) and present.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-z0kn","title":"Port provider-routing generate() test to a PG-enabled tier (storage injection)","description":"provider-swap.test.ts 'returns text' sub-test calls agent.generate() which now needs PostgresStore-backed Memory (foreman migrated LibSQL-\u003e@mastra/pg). It can't run in the no-external-services mocked tier (agents CI job has no PG), so it's it.skip'd. Proper fix: either inject a test storage into createForemanAgent (let tests use an in-memory/file store), or run this sub-test in a PG-enabled tier (test:live or a CI job with a postgres service). Discovered during the catch-up integration of claude/add-multiple-providers.","status":"closed","priority":3,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-11T16:40:19Z","created_by":"HamChowderr","updated_at":"2026-07-05T03:26:34Z","closed_at":"2026-07-05T03:26:34Z","close_reason":"Multi-provider layer merged (c9f6b23); lib/providers/ present and wired into agents.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-elyi","title":"[bump] Surface ZapierApprovalError approval URL to the user (handleSdkError)","description":"Under SDK \u003e=0.50 with approvalMode unset, a server (non-TTY) defaults to 'throw': sdk.runAction throws ZapierApprovalError carrying an approval URL on approval-gated responses. Foreman's handleSdkError (zapier-sdk-tools.ts) currently catches it only via the generic ZapierError catch-all, surfacing .message/.code but DROPPING the approval URL. Add an explicit 'if (err instanceof ZapierApprovalError)' branch that returns the approval URL + approvalStatus so the agent can tell the user how to approve. Non-blocking for the bump (degrades gracefully today). Discovered during foreman-2xdk verification.","status":"closed","priority":3,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-11T15:10:57Z","created_by":"HamChowderr","updated_at":"2026-06-11T22:39:56Z","closed_at":"2026-06-11T22:39:56Z","close_reason":"Done: handleSdkError now surfaces ZapierApprovalError.approvalUrl (code APPROVAL_REQUIRED), placed before the generic ZapierError catch-all; handleSdkError exported + 2 unit tests (with/without URL) pass; lint clean. Verified approvalUrl field exists in SDK 0.69.3.","dependencies":[{"issue_id":"foreman-elyi","depends_on_id":"foreman-2xdk","type":"discovered-from","created_at":"2026-06-11T08:10:57Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-d4w9","title":"[aimock] Add a fixture-match coverage check to CI","description":"Nothing verifies fixtures on disk match aimock.json declarations. Add scripts/verify-aimock-coverage.mjs that enumerates declared MCP tools + A2A agents and asserts each has a fixture; wire into .github/workflows/test.yml. Add a short fixture-authoring doc (and why catch-alls are an anti-pattern).","acceptance_criteria":"Coverage script exists, runs in CI, fails on any unmocked declaration; short fixture doc added.","status":"in_progress","priority":3,"issue_type":"chore","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:30:31Z","created_by":"HamChowderr","updated_at":"2026-06-11T21:37:31Z","started_at":"2026-06-11T21:37:31Z","dependencies":[{"issue_id":"foreman-d4w9","depends_on_id":"foreman-9zsp","type":"discovered-from","created_at":"2026-06-11T01:30:31Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-8bh9","title":"[durable] Post-v1 spike: publishWorkflowVersion + runDurable hello-world; evaluate cron-\u003ewatchTriggerInbox SSE","description":"Deferred (post-v1). Prove Zapier durable execution: publish a trivial workflow version, runDurable, poll getDurableRun to terminal, triggerWorkflow via tokenized URL. Separately evaluate replacing the minute-tick cron-driver with watchTriggerInbox SSE for real-time triggers (relates to the trigger-inbox spike). No production wiring.","acceptance_criteria":"Spike doc with call shapes, latency notes, and a recommendation on whether/when to augment. Marked post-v1 backlog.","status":"open","priority":3,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:29:44Z","created_by":"HamChowderr","updated_at":"2026-06-11T08:29:44Z","dependencies":[{"issue_id":"foreman-8bh9","depends_on_id":"foreman-iyq6","type":"discovered-from","created_at":"2026-06-11T01:29:44Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-13mw","title":"[trigger-inbox] Confirm long-term stability/sunset of experimental Triggers with Zapier","description":"Access works today (iyq6 notes), but the API is /experimental and the 0.51 changelog mentions a closed-beta notice. Ask Zapier whether trigger-inbox is the go-forward path, the stability/SLA, and any sunset risk. Low priority since we can already build/spike now; this de-risks long-term reliance and is a good Zapier-feedback touchpoint.","acceptance_criteria":"Documented answer from Zapier on stability/roadmap, or a logged attempt + explicit decision to proceed at our own risk.","status":"open","priority":3,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:29:35Z","created_by":"HamChowderr","updated_at":"2026-06-11T08:29:35Z","dependencies":[{"issue_id":"foreman-13mw","depends_on_id":"foreman-iyq6","type":"discovered-from","created_at":"2026-06-11T01:29:34Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-d4w9","title":"[aimock] Add a fixture-match coverage check to CI","description":"Nothing verifies fixtures on disk match aimock.json declarations. Add scripts/verify-aimock-coverage.mjs that enumerates declared MCP tools + A2A agents and asserts each has a fixture; wire into .github/workflows/test.yml. Add a short fixture-authoring doc (and why catch-alls are an anti-pattern).","acceptance_criteria":"Coverage script exists, runs in CI, fails on any unmocked declaration; short fixture doc added.","status":"closed","priority":3,"issue_type":"chore","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:30:31Z","created_by":"HamChowderr","updated_at":"2026-06-25T17:39:27Z","started_at":"2026-06-11T21:37:31Z","closed_at":"2026-06-25T17:39:27Z","close_reason":"Already complete + verified: scripts/verify-aimock-coverage.mjs exists, wired into .github/workflows/test.yml (Verify AIMock fixture coverage step), docs/aimock-fixture-drift.md present. Ran npm run verify:aimock -\u003e green (strict mode, 8 MCP tools + 5 A2A agents, no catch-all, no drift).","dependencies":[{"issue_id":"foreman-d4w9","depends_on_id":"foreman-9zsp","type":"discovered-from","created_at":"2026-06-11T01:30:31Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-8bh9","title":"[durable] Post-v1 spike: publishWorkflowVersion + runDurable hello-world; evaluate cron-\u003ewatchTriggerInbox SSE","description":"Deferred (post-v1). Prove Zapier durable execution: publish a trivial workflow version, runDurable, poll getDurableRun to terminal, triggerWorkflow via tokenized URL. Separately evaluate replacing the minute-tick cron-driver with watchTriggerInbox SSE for real-time triggers (relates to the trigger-inbox spike). No production wiring.","acceptance_criteria":"Spike doc with call shapes, latency notes, and a recommendation on whether/when to augment. Marked post-v1 backlog.","status":"closed","priority":3,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:29:44Z","created_by":"HamChowderr","updated_at":"2026-07-05T04:52:45Z","closed_at":"2026-07-05T04:52:45Z","close_reason":"DONE (spike): finding committed docs/durable-workflow-spike.md — durable 403s userJwt wall; dropped from v1.","dependencies":[{"issue_id":"foreman-8bh9","depends_on_id":"foreman-iyq6","type":"discovered-from","created_at":"2026-06-11T01:29:44Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-13mw","title":"[trigger-inbox] Confirm long-term stability/sunset of experimental Triggers with Zapier","description":"Access works today (iyq6 notes), but the API is /experimental and the 0.51 changelog mentions a closed-beta notice. Ask Zapier whether trigger-inbox is the go-forward path, the stability/SLA, and any sunset risk. Low priority since we can already build/spike now; this de-risks long-term reliance and is a good Zapier-feedback touchpoint.","acceptance_criteria":"Documented answer from Zapier on stability/roadmap, or a logged attempt + explicit decision to proceed at our own risk.","notes":"Durable wall re-swept on SDK 0.79.0 (2026-06-25, client-creds, durable-endpoints-probe.ts): the wall MOVED vs the 0.70.4 18/18-walled sweep. Now 14/18 still userJwt-403-walled (all 13 workflow endpoints + getTriggerRun), but 4/18 — the durable-run family runDurable/cancelDurableRun/listDurableRuns/getDurableRun — now AUTHENTICATE with client-creds and return 403 'early access / available only to select users' (feature allowlist, not scope wall). So durable workflows still unusable end-to-end (can't define/publish), but the run family is now an early-access request away rather than scope-walled. Undetermined whether SDK or Zapier-server change. Doc updated (capability-map durable wall section).\n\nEARLY-ACCESS REQUEST DRAFT (durable-run family; user must submit — Foreman can't act on the Zapier account relationship). As of 0.79.0 the durable-RUN endpoints (runDurable/cancelDurableRun/listDurableRuns/getDurableRun) authenticate with client-creds but return 403 'available only to select users' — an early-access allowlist, not the userJwt scope wall. To unblock: ask Zapier (developer platform / durable EA contact) to add the Foreman client (ZAPIER_CLIENT_ID U5g…, account admin@otakusolutions.io / account id 16517015) to the durable-execution early-access program. The 13 durable WORKFLOW endpoints remain userJwt/internal-scope-walled and are NOT unblocked by this. Suggested message: 'We're building Foreman on @zapier/zapier-sdk and would like early access to the durable run-execution API (runDurable et al.) for client id U5g… / account 16517015. The run endpoints now authenticate but return the early-access 403; please add us to the allowlist.'\n\nEARLY-ACCESS URL CONFIRMED: the durable-run 403 message itself gives the intake — 'please get in touch with Zapier at https://next-gen-zaps.zapier.app/'. That's the next-gen-Zaps (durable) early-access program. Submit there for client U5g… / account 16517015 (admin@otakusolutions.io).\n\nEARLY-ACCESS REQUEST SUBMITTED 2026-06-25 via https://next-gen-zaps.zapier.app/ (the next-gen Zaps beta form). Submitted by Tylan Miller / Otaku Solutions / admin@otakusolutions.io; tools=SDK+MCP, agent=Claude Code, video-call=yes; pitched Foreman + asked for durable run/workflow API access. Access granted on a rolling basis — awaiting Zapier reply.\n\nACCESS GRANTED + CONFIRMED 2026-06-25. Email \"Youre In! Test the next generation of Zapier\" from Kenyon Sparks (kenyon.sparks@zapier.com), cc Tim Jones — next-gen-Zaps/durable early access turned ON for account admin@otakusolutions.io. CONFIRMED via read-only client-creds probe (scripts/durable-access-confirm.ts): the durable-RUN family wall is LIFTED — listDurableRuns -\u003e 2xx [] (was 403 'available only to select users'), getDurableRun(fake-uuid) -\u003e 404 'Run not found' (authenticated, not the early-access 403). So runDurable/listDurableRuns/getDurableRun/cancelDurableRun are now usable with client-creds. STILL PENDING: the 13 workflow-definition endpoints + getTriggerRun remain userJwt/internal-scope-walled under client-creds; the grant ships a NEW agentic experience (new Zapier SDK + skills) which is the path for those. Getting-started guide (Google Doc): https://docs.google.com/document/d/1-ZBpMQ5LDzqUzIWQEdwNvr1J72X8DyKbHEOmrem5ENk/edit — run its install command to get the new SDK+skills, then re-probe the workflow endpoints. Call booked with Tim Jones next week (stability/roadmap = this issue's acceptance criterion). NEXT: install new SDK+skills from guide; plan durable/trigger rebuild (deferred at workflow-engine removal).\nCORRECTION 2026-06-25 (post-grant re-test, read-only, durable-access-confirm.ts expanded): the workflow-definition family is NOT still walled. ALL tested read endpoints authenticate under client-creds now: listWorkflows-\u003e2xx empty; getWorkflow/listWorkflowVersions/getWorkflowVersion/listWorkflowRuns/getWorkflowRun/getTriggerRun all -\u003e 404 not-found (auth passed, resource just missing). So the grant opened the WHOLE durable+workflow READ surface, not just the durable-run family; the prior 14/18 userJwt-walled was the PRE-grant state. Write endpoints (createWorkflow/runDurable/publish/update/delete/enable/disable/trigger) authenticate at the same layer so are almost certainly reachable; a createWorkflow+deleteWorkflow round-trip would prove end-to-end (creates a real resource, not yet attempted).\nDEFINITIVE WRITE PROOF 2026-06-25 (scripts/durable-write-roundtrip.ts): createWorkflow + deleteWorkflow round-trip SUCCEEDED under client-creds. createWorkflow({name, is_private:true}) -\u003e 2xx with a real id (019f0166-3831-7e39-882c-ba3e78378c2c), enabled=false, is_private=true, trigger_url=https://code-substrate-workflows.zapier.com/api/v0/workflows/trigger/...; deleteWorkflow cleaned it up (no lingering resource). So workflow DEFINE works END-TO-END — the FULL durable+workflow API (read AND write) is usable for Foreman now under client-creds. createWorkflow only needs {name} (source_files belongs to publishWorkflowVersion, not create). The new agentic SDK+skills (getting-started guide) are about the AUTHORING experience, not API access. Durable/trigger rebuild is API-unblocked.","status":"open","priority":3,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-11T08:29:35Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","dependencies":[{"issue_id":"foreman-13mw","depends_on_id":"foreman-iyq6","type":"discovered-from","created_at":"2026-06-11T01:29:34Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-9hoq","title":"Wire checkpoint restore (undo generation) — needs backend endpoint","description":"The ai-elements/checkpoint.tsx component is ported from myrp-build but its 'restore' action is not wired into the live chat. myrp deletes files it wrote via Electron; Foreman (web + agent server) has no equivalent 'undo this generation' endpoint. To use the checkpoint marker meaningfully, add a backend route to roll back the side effects of an assistant turn (e.g. revert created proposals/actions), then render Checkpoint after the last assistant message in chat/messages.tsx wired to it. Until then the component stays unused to avoid a dead button.","status":"closed","priority":3,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-06-02T09:54:11Z","created_by":"HamChowderr","updated_at":"2026-06-02T10:04:17Z","closed_at":"2026-06-02T10:04:17Z","close_reason":"Skipped per user decision — checkpoint restore not wanted. Component remains ported/available but unwired; revisit only if an undo-generation backend is built.","dependencies":[{"issue_id":"foreman-9hoq","depends_on_id":"foreman-te0c","type":"discovered-from","created_at":"2026-06-02T02:54:11Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-hnw1","title":"Clear Biome lint backlog (624 errors, 194 warnings) and re-add to CI","description":"When CI was bootstrapped (foreman-9zsp / PR #12), Biome lint was deliberately omitted because the codebase had 624 errors + 194 warnings of pre-existing style/a11y violations from rules that had never been enforced.\n\nTop offenders:\n- assist/source/organizeImports: 215 (just an import-order auto-fix)\n- lint/a11y/noSvgWithoutTitle: 64 (mostly shadcn icons)\n- lint/correctness/noUnusedVariables: 43 (warnings)\n- lint/style/useImportType: 42 (warnings)\n- lint/suspicious/noArrayIndexKey: 21\n- lint/correctness/noUnusedFunctionParameters: 18 (warnings)\n- lint/a11y/useButtonType: 14\n\nPlan:\n1. Run 'npx biome check --write' to auto-fix everything biome can fix safely (organize imports, useImportType, useTemplate, etc.). That should eat ~300+ violations.\n2. Triage remaining a11y errors — most are in shadcn-vendored components; either fix or ignore the components dir.\n3. Hand-fix the rest (parsing-error files, real bugs).\n4. Add 'npm run lint' back to .github/workflows/test.yml under the web job.\n\nAcceptance: 'npm run lint' passes with 0 errors. Warnings allowed but tracked. CI fails on new errors.","status":"closed","priority":3,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-05-10T00:01:49Z","created_by":"HamChowderr","updated_at":"2026-05-10T00:38:29Z","started_at":"2026-05-10T00:09:36Z","closed_at":"2026-05-10T00:38:29Z","close_reason":"Cleared. Started at 617 errors / 194 warnings, ended at 0/0. Auto-fixed ~600 (line endings, import order, type-only imports). Hand-fixed ~30 real issues (conditional hook, button types, label/input bindings, keyboard accessibility on interactive divs, forEach return values, unused vars). Targeted suppressions for ~15 valid patterns (Supabase thenable mocks, static-array index keys, custom multi-input components). Per-directory overrides for shadcn-vendored ui/ai-elements (don't fork upstream) and landing-page static demos. Lint job re-added to test.yml workflow.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-33qx","title":"Restructure root README.md — currently detailed but disorganized","description":"The README has good content but is sprawled. Needs to be reorganized into a clear, predictable order so a new contributor or evaluator can scan it top-to-bottom and orient themselves.\n\nTarget structure:\n1. Hero — name, one-line description, status badge\n2. What it is (2-3 sentences, no jargon)\n3. Quick start (5 commands max — Supabase + agents + web)\n4. Architecture (one diagram or bullet list — agents, web, channels, data flow)\n5. Stack (frameworks + key deps)\n6. Modes (dev / production / self_hosted — what each does and when to pick)\n7. Channels (table — Slack, Discord, Telegram, etc., with status)\n8. Deployment (Vercel for web, Coolify on Hostinger VPS for agents)\n9. Testing (unit / live / sdk / e2e tiers)\n10. Contributing / development workflow (bd, branches, PR conventions)\n11. Links (docs, related repos, design assets)\n\nScope:\n- packages/agents/CLAUDE.md and packages/agents/AGENTS.md stay as developer-facing detail; README is for top-level orientation.\n- Pull existing scattered content into the structure above. Cut anything that is duplicated in CLAUDE.md.\n- Use heading hierarchy that renders well on GitHub.\n- Verify every command + URL still works (don't blindly copy).\n\nAcceptance:\n- Single ToC at top\n- Each top-level section has consistent voice and length (intro paragraph + scannable list/table)\n- New contributor can run the project from a clean checkout using only README — no need to read CLAUDE.md first","status":"closed","priority":3,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-05-09T22:24:08Z","created_by":"HamChowderr","updated_at":"2026-05-09T22:28:07Z","started_at":"2026-05-09T22:24:47Z","closed_at":"2026-05-09T22:28:07Z","close_reason":"README restructured into 11 ordered sections with ToC: What it is, Quick start, Architecture, Stack, Modes, Channels, Deployment, Testing, Development workflow, Links, License. Cut 648 lines of duplicated detail (full file tree, env-var lists, channel setup steps, API route table, schema table, security details) — those live in packages/agents/CLAUDE.md and AGENTS.md. Verified npm scripts, Next.js 16 / React 19 versions, Mastra + Hono + Supabase port shifts. Self-hosted mode rewritten as 'same per-user OAuth as production, just on own infra' (also fixed by foreman-8ktu fork in parallel; both edits converged).","dependency_count":0,"dependent_count":0,"comment_count":0}
@@ -231,10 +393,10 @@
 {"_type":"issue","id":"foreman-dqzb","title":"Foreman prompt v2 — refinements from first test review","description":"Follow-up to foreman-mebm. After the v1 prompt rewrite (XML structure + 5 phases + multishot examples) shipped and was validated against 4 example tests, reviewing the actual conversation traces surfaced 6 specific refinements.\n\nREVIEW SOURCE: 4 conversations on resourceId='foreman' under thread IDs 1778349944-test{1-4}-*\n\nREFINEMENTS:\n\n1. **Confirmation template — enforce account name even for single-account connections.**\n   Test 2 (HubSpot) said 'using the **HubSpot** connection' instead of 'using the **\u003caccount\u003e** HubSpot connection'. The template specifies \u003cconnection account name\u003e, but agents fall back to app name when only one account exists. Tighten the prompt: always state the account/email/handle even when there's only one.\n\n2. **Capitalization in field labels — pick a convention.**\n   Test 4 used 'channel: #general' / 'text: standup in 5 minutes' (lowercase). Test 2 used 'First Name: John' / 'Last Name: Doe' (capitalized). The prompt template says \u003cfield\u003e: \u003cvalue\u003e without specifying casing. Either always Title Case the user-visible field name, or always echo the SDK schema's exact field key — pick one and add an explicit rule.\n\n3. **Over-narration — reduce mid-flow status updates.**\n   Test 3 (multi-app) emitted 4 mid-flow text updates ('Now let me discover…', 'Actions found. Now let me run first-pass…', 'Now I need to resolve…'). Test 4 stayed silent through the same phases. Inconsistent. Per the 'Be concise' rule, narrate only at major decision points: initial plan, end-of-flow. Add explicit guidance: 'Do not narrate between every tool call. One initial plan announcement and the final confirmation are enough.'\n\n4. **Tone in clarification questions.**\n   Test 1 opened with 'The request is a bit ambiguous' which reads slightly accusatory. Soften to 'Quick question — …' or similar. Add as a tone note in \u003cconversation_style\u003e.\n\n5. **Empty-schema edge case handling.**\n   Test 3 hit a Google Sheet with no header columns. Agent acknowledged ('schema didn't return any column fields') but proceeded to confirm both actions anyway. The Sheets run-action would have failed at execution. Add explicit rule: 'If schema discovery returns no writable fields for a write action, refuse the step and ask the user to clarify what columns the action should set.'\n\n6. **Premature confirm handling.**\n   Test 3 user said 'Confirm' before the agent had asked for one (after picking spreadsheet '1.'). Agent recovered fine but the prompt doesn't address this. Add: 'If the user says yes/confirm/go ahead before you have proposed an action, interpret as proceed with what you were doing — do not synthesize an action and re-confirm.'\n\nACCEPTANCE:\n- Updated prompt at lib/prompt-template.ts\n- Re-run the same 4 example prompts; verify no regression on triage/parallel/clarification behavior; verify the 6 refinements show up\n- Once foreman-baseline-v1 dataset is labeled (depends on foreman-ib6z), establish a baseline score before this change and re-score after to measure quality delta\n\nDEPENDS ON: foreman-mebm (this PR's predecessor), foreman-ib6z (for measurable scoring)","notes":"All 6 refinements applied and committed (a6a9142). Bundle rebuilt and v2 prompt verified in outbound system prompt (\u003crole\u003e tag visible). Could not validate experiment delta — Anthropic credit balance ran out during validation chat. To complete validation: top up Anthropic credits, then run npm run datasets:experiment -- --full and compare avg score against the v1 baseline of 0.094.","status":"closed","priority":3,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-05-09T18:15:43Z","created_by":"HamChowderr","updated_at":"2026-05-09T20:49:38Z","started_at":"2026-05-09T20:28:48Z","closed_at":"2026-05-09T20:49:38Z","close_reason":"v2 prompt shipped (a6a9142). Bundle rebuilt, verified live. Full 80-item experiment ran 80/80 success at $2.06 cost. Trajectory score: 0.094 (same as v1). Score parity is the EXPECTED result — all 6 v2 refinements affect text output (confirmation template, narration, tone, empty-schema handling, premature confirm), not tool-call sequences. The trajectory scorer measures sequence only. To quantitatively validate v2 we'd need an LLM-judge accuracy scorer (separate follow-up). Closing here because v2 is shipped and validated qualitatively (the prompt is live and the agent is using it per the chat trace). Quantitative validation is blocked on missing scoring dimension, not on the prompt itself.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-ey7g","title":"Exclude unused Zapier SDK methods from tool generation","description":"Four SDK methods generated but unused: listInputFields (legacy duplicate of getInputFieldsSchema), createClientCredentials/deleteClientCredentials/listClientCredentials (Connect Builder OAuth — not exposed in Foreman). Excluding them removes noise from the tool catalog and the agent's search-tools surface area.","status":"closed","priority":3,"issue_type":"chore","owner":"admin@otakusolutions.io","created_at":"2026-05-09T01:38:00Z","created_by":"HamChowderr","updated_at":"2026-05-09T01:38:13Z","closed_at":"2026-05-09T01:38:13Z","close_reason":"Implemented in 8d23b85 (zapier-sdk-tools.ts EXCLUDED_METHODS rename + 4 new exclusions).","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-s3gi","title":"Document channel integration setup requirements per platform","description":"After a few users give feedback, we need a structured log of exactly what credentials, permissions, and setup steps each channel requires for the cloud version. Covers Slack (OAuth app, scopes, redirect URI), Discord (bot invite, application ID, public key), and Telegram (BotFather, bot username). Should include what env vars to set and where to find each value. Could become in-app onboarding or a public setup guide.","status":"closed","priority":3,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-30T11:00:14Z","created_by":"HamChowderr","updated_at":"2026-04-30T12:32:40Z","closed_at":"2026-04-30T12:32:40Z","close_reason":"Channel setup credentials documented in README Channel Setup section — Slack (bot + OAuth), Telegram (bot username env var), Discord (app ID env var), with exact env var names for both agents and web packages.","dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-69pg","title":"Multi-workspace OAuth callbacks for channel distribution","description":"Each channel (Slack, Discord, Telegram, etc.) currently runs on a single bot token. To let other users/workspaces add Foreman, we need per-workspace OAuth flows: install URL → OAuth callback route that exchanges the code for a bot token → saves it per-workspace. Defer until we have user feedback on which channels matter most and what scopes are actually needed in practice. Affects: /slack/oauth, /discord/oauth routes in agents + NEXT_PUBLIC_*_INSTALL_URL env vars in web.","status":"open","priority":3,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-04-30T01:22:53Z","created_by":"HamChowderr","updated_at":"2026-04-30T01:22:53Z","dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-yz2z","title":"Pen test Foreman API routes and auth layer","description":"Security audit of the Foreman API surface. Key areas to test: (1) JWT validation on all Hono routes in routes/index.ts — do all /conversations/*, /proposals/*, /workflows/* etc. reject missing/invalid tokens; (2) service_role key leakage — confirm it never reaches the browser bundle; (3) api_key table — fmn_ prefixed keys validated correctly in lib/api-auth.ts; (4) RLS bypass via SECURITY DEFINER functions; (5) Zapier OAuth callback flow for CSRF/state param validation.","status":"open","priority":3,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-28T23:16:20Z","created_by":"HamChowderr","updated_at":"2026-04-28T23:16:20Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-69pg","title":"Multi-workspace OAuth callbacks for channel distribution","description":"Each channel (Slack, Discord, Telegram, etc.) currently runs on a single bot token. To let other users/workspaces add Foreman, we need per-workspace OAuth flows: install URL → OAuth callback route that exchanges the code for a bot token → saves it per-workspace. Defer until we have user feedback on which channels matter most and what scopes are actually needed in practice. Affects: /slack/oauth, /discord/oauth routes in agents + NEXT_PUBLIC_*_INSTALL_URL env vars in web.","status":"closed","priority":3,"issue_type":"feature","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-30T01:22:53Z","created_by":"HamChowderr","updated_at":"2026-07-05T04:52:45Z","closed_at":"2026-07-05T04:52:45Z","close_reason":"DONE: multi-workspace Slack OAuth — slack/oauth.ts per-team upsert + rehydrateInstallations; 51e0919.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-yz2z","title":"Pen test Foreman API routes and auth layer","description":"Security audit of the Foreman API surface. Key areas to test: (1) JWT validation on all Hono routes in routes/index.ts — do all /conversations/*, /proposals/*, /workflows/* etc. reject missing/invalid tokens; (2) service_role key leakage — confirm it never reaches the browser bundle; (3) api_key table — fmn_ prefixed keys validated correctly in lib/api-auth.ts; (4) RLS bypass via SECURITY DEFINER functions; (5) Zapier OAuth callback flow for CSRF/state param validation.","status":"open","priority":3,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-28T23:16:20Z","created_by":"HamChowderr","updated_at":"2026-06-30T08:00:57Z","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-yw8n","title":"Delete src/proxy.ts stub from web package","description":"After Clerk→Supabase migration, proxy.ts was reduced to an empty export stub. The real middleware is now src/middleware.ts. proxy.ts should be deleted to avoid confusion.","status":"closed","priority":3,"issue_type":"chore","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-26T07:32:12Z","created_by":"HamChowderr","updated_at":"2026-04-26T07:34:02Z","started_at":"2026-04-26T07:32:26Z","closed_at":"2026-04-26T07:34:02Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-blmn","title":"Set up .zapierrc + npx zapier-sdk add for typed app clients","description":"Run npx zapier-sdk add \u003capp\u003e for apps we actually use in workflow definitions. Creates .zapierrc pinning app versions and generates TypeScript types in src/zapier/apps/. Prerequisite for the apps proxy to be type-safe. Without this, the proxy works but returns unknown. Decide which apps to pin based on actual workflow usage.","status":"closed","priority":3,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-04-22T07:13:42Z","created_by":"HamChowderr","updated_at":"2026-04-22T07:26:57Z","closed_at":"2026-04-22T07:26:57Z","close_reason":"Not needed for workflow sharing goal. Type generation only helps when hand-writing workflow step JSON in code; Foreman generates step JSON from LLM conversations at runtime, so types add no value. Revisit if we later hand-author workflow definitions.","dependency_count":0,"dependent_count":2,"comment_count":0}
+{"_type":"issue","id":"foreman-blmn","title":"Set up .zapierrc + npx zapier-sdk add for typed app clients","description":"Run npx zapier-sdk add \u003capp\u003e for apps we actually use in workflow definitions. Creates .zapierrc pinning app versions and generates TypeScript types in src/zapier/apps/. Prerequisite for the apps proxy to be type-safe. Without this, the proxy works but returns unknown. Decide which apps to pin based on actual workflow usage.","status":"closed","priority":3,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-04-22T07:13:42Z","created_by":"HamChowderr","updated_at":"2026-07-04T20:21:40Z","closed_at":"2026-04-22T07:26:57Z","close_reason":"Not needed for workflow sharing goal. Type generation only helps when hand-writing workflow step JSON in code; Foreman generates step JSON from LLM conversations at runtime, so types add no value. Revisit if we later hand-author workflow definitions.","dependency_count":0,"dependent_count":2,"comment_count":0}
 {"_type":"issue","id":"foreman-3661","title":"Use Zapier apps proxy for workflow engine step execution","description":"workflows/engine.ts runs hand-authored step definitions via runAction(app, actionType, action, inputs). The comment at zapier-sdk-tools.ts:28-34 explicitly says the apps proxy (zapier.apps[appKey][actionType][actionKey]) is the right fit for this case — LLM tools stay on runAction, but workflow steps gain type safety from the proxy. Requires type generation (see linked issue).","status":"closed","priority":3,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-04-22T07:13:38Z","created_by":"HamChowderr","updated_at":"2026-04-22T07:27:01Z","closed_at":"2026-04-22T07:27:01Z","close_reason":"Not needed for workflow sharing goal. Apps proxy is an ergonomic code-writing convenience; workflow engine executes JSON produced by the agent at runtime where the proxy adds no value. Revisit if we hand-author workflow logic.","dependencies":[{"issue_id":"foreman-3661","depends_on_id":"foreman-blmn","type":"blocks","created_at":"2026-04-22T00:14:53Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-lqs","title":"Use SDK dynamic credentials resolver in getSdkForUser","description":"getSdkForUser recreates + caches an SDK per user with manual refresh_token handling. The SDK supports credentials: async () =\u003e token as a resolver. Evaluate switching to one SDK instance + resolver, which would consolidate caching and refresh logic. Note: SDK only auto-refreshes client_credentials, not user OAuth refresh tokens — Foreman would still need to implement user-token refresh, but the shape can be unified.","status":"closed","priority":3,"issue_type":"chore","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-22T07:13:33Z","created_by":"HamChowderr","updated_at":"2026-04-22T07:18:34Z","closed_at":"2026-04-22T07:18:34Z","close_reason":"Won't do. The credentials resolver attaches to a single SDK instance with no per-call user context. Foreman's per-user OAuth model requires SDK-per-user, which is the current pattern. Resolver is useful for single-tenant or server-wide token rotation — the latter is already covered by foreman-4j9's client_credentials flow.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-cuf","title":"Next 16: rename middleware.ts → proxy.ts","description":"Next 16 renamed the middleware file convention to \"proxy\". Build log emits: \"The 'middleware' file convention is deprecated. Please use 'proxy' instead.\" File: packages/web/src/middleware.ts (Clerk route protection). Action: rename to packages/web/src/proxy.ts, verify Clerk middleware API is still imported correctly (proxy convention may expect a different default export signature vs middleware). Docs: https://nextjs.org/docs/messages/middleware-to-proxy. Low urgency — still works, just warns on every build.","status":"closed","priority":3,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-21T16:28:25Z","created_by":"HamChowderr","updated_at":"2026-04-21T16:30:46Z","closed_at":"2026-04-21T16:30:46Z","close_reason":"Renamed packages/web/src/middleware.ts → proxy.ts in commit 558279e. File content unchanged; the Clerk middleware API is identical between the two file conventions.","dependency_count":0,"dependent_count":0,"comment_count":0}
@@ -249,7 +411,7 @@
 {"_type":"issue","id":"foreman-849","title":"Add voice capabilities (STT/TTS)","description":"Voice input via Telegram and web. @mastra/voice-openai for Whisper STT and TTS. CompositeVoice for mixing providers.","status":"closed","priority":3,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-04-18T04:23:55Z","created_by":"HamChowderr","updated_at":"2026-04-18T05:55:24Z","closed_at":"2026-04-18T05:55:24Z","close_reason":"OpenAIVoice added to agent via @mastra/voice-openai. Enables agent.voice.speak() (TTS) and agent.voice.listen() (STT).","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-6lb","title":"Split into multi-agent (supervisor + specialists)","description":"Break Foreman into subagents: discovery agent, execution agent, workflow builder agent. Supervisor routes requests. Phase 3 — after single agent is solid.","status":"closed","priority":3,"issue_type":"feature","owner":"admin@otakusolutions.io","created_at":"2026-04-18T03:27:15Z","created_by":"HamChowderr","updated_at":"2026-04-18T05:47:55Z","closed_at":"2026-04-18T05:47:55Z","close_reason":"Supervisor + 3 specialist subagents (discovery/Haiku, execution/Sonnet, history/Haiku). Uses Mastra native agents property for auto-delegation. Original foreman agent unchanged — supervisor is alternative entry point.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-u5j7","title":"Optionally adopt Conversation stick-to-bottom wrapper in chat","description":"ai-elements/conversation.tsx (use-stick-to-bottom) is ported but not wired in; chat/messages.tsx still uses the existing useMessages scroll hook (works fine). If we want myrp's exact smooth stick-to-bottom feel, refactor messages.tsx to render inside \u003cConversation\u003e/\u003cConversationContent\u003e + \u003cConversationScrollButton\u003e. Low priority — current scroll behavior is equivalent.","status":"closed","priority":4,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-02T09:54:12Z","created_by":"HamChowderr","updated_at":"2026-06-02T10:04:16Z","closed_at":"2026-06-02T10:04:16Z","close_reason":"Done — wired Conversation/ConversationContent/ConversationScrollButton (use-stick-to-bottom) into chat/messages.tsx, replacing the manual scroll hook. Clean build passes.","dependencies":[{"issue_id":"foreman-u5j7","depends_on_id":"foreman-te0c","type":"discovered-from","created_at":"2026-06-02T02:54:12Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"foreman-v4i4","title":"Fixture drift detection — design + decision (NOT just an aimock config)","description":"Fixtures at packages/agents/tests/fixtures/aimock/ were recorded against specific Anthropic response shapes (Sonnet 4.6, Haiku 4.5). If Anthropic ships a new revision or changes streaming chunk format, mocked tests pass against stale fixtures and we get false green. Drift detection periodically replays fixtures against the real provider and flags divergence.\n\nDepends on: foreman-9zsp (CI must exist before scheduled drift jobs can run there).\n\nScope:\n1. Read https://aimock.copilotkit.dev/drift-detection/ for the current command surface + recommended cadence. Do not guess from training data.\n2. Decide cadence: weekly cron on .github/workflows/drift.yml is probably right; monthly may be too slow for catching API changes pre-incident.\n3. Job runs aimock drift command with ANTHROPIC_API_KEY (real provider) against existing fixtures. On divergence, fail the workflow + open an issue or post to a Slack channel.\n4. Budget guard: cap real-provider spend per run (drift checks should be cheap, but pin a max).\n5. Wire ANTHROPIC_API_KEY as a repo secret (already set for Vercel — copy or reuse).\n\nAcceptance:\n- Weekly drift job runs and either passes silently or opens a github issue describing which fixture diverged from real provider\n- One forced-divergence test case proves the workflow actually catches drift (e.g. temporarily edit a fixture, confirm next run fails)","notes":"Investigation finding: AIMock's documented 'drift detection' (https://aimock.copilotkit.dev/drift-detection/) is internal QA for the AIMock library — it tests that AIMock's BUILT-IN mocks match real provider APIs. Direct quote: 'aimock includes three-way drift tests that compare SDK types, real API responses, and mock output.' That's their library testing itself, not a feature consumers can wire to validate their own recorded fixtures.\n\nThere is no documented user-facing feature in @copilotkit/aimock for periodic real-provider replay against user fixtures.\n\nThe underlying need is still real (Anthropic ships new model revisions, our recorded fixtures go stale, mocked tests pass on fake data). But it's a build, not a config:\n\nOption A — Roll our own:\n1. Weekly cron workflow that runs the existing test suite WITHOUT aimock (real ANTHROPIC_API_KEY)\n2. Capture the responses, diff against the recorded fixture JSON\n3. Open a github issue when fields/types diverge\n4. Spend cap: ~/month on real API replay\n\nOption B — Pin aggressively:\n- Lock anthropic-sdk version, lock model IDs to specific dated snapshots\n- Re-record fixtures on schedule (manual quarterly review)\n- Cheaper but fragile to silent shape changes\n\nOption C — Defer:\n- Accept the risk for v1\n- Revisit when we have a real customer hit by stale fixtures\n- Lowest effort\n\nRecommend Option C until the agent has paying users — drift damage is theoretical right now and Option A's tooling lift is non-trivial.","status":"open","priority":4,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-05-09T23:31:49Z","created_by":"HamChowderr","updated_at":"2026-05-09T23:35:34Z","dependency_count":0,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"foreman-v4i4","title":"Fixture drift detection — design + decision (NOT just an aimock config)","description":"Fixtures at packages/agents/tests/fixtures/aimock/ were recorded against specific Anthropic response shapes (Sonnet 4.6, Haiku 4.5). If Anthropic ships a new revision or changes streaming chunk format, mocked tests pass against stale fixtures and we get false green. Drift detection periodically replays fixtures against the real provider and flags divergence.\n\nDepends on: foreman-9zsp (CI must exist before scheduled drift jobs can run there).\n\nScope:\n1. Read https://aimock.copilotkit.dev/drift-detection/ for the current command surface + recommended cadence. Do not guess from training data.\n2. Decide cadence: weekly cron on .github/workflows/drift.yml is probably right; monthly may be too slow for catching API changes pre-incident.\n3. Job runs aimock drift command with ANTHROPIC_API_KEY (real provider) against existing fixtures. On divergence, fail the workflow + open an issue or post to a Slack channel.\n4. Budget guard: cap real-provider spend per run (drift checks should be cheap, but pin a max).\n5. Wire ANTHROPIC_API_KEY as a repo secret (already set for Vercel — copy or reuse).\n\nAcceptance:\n- Weekly drift job runs and either passes silently or opens a github issue describing which fixture diverged from real provider\n- One forced-divergence test case proves the workflow actually catches drift (e.g. temporarily edit a fixture, confirm next run fails)","notes":"Investigation finding: AIMock's documented 'drift detection' (https://aimock.copilotkit.dev/drift-detection/) is internal QA for the AIMock library — it tests that AIMock's BUILT-IN mocks match real provider APIs. Direct quote: 'aimock includes three-way drift tests that compare SDK types, real API responses, and mock output.' That's their library testing itself, not a feature consumers can wire to validate their own recorded fixtures.\n\nThere is no documented user-facing feature in @copilotkit/aimock for periodic real-provider replay against user fixtures.\n\nThe underlying need is still real (Anthropic ships new model revisions, our recorded fixtures go stale, mocked tests pass on fake data). But it's a build, not a config:\n\nOption A — Roll our own:\n1. Weekly cron workflow that runs the existing test suite WITHOUT aimock (real ANTHROPIC_API_KEY)\n2. Capture the responses, diff against the recorded fixture JSON\n3. Open a github issue when fields/types diverge\n4. Spend cap: ~/month on real API replay\n\nOption B — Pin aggressively:\n- Lock anthropic-sdk version, lock model IDs to specific dated snapshots\n- Re-record fixtures on schedule (manual quarterly review)\n- Cheaper but fragile to silent shape changes\n\nOption C — Defer:\n- Accept the risk for v1\n- Revisit when we have a real customer hit by stale fixtures\n- Lowest effort\n\nRecommend Option C until the agent has paying users — drift damage is theoretical right now and Option A's tooling lift is non-trivial.","status":"closed","priority":4,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-05-09T23:31:49Z","created_by":"HamChowderr","updated_at":"2026-07-05T04:52:45Z","closed_at":"2026-07-05T04:52:45Z","close_reason":"DONE: design+decision doc committed — docs/aimock-fixture-drift.md (0ca0b2d).","dependency_count":0,"dependent_count":1,"comment_count":0}
 {"_type":"issue","id":"foreman-8w7","title":"Swap elevenlabs npm package → @elevenlabs/elevenlabs-js","description":"Transitive dep issue: the 'elevenlabs' package is pulled in by @mastra/voice-elevenlabs@0.12.0 (its direct dep, see node_modules/@mastra/voice-elevenlabs/package.json). Not fixable from our repo. Actions: (1) Upstream: file an issue on mastra-ai/mastra asking voice-elevenlabs to migrate to @elevenlabs/elevenlabs-js. (2) Monitor: bump @mastra/voice-elevenlabs when they release a version using the new package. (3) Until then: ignore the npm warn on install — it's informational, not blocking.","notes":"Moot — @mastra/voice-elevenlabs removed from the project entirely. No longer a transitive dep concern.","status":"closed","priority":4,"issue_type":"chore","owner":"admin@otakusolutions.io","created_at":"2026-04-21T16:28:54Z","created_by":"HamChowderr","updated_at":"2026-04-26T01:08:18Z","closed_at":"2026-04-26T01:08:18Z","close_reason":"Removed @mastra/voice-elevenlabs from project — ElevenLabs TTS is no longer used","defer_until":"2026-07-01T07:00:00Z","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-cur","title":"Native fetch in workflow sandbox — switch to 'workflow' import","description":"packages/agents/src/mastra/index.ts customMiddleware (~line 43) uses native fetch to dynamically load routes. Linter warns native fetch() is not available in workflow sandbox scope, recommends: import fetch from 'workflow' OR move the call into a 'use step' function. Low-impact today because the call is in middleware, not a workflow step, but worth aligning.","status":"closed","priority":4,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-21T15:43:34Z","created_by":"HamChowderr","updated_at":"2026-04-26T01:01:07Z","started_at":"2026-04-26T00:59:06Z","closed_at":"2026-04-26T01:01:07Z","close_reason":"False positive — customRoutes.fetch() is Hono's .fetch() method, not global fetch. Middleware doesn't run in workflow sandbox. No fix needed.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-0sb","title":"Telegram bot singleton test times out after 5s","description":"packages/agents/tests/unit/telegram-bot.test.ts 'getTelegramBot returns a singleton' hits 5000ms timeout. Pre-existing, surfaced during post-migration test run. Likely making a real network call or has a flaky mock. Either bump timeout, add proper mock, or rewrite the assertion.","status":"closed","priority":4,"issue_type":"bug","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-04-21T15:43:22Z","created_by":"HamChowderr","updated_at":"2026-04-26T01:01:05Z","started_at":"2026-04-26T00:59:07Z","closed_at":"2026-04-26T01:01:05Z","close_reason":"Mocked @chat-adapter/telegram and chat to prevent real Telegram API calls during init","dependency_count":0,"dependent_count":0,"comment_count":0}
diff --git a/.beads/metadata.json b/.beads/metadata.json
index 2b8a01ca..48e5f715 100644
--- a/.beads/metadata.json
+++ b/.beads/metadata.json
@@ -3,5 +3,6 @@
   "backend": "dolt",
   "dolt_mode": "server",
   "dolt_database": "foreman",
-  "project_id": "47c0db0f-fd99-4f5f-863c-de5bb1b033dd"
+  "project_id": "47c0db0f-fd99-4f5f-863c-de5bb1b033dd",
+  "braynee_seen_bd_version": "1.1.0"
 }
diff --git a/.claude/settings.local.json b/.claude/settings.local.json
deleted file mode 100644
index f397a8d5..00000000
--- a/.claude/settings.local.json
+++ /dev/null
@@ -1,100 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(sqlite3 local.db \".tables\")",
-      "Bash(sqlite3 foreman.db \".tables\")",
-      "Bash(mcp__key-broker__list_secrets)",
-      "Read(//c/Users/HamCh/**)",
-      "Bash(cp -r src/mastra/* packages/agents/src/mastra/)",
-      "Bash(cp -r src/lib/zapier/* packages/agents/src/lib/zapier/)",
-      "Bash(cp -r src/lib/db/* packages/agents/src/lib/db/)",
-      "Bash(cp -r src/lib/stream/* packages/agents/src/lib/stream/)",
-      "Bash(cp -r drizzle/* packages/agents/drizzle/)",
-      "Bash(python3 -c \"import sys,json; d=json.load\\(sys.stdin\\); print\\(list\\(d.keys\\(\\)\\)\\)\")",
-      "Bash(mv /c/Users/HamCh/code/foreman/packages/agents/.env /c/Users/HamCh/code/foreman/packages/agents/.env.local)",
-      "Bash(sed -i 's/^\\\\.env$/\\\\.env.local/' /c/Users/HamCh/code/foreman/packages/agents/.gitignore)",
-      "Bash(pkill -f cloudflared)",
-      "Bash(ngrok version:*)",
-      "Bash(ngrok http:*)",
-      "Bash(pkill -f ngrok)",
-      "Bash(pkill -f \"node -e\")",
-      "Bash(winget install:*)",
-      "Bash(\"/c/Program Files/Microsoft SDKs/Azure/CLI2/wbin/az\" account show)",
-      "Bash(\"/c/Program Files \\(x86\\)/Microsoft SDKs/Azure/CLI2/wbin/az\" account show)",
-      "Bash($AZ account:*)",
-      "Bash($AZ ad:*)",
-      "Bash($AZ bot:*)",
-      "Bash('/c/Program Files/Microsoft SDKs/Azure/CLI2/wbin/az' bot msteams create --resource-group foreman-rg --name foreman-bot)",
-      "Bash(disown)",
-      "Bash(jobs -l)",
-      "Bash(pkill -f \"test-discord-gw\")",
-      "Bash(python3 -c \"import sys,json; items=json.load\\(sys.stdin\\); [print\\(f'{i[\\\\\"id\\\\\"]} P{i[\\\\\"priority\\\\\"]} [{i[\\\\\"issue_type\\\\\"]}] {i[\\\\\"title\\\\\"]}'\\) for i in sorted\\(items, key=lambda x: x['priority']\\)]\")",
-      "Bash(mv tests/llmock-setup.ts tests/aimock-setup.ts)",
-      "Bash(mv tests/llmock-teardown.ts tests/aimock-teardown.ts)",
-      "Bash(disown sleep:*)",
-      "Bash(sed:*)",
-      "Bash(printf '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2024-11-05\",\"capabilities\":{},\"clientInfo\":{\"name\":\"test\",\"version\":\"1.0\"}}}\\\\n{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/list\",\"params\":{}}\\\\n')",
-      "Bash(rm:*)",
-      "Bash(python3 -c \"import sys,json; items=json.load\\(sys.stdin\\); [print\\(f'{i[\\\\\"id\\\\\"]:15s} {i[\\\\\"status\\\\\"]:12s} {i[\\\\\"title\\\\\"][:70]}'\\) for i in items]\")",
-      "Bash(mv:*)",
-      "mcp__ssh-mcp__exec",
-      "Bash(nslookup foreman.otakusolutions.io)",
-      "Bash(nslookup foreman-agents.otakusolutions.io)",
-      "Bash(nslookup:*)",
-      "Read(//c/c/Users/HamCh/**)",
-      "Bash(cp:*)",
-      "Bash(powershell:*)",
-      "Bash(DATABASE_URL=\"file:./src/mastra/public/foreman.db\" npx drizzle-kit push --force)",
-      "Bash(DATABASE_URL=\"file:./src/mastra/public/foreman.db\" npx drizzle-kit migrate)",
-      "Skill(commit-commands:commit)",
-      "Bash(wmic process:*)",
-      "Bash(pkill -f \"next dev\")",
-      "Bash(pkill -f \"mastra dev\")",
-      "Bash(PORT=4111 npx mastra *)",
-      "Bash(winget list *)",
-      "Bash(scoop list *)",
-      "Bash(DATABASE_URL=\"postgres://placeholder\" npx drizzle-kit generate)",
-      "Bash(DATABASE_URL=\"postgres://postgres:postgres@127.0.0.1:54422/postgres\" npx --workspace packages/agents drizzle-kit generate --name=init)",
-      "Bash(awk '{print $5}')",
-      "Bash(DATABASE_URL=\"postgres://postgres:postgres@127.0.0.1:54422/postgres\" npx drizzle-kit migrate)",
-      "Bash(awk ' /^\\\\[storage\\\\]$/ { print; getline; print; sub\\(/enabled = true/, \"enabled = false\"\\); next } /^\\\\[auth\\\\]$/ { print; getline; print; sub\\(/enabled = true/, \"enabled = false\"\\); next } /^\\\\[realtime\\\\]$/ { print; getline; print; sub\\(/enabled = true/, \"enabled = false\"\\); next } /^\\\\[inbucket\\\\]$/ { print; getline; print; sub\\(/enabled = true/, \"enabled = false\"\\); next } { print } ' supabase/config.toml)",
-      "Bash(tee /tmp/test-output.txt)",
-      "Bash(tee /c/Users/HamCh/AppData/Local/Temp/mastra-dev.log)",
-      "Bash(tee /tmp/test-output2.txt)",
-      "Bash(PGPASSWORD=postgres psql -h 127.0.0.1 -p 54422 -U postgres -d postgres -c \"\\\\dt connection_alias\")",
-      "Bash(\"/c/Program Files/Docker/Docker/Docker Desktop.exe\")",
-      "Bash(awk '{print $2}')",
-      "Bash(tee /tmp/agents-start.log)",
-      "Bash(DATABASE_URL=postgres://postgres:postgres@127.0.0.1:54422/postgres ENCRYPTION_KEY=test node --unhandled-rejections=strict .mastra/output/index.mjs)",
-      "Bash(DATABASE_URL=postgres://postgres:postgres@127.0.0.1:54422/postgres ENCRYPTION_KEY=test-key-32-characters-minimum-16 node --unhandled-rejections=strict --trace-uncaught .mastra/output/index.mjs)",
-      "Bash(kill 34370)",
-      "Read(//tmp/**)",
-      "Bash(/c/Users/HamCh/code/foreman/node_modules/.bin/mastra dev *)",
-      "Bash(./node_modules/.bin/mastra dev *)",
-      "Bash(kill %1)",
-      "Bash(python3 -c \"import sys,json; d=json.load\\(sys.stdin\\); [print\\(k,v\\) for k,v in d.get\\('dependencies',{}\\).items\\(\\) if 'mastra' in k.lower\\(\\)]\")",
-      "Bash(python3 -c \"import sys,json; d=json.load\\(sys.stdin\\); print\\(json.dumps\\(d.get\\('peerDependencies',{}\\), indent=2\\)\\)\")",
-      "Bash(kill 399334)",
-      "Bash(node_modules/.bin/mastra --version)",
-      "Bash(DEBUG=\"*\" timeout 50 npx mastra dev)",
-      "Bash(pkill -f \"until curl\")",
-      "Bash(pkill -f \"mastra/output\")",
-      "Bash(kill 441951)",
-      "Skill(update-config)",
-      "Bash(bash -c 'bd doctor --fix 2>/dev/null; bd hooks install --force 2>/dev/null; exit 0')",
-      "Bash(python3 -c \"import json,sys; issues=json.load\\(sys.stdin\\); [print\\(f'{i[\\\\\"id\\\\\"]} [{i[\\\\\"priority\\\\\"]}] {i[\\\\\"title\\\\\"]}'\\) for i in issues]\")",
-      "Bash(bash -c \"bd close foreman-qk1 --reason='Ported providers layer from claude/add-multiple-providers-wXhQJ: AGENT_MODELS, modelSettingsFor, systemPromptFor, toolsWithCacheControl, onFinishCostLogger, validateAgentCapabilities. Deleted request dead code from execution agent.' && bd close foreman-km8 --reason='AI Elements already bundled locally at src/components/ai-elements/ and wired into chat shell. No install needed.'\")",
-      "Bash(node_modules/.bin/vitest.cmd run *)",
-      "Bash(python3 -c \" import json, sys issues = json.load\\(sys.stdin\\) for i in issues: blocked = i.get\\('dependency_count', 0\\) > 0 print\\(f\\\\\"P{i['priority']} [{i['id']}] {i['title']}\\\\\"\\) \")",
-      "Bash(npx vitest *)",
-      "Bash(NODE_OPTIONS=\"--max-old-space-size=4096\" npx tsc --noEmit --skipLibCheck)",
-      "Bash(python3 -c \" import json, sys issues = json.load\\(sys.stdin\\) for i in issues: deps = i.get\\('dependency_count', 0\\) blocked = '🔒' if deps > 0 else ' ' print\\(f\\\\\"{blocked} [{i['priority']}] {i['id']}: {i['title']}\\\\\"\\) \")",
-      "Bash(psql *)",
-      "Bash(mv 20260426000003_workspaces.sql 20260426000004_workspaces.sql)",
-      "Bash(mv 20260426000004_billing.sql 20260426000005_billing.sql)",
-      "Bash(mv 20260426000005_marketing.sql 20260426000006_marketing.sql)",
-      "Bash(mv 20260426000006_marketing_blog.sql 20260426000007_marketing_blog.sql)",
-      "Bash(mv 20260426000007_marketing_changelog.sql 20260426000008_marketing_changelog.sql)"
-    ]
-  }
-}
diff --git a/.claude/skills/make-interfaces-feel-better/SKILL.md b/.claude/skills/make-interfaces-feel-better/SKILL.md
new file mode 100644
index 00000000..cd19691d
--- /dev/null
+++ b/.claude/skills/make-interfaces-feel-better/SKILL.md
@@ -0,0 +1,148 @@
+---
+name: make-interfaces-feel-better
+description: Design engineering principles for making interfaces feel polished. Use when building UI components, reviewing frontend code, implementing animations, hover states, shadows, borders, typography, micro-interactions, enter/exit animations, or any visual detail work. Triggers on UI polish, design details, "make it feel better", "feels off", stagger animations, border radius, optical alignment, font smoothing, tabular numbers, image outlines, box shadows.
+---
+
+# Details that make interfaces feel better
+
+Great interfaces rarely come from a single thing. It's usually a collection of small details that compound into a great experience. Apply these principles when building or reviewing UI code.
+
+## Quick Reference
+
+| Category | When to Use |
+| --- | --- |
+| [Typography](typography.md) | Text wrapping, font smoothing, tabular numbers |
+| [Surfaces](surfaces.md) | Border radius, optical alignment, shadows, image outlines, hit areas |
+| [Animations](animations.md) | Interruptible animations, enter/exit transitions, icon animations, scale on press |
+| [Performance](performance.md) | Transition specificity, `will-change` usage |
+
+## Core Principles
+
+### 1. Concentric Border Radius
+
+Outer radius = inner radius + padding. Mismatched radii on nested elements is the most common thing that makes interfaces feel off.
+
+### 2. Optical Over Geometric Alignment
+
+When geometric centering looks off, align optically. Buttons with icons, play triangles, and asymmetric icons all need manual adjustment.
+
+### 3. Shadows Over Borders
+
+Layer multiple transparent `box-shadow` values for natural depth. Shadows adapt to any background; solid borders don't.
+
+### 4. Interruptible Animations
+
+Use CSS transitions for interactive state changes — they can be interrupted mid-animation. Reserve keyframes for staged sequences that run once.
+
+### 5. Split and Stagger Enter Animations
+
+Don't animate a single container. Break content into semantic chunks and stagger each with ~100ms delay.
+
+### 6. Subtle Exit Animations
+
+Use a small fixed `translateY` instead of full height. Exits should be softer than enters.
+
+### 7. Contextual Icon Animations
+
+Animate icons with `opacity`, `scale`, and `blur` instead of toggling visibility. Use exactly these values: scale from `0.25` to `1`, opacity from `0` to `1`, blur from `4px` to `0px`. If the project has `motion` or `framer-motion` in `package.json`, use `transition: { type: "spring", duration: 0.3, bounce: 0 }` — bounce must always be `0`. If no motion library is installed, keep both icons in the DOM (one absolute-positioned) and cross-fade with CSS transitions using `cubic-bezier(0.2, 0, 0, 1)` — this gives both enter and exit animations without any dependency.
+
+### 8. Font Smoothing
+
+Apply `-webkit-font-smoothing: antialiased` to the root layout on macOS for crisper text.
+
+### 9. Tabular Numbers
+
+Use `font-variant-numeric: tabular-nums` for any dynamically updating numbers to prevent layout shift.
+
+### 10. Text Wrapping
+
+Use `text-wrap: balance` on headings. Use `text-wrap: pretty` for body text to avoid orphans.
+
+### 11. Image Outlines
+
+Add a subtle `1px` outline with low opacity to images for consistent depth. The color must be pure black in light mode (`rgba(0, 0, 0, 0.1)`) and pure white in dark mode (`rgba(255, 255, 255, 0.1)`) — never a near-black like slate, zinc, or any tinted neutral. A tinted outline picks up the surface color underneath it and reads as dirt on the image edge.
+
+### 12. Scale on Press
+
+A subtle `scale(0.96)` on click gives buttons tactile feedback. Always use `0.96`. Never use a value smaller than `0.95` — anything below feels exaggerated. Add a `static` prop to disable it when motion would be distracting.
+
+### 13. Skip Animation on Page Load
+
+Use `initial={false}` on `AnimatePresence` to prevent enter animations on first render. Verify it doesn't break intentional entrance animations.
+
+### 14. Never Use `transition: all`
+
+Always specify exact properties: `transition-property: scale, opacity`. Tailwind's `transition-transform` covers `transform, translate, scale, rotate`.
+
+### 15. Use `will-change` Sparingly
+
+Only for `transform`, `opacity`, `filter` — properties the GPU can composite. Never use `will-change: all`. Only add when you notice first-frame stutter.
+
+### 16. Minimum Hit Area
+
+Interactive elements need at least 40×40px hit area. Extend with a pseudo-element if the visible element is smaller. Never let hit areas of two elements overlap.
+
+## Common Mistakes
+
+| Mistake | Fix |
+| --- | --- |
+| Same border radius on parent and child | Calculate `outerRadius = innerRadius + padding` |
+| Icons look off-center | Adjust optically with padding or fix SVG directly |
+| Hard borders between sections | Use layered `box-shadow` with transparency |
+| Jarring enter/exit animations | Split, stagger, and keep exits subtle |
+| Numbers cause layout shift | Apply `tabular-nums` |
+| Heavy text on macOS | Apply `antialiased` to root |
+| Animation plays on page load | Add `initial={false}` to `AnimatePresence` |
+| `transition: all` on elements | Specify exact properties |
+| First-frame animation stutter | Add `will-change: transform` (sparingly) |
+| Tiny hit areas on small controls | Extend with pseudo-element to 40×40px |
+
+## Review Output Format
+
+Always present changes as a markdown table with **Before** and **After** columns. Include every change you made — not just a subset. Never list findings as separate "Before:" / "After:" lines outside of a table. Group changes by principle using a heading above each table, and keep each row focused on a single diff so the reader can scan the whole list quickly.
+
+### Example
+
+#### Concentric border radius
+| Before | After |
+| --- | --- |
+| `rounded-xl` on card + `rounded-xl` on inner button (`p-2`) | `rounded-2xl` on card (`12 + 8`), `rounded-lg` on inner button |
+| `border-radius: 16px` on both nested surfaces | Outer `24px`, inner `16px` with `8px` padding |
+
+#### Tabular numbers
+| Before | After |
+| --- | --- |
+| `<span>{count}</span>` on animated counter | `<span className="tabular-nums">{count}</span>` |
+| Default numerals on timer | Added `font-variant-numeric: tabular-nums` to root |
+
+#### Scale on press
+| Before | After |
+| --- | --- |
+| `<button className="...">` | Added `active:scale-[0.96] transition-transform` |
+| `scale(0.9)` on press | Raised to `scale(0.96)` — anything below `0.95` feels exaggerated |
+
+Rows should cite the specific file and the specific property that changed when it isn't obvious from the snippet. If a principle was reviewed but nothing needed to change, omit that table entirely — empty tables add noise.
+
+## Review Checklist
+
+- [ ] Nested rounded elements use concentric border radius
+- [ ] Icons are optically centered, not just geometrically
+- [ ] Shadows used instead of borders where appropriate
+- [ ] Enter animations are split and staggered
+- [ ] Exit animations are subtle
+- [ ] Dynamic numbers use tabular-nums
+- [ ] Font smoothing is applied
+- [ ] Headings use text-wrap: balance
+- [ ] Images have subtle outlines
+- [ ] Buttons use scale on press where appropriate
+- [ ] AnimatePresence uses `initial={false}` for default-state elements
+- [ ] No `transition: all` — only specific properties
+- [ ] `will-change` only on transform/opacity/filter, never `all`
+- [ ] Interactive elements have at least 40×40px hit area
+
+## Reference Files
+
+- [typography.md](typography.md) — Text wrapping, font smoothing, tabular numbers
+- [surfaces.md](surfaces.md) — Border radius, optical alignment, shadows, image outlines
+- [animations.md](animations.md) — Interruptible animations, enter/exit transitions, icon animations, scale on press
+- [performance.md](performance.md) — Transition specificity, `will-change` usage
diff --git a/.claude/skills/make-interfaces-feel-better/animations.md b/.claude/skills/make-interfaces-feel-better/animations.md
new file mode 100644
index 00000000..e0515e02
--- /dev/null
+++ b/.claude/skills/make-interfaces-feel-better/animations.md
@@ -0,0 +1,379 @@
+# Animations
+
+Interruptible animations, enter/exit transitions, and contextual icon animations.
+
+## Interruptible Animations
+
+Users change intent mid-interaction. If animations aren't interruptible, the interface feels broken.
+
+### CSS Transitions vs. Keyframes
+
+| | CSS Transitions | CSS Keyframe Animations |
+| --- | --- | --- |
+| **Behavior** | Interpolate toward latest state | Run on a fixed timeline |
+| **Interruptible** | Yes — retargets mid-animation | No — restarts from beginning |
+| **Use for** | Interactive state changes (hover, toggle, open/close) | Staged sequences that run once (enter animations, loading) |
+| **Duration** | Adapts to remaining distance | Fixed regardless of state |
+
+```css
+/* Good — interruptible transition for a toggle */
+.drawer {
+  transform: translateX(-100%);
+  transition: transform 200ms ease-out;
+}
+.drawer.open {
+  transform: translateX(0);
+}
+
+/* Clicking again mid-animation smoothly reverses — no jank */
+```
+
+```css
+/* Bad — keyframe animation for interactive element */
+.drawer.open {
+  animation: slideIn 200ms ease-out forwards;
+}
+
+/* Closing mid-animation snaps or restarts — feels broken */
+```
+
+**Rule:** Always prefer CSS transitions for interactive elements. Reserve keyframes for one-shot sequences.
+
+## Enter Animations: Split and Stagger
+
+Don't animate a single large container. Break content into semantic chunks and animate each individually.
+
+### Step by Step
+
+1. **Split** into logical groups (title, description, buttons)
+2. **Stagger** with ~100ms delay between groups
+3. **For titles**, consider splitting into individual words with ~80ms stagger
+4. **Combine** `opacity`, `blur`, and `translateY` for the enter effect
+
+### Code Example
+
+```tsx
+// Motion (Framer Motion) — staggered enter
+function PageHeader() {
+  return (
+    <motion.div
+      initial="hidden"
+      animate="visible"
+      variants={{
+        visible: { transition: { staggerChildren: 0.1 } },
+      }}
+    >
+      <motion.h1
+        variants={{
+          hidden: { opacity: 0, y: 12, filter: "blur(4px)" },
+          visible: { opacity: 1, y: 0, filter: "blur(0px)" },
+        }}
+      >
+        Welcome
+      </motion.h1>
+
+      <motion.p
+        variants={{
+          hidden: { opacity: 0, y: 12, filter: "blur(4px)" },
+          visible: { opacity: 1, y: 0, filter: "blur(0px)" },
+        }}
+      >
+        A description of the page.
+      </motion.p>
+
+      <motion.div
+        variants={{
+          hidden: { opacity: 0, y: 12, filter: "blur(4px)" },
+          visible: { opacity: 1, y: 0, filter: "blur(0px)" },
+        }}
+      >
+        <Button>Get started</Button>
+      </motion.div>
+    </motion.div>
+  );
+}
+```
+
+### CSS-Only Stagger
+
+```css
+.stagger-item {
+  opacity: 0;
+  transform: translateY(12px);
+  filter: blur(4px);
+  animation: fadeInUp 400ms ease-out forwards;
+}
+
+.stagger-item:nth-child(1) { animation-delay: 0ms; }
+.stagger-item:nth-child(2) { animation-delay: 100ms; }
+.stagger-item:nth-child(3) { animation-delay: 200ms; }
+
+@keyframes fadeInUp {
+  to {
+    opacity: 1;
+    transform: translateY(0);
+    filter: blur(0);
+  }
+}
+```
+
+## Exit Animations
+
+Exit animations should be softer and less attention-grabbing than enter animations. The user's focus is moving to the next thing — don't fight for attention.
+
+### Subtle Exit (Recommended)
+
+```tsx
+// Small fixed translateY — indicates direction without drama
+<motion.div
+  exit={{
+    opacity: 0,
+    y: -12,
+    filter: "blur(4px)",
+    transition: { duration: 0.15, ease: "easeIn" },
+  }}
+>
+  {content}
+</motion.div>
+```
+
+### Full Exit (When Context Matters)
+
+```tsx
+// Slide fully out — use when spatial context is important
+// (e.g., a card returning to a list, a drawer closing)
+<motion.div
+  exit={{
+    opacity: 0,
+    x: "-100%",
+    transition: { duration: 0.2, ease: "easeIn" },
+  }}
+>
+  {content}
+</motion.div>
+```
+
+### Good vs. Bad
+
+```css
+/* Good — subtle exit */
+.item-exit {
+  opacity: 0;
+  transform: translateY(-12px);
+  transition: opacity 150ms ease-in, transform 150ms ease-in;
+}
+
+/* Bad — dramatic exit that steals focus */
+.item-exit {
+  opacity: 0;
+  transform: translateY(-100%) scale(0.5);
+  transition: all 400ms ease-in;
+}
+
+/* Bad — no exit animation at all (element just vanishes) */
+.item-exit {
+  display: none;
+}
+```
+
+**Key points:**
+- Use a small fixed `translateY` (e.g., `-12px`) instead of the full container height
+- Keep some directional movement to indicate where the element went
+- Exit duration should be shorter than enter duration (150ms vs 300ms)
+- Don't remove exit animations entirely — subtle motion preserves context
+
+## Contextual Icon Animations
+
+When icons appear or disappear contextually (on hover, on state change), animate them with `opacity`, `scale`, and `blur` rather than just toggling visibility.
+
+### Motion Example
+
+```tsx
+import { AnimatePresence, motion } from "motion/react";
+
+function IconButton({ isActive, icon: Icon }) {
+  return (
+    <button>
+      <AnimatePresence mode="popLayout">
+        <motion.span
+          key={isActive ? "active" : "inactive"}
+          initial={{ opacity: 0, scale: 0.25, filter: "blur(4px)" }}
+          animate={{ opacity: 1, scale: 1, filter: "blur(0px)" }}
+          exit={{ opacity: 0, scale: 0.25, filter: "blur(4px)" }}
+          transition={{ type: "spring", duration: 0.3, bounce: 0 }}
+        >
+          <Icon />
+        </motion.span>
+      </AnimatePresence>
+    </button>
+  );
+}
+```
+
+### CSS Transition Approach (No Motion)
+
+If the project doesn't use Motion (Framer Motion), keep both icons in the DOM and cross-fade them with CSS transitions. Because neither icon unmounts, both enter and exit animate smoothly.
+
+The trick: one icon is absolutely positioned on top of the other. Toggling state cross-fades them — the entering icon scales up from `0.25` while the exiting icon scales down to `0.25`, both with opacity and blur.
+
+```tsx
+function IconButton({ isActive, ActiveIcon, InactiveIcon }) {
+  return (
+    <button>
+      <div className="relative">
+        <div
+          className={cn(
+            "absolute inset-0 flex items-center justify-center",
+            "transition-[opacity,filter,scale] duration-300",
+            "cubic-bezier(0.2, 0, 0, 1)",
+            isActive
+              ? "scale-100 opacity-100 blur-0"
+              : "scale-[0.25] opacity-0 blur-[4px]"
+          )}
+        >
+          <ActiveIcon />
+        </div>
+        <div
+          className={cn(
+            "transition-[opacity,filter,scale] duration-300",
+            "cubic-bezier(0.2, 0, 0, 1)",
+            isActive
+              ? "scale-[0.25] opacity-0 blur-[4px]"
+              : "scale-100 opacity-100 blur-0"
+          )}
+        >
+          <InactiveIcon />
+        </div>
+      </div>
+    </button>
+  );
+}
+```
+
+The non-absolute icon (InactiveIcon) defines the layout size. The absolute icon (ActiveIcon) overlays it without affecting flow.
+
+### Choosing Between Motion and CSS
+
+| | Motion (Framer Motion) | CSS transitions (both icons in DOM) |
+| --- | --- | --- |
+| **Enter animation** | Yes | Yes |
+| **Exit animation** | Yes (via `AnimatePresence`) | Yes (cross-fade — icon never unmounts) |
+| **Spring physics** | Yes | No — use `cubic-bezier(0.2, 0, 0, 1)` as approximation |
+| **When to use** | Project already uses `motion/react` | No motion dependency, or keeping bundle small |
+
+**Rule:** Check the project's `package.json` for `motion` or `framer-motion`. If present, use the Motion approach. If not, use the CSS cross-fade pattern — don't add a dependency just for icon transitions.
+
+### When to Animate Icons
+
+| Animate | Don't animate |
+| --- | --- |
+| Icons that appear on hover (action buttons) | Static navigation icons |
+| State change icons (play → pause, like → liked) | Decorative icons |
+| Icons in contextual toolbars | Icons that are always visible |
+| Loading/success state indicators | Icon labels (text next to icon) |
+
+**Important:** Always use exactly these values for contextual icon animations — do not deviate:
+- `scale`: `0.25` → `1` (never use `0.5` or `0.6`)
+- `opacity`: `0` → `1`
+- `filter`: `"blur(4px)"` → `"blur(0px)"`
+- `transition`: `{ type: "spring", duration: 0.3, bounce: 0 }` — **bounce must always be `0`**, never `0.1` or any other value
+
+## Scale on Press
+
+A subtle scale-down on click gives buttons tactile feedback. Always use `scale(0.96)`. Never use a value smaller than `0.95` — anything below feels exaggerated. Use CSS transitions for interruptibility — if the user releases mid-press, it should smoothly return.
+
+Not every button needs this. Add a `static` prop to your button component that disables the scale effect when the motion would be distracting.
+
+### CSS Example
+
+```css
+.button {
+  transition-property: scale;
+  transition-duration: 150ms;
+  transition-timing-function: ease-out;
+}
+
+.button:active {
+  scale: 0.96;
+}
+```
+
+### Tailwind Example
+
+```tsx
+<button className="transition-transform duration-150 ease-out active:scale-[0.96]">
+  Click me
+</button>
+```
+
+### Motion Example
+
+```tsx
+<motion.button whileTap={{ scale: 0.96 }}>
+  Click me
+</motion.button>
+```
+
+### Static Prop Pattern
+
+Extract the scale class into a variable and conditionally apply it based on a `static` prop:
+
+```tsx
+const tapScale = "active:not-disabled:scale-[0.96]";
+
+function Button({ static: isStatic, className, children, ...props }) {
+  return (
+    <button
+      className={cn(
+        "transition-transform duration-150 ease-out",
+        !isStatic && tapScale,
+        className,
+      )}
+      {...props}
+    >
+      {children}
+    </button>
+  );
+}
+
+// Usage
+<Button>Click me</Button>           {/* scales on press */}
+<Button static>Submit</Button>       {/* no scale */}
+```
+
+## Skip Animation on Page Load
+
+Use `initial={false}` on `AnimatePresence` to prevent enter animations from firing on first render. Elements that are already in their default state shouldn't animate in on page load — only on subsequent state changes.
+
+### When It Works
+
+```tsx
+// Good — icon doesn't animate in on mount, only on state change
+<AnimatePresence initial={false} mode="popLayout">
+  <motion.span
+    key={isActive ? "active" : "inactive"}
+    initial={{ opacity: 0, scale: 0.25, filter: "blur(4px)" }}
+    animate={{ opacity: 1, scale: 1, filter: "blur(0px)" }}
+    exit={{ opacity: 0, scale: 0.25, filter: "blur(4px)" }}
+  >
+    <Icon />
+  </motion.span>
+</AnimatePresence>
+```
+
+Works well for: icon swaps, toggles, tabs, segmented controls — anything that has a default state on page load.
+
+### When It Breaks
+
+Don't use `initial={false}` when the component relies on its `initial` prop to set up a first-time enter animation, like a staggered page hero or a loading state. In those cases, removing the initial animation skips the entire entrance.
+
+```tsx
+// Bad — initial={false} would skip the staggered page enter entirely
+<AnimatePresence initial={false}>
+  <motion.div initial="hidden" animate="visible" variants={...}>
+    ...
+  </motion.div>
+</AnimatePresence>
+```
+
+Verify the component still looks right on a full page refresh before applying this.
diff --git a/.claude/skills/make-interfaces-feel-better/performance.md b/.claude/skills/make-interfaces-feel-better/performance.md
new file mode 100644
index 00000000..15595498
--- /dev/null
+++ b/.claude/skills/make-interfaces-feel-better/performance.md
@@ -0,0 +1,88 @@
+# Performance
+
+Transition specificity and GPU compositing hints.
+
+## Transition Only What Changes
+
+Never use `transition: all` or Tailwind's `transition` shorthand (which maps to `transition-property: all`). Always specify the exact properties that change.
+
+### Why
+
+- `transition: all` forces the browser to watch every property for changes
+- Causes unexpected transitions on properties you didn't intend to animate (colors, padding, shadows)
+- Prevents browser optimizations
+
+### CSS Example
+
+```css
+/* Good — only transition what changes */
+.button {
+  transition-property: scale, background-color;
+  transition-duration: 150ms;
+  transition-timing-function: ease-out;
+}
+
+/* Bad — transition everything */
+.button {
+  transition: all 150ms ease-out;
+}
+```
+
+### Tailwind
+
+```tsx
+// Good — explicit properties
+<button className="transition-[scale,background-color] duration-150 ease-out">
+
+// Bad — transition all
+<button className="transition duration-150 ease-out">
+```
+
+### Tailwind `transition-transform` Note
+
+`transition-transform` in Tailwind maps to `transition-property: transform, translate, scale, rotate` — it covers all transform-related properties, not just `transform`. Use this when you're only animating transforms. For multiple non-transform properties, use the bracket syntax: `transition-[scale,opacity,filter]`.
+
+## Use `will-change` Sparingly
+
+`will-change` hints the browser to pre-promote an element to its own GPU compositing layer. Without it, the browser promotes the element only when the animation starts — that one-time layer promotion can cause a micro-stutter on the first frame.
+
+This particularly helps when an element is changing `scale`, `rotation`, or moving around with `transform`. For other properties, it doesn't help much — the browser can't composite them on the GPU anyway.
+
+### Rules
+
+```css
+/* Good — specific property that benefits from GPU compositing */
+.animated-card {
+  will-change: transform;
+}
+
+/* Good — multiple compositor-friendly properties */
+.animated-card {
+  will-change: transform, opacity;
+}
+
+/* Bad — never use will-change: all */
+.animated-card {
+  will-change: all;
+}
+
+/* Bad — properties that can't be GPU-composited anyway */
+.animated-card {
+  will-change: background-color, padding;
+}
+```
+
+### Useful Properties
+
+| Property | GPU-compositable | Worth using `will-change` |
+| --- | --- | --- |
+| `transform` | Yes | Yes |
+| `opacity` | Yes | Yes |
+| `filter` (blur, brightness) | Yes | Yes |
+| `clip-path` | Yes | Yes |
+| `top`, `left`, `width`, `height` | No | No |
+| `background`, `border`, `color` | No | No |
+
+### When to Skip
+
+Modern browsers are already good at optimizing on their own. Only add `will-change` when you notice first-frame stutter — Safari in particular benefits from it. Don't add it preemptively to every animated element; each extra compositing layer costs memory.
diff --git a/.claude/skills/make-interfaces-feel-better/surfaces.md b/.claude/skills/make-interfaces-feel-better/surfaces.md
new file mode 100644
index 00000000..180de509
--- /dev/null
+++ b/.claude/skills/make-interfaces-feel-better/surfaces.md
@@ -0,0 +1,256 @@
+# Surfaces
+
+Border radius, optical alignment, shadows, and image outlines.
+
+## Concentric Border Radius
+
+When nesting rounded elements, the outer radius must equal the inner radius plus the padding between them:
+
+```
+outerRadius = innerRadius + padding
+```
+
+This rule is most useful when nested surfaces are close together. If padding is larger than `24px`, treat the layers as separate surfaces and choose each radius independently instead of forcing strict concentric math.
+
+### Example
+
+```css
+/* Good — concentric radii */
+.card {
+  border-radius: 20px; /* 12 + 8 */
+  padding: 8px;
+}
+.card-inner {
+  border-radius: 12px;
+}
+
+/* Bad — same radius on both */
+.card {
+  border-radius: 12px;
+  padding: 8px;
+}
+.card-inner {
+  border-radius: 12px;
+}
+```
+
+### Tailwind Example
+
+```tsx
+// Good — outer radius accounts for padding
+<div className="rounded-2xl p-2">       {/* 16px radius, 8px padding */}
+  <div className="rounded-lg">          {/* 8px radius = 16 - 8 ✓ */}
+    ...
+  </div>
+</div>
+
+// Bad — same radius on both
+<div className="rounded-xl p-2">
+  <div className="rounded-xl">          {/* same radius, looks off */}
+    ...
+  </div>
+</div>
+```
+
+Mismatched border radii on nested elements is one of the most common things that makes interfaces feel off. Always calculate concentrically.
+
+## Optical Alignment
+
+When geometric centering looks off, align optically instead.
+
+### Buttons with Text + Icon
+
+Use slightly less padding on the icon side to make the button feel balanced. A reliable rule of thumb is:
+`icon-side padding = text-side padding - 2px`.
+
+```css
+/* Good — less padding on icon side */
+.button-with-icon {
+  padding-left: 16px;
+  padding-right: 14px; /* icon side = text side - 2px */
+}
+
+/* Bad — equal padding looks like icon is pushed too far right */
+.button-with-icon {
+  padding: 0 16px;
+}
+```
+
+```tsx
+// Tailwind
+<button className="pl-4 pr-3.5 flex items-center gap-2">
+  <span>Continue</span>
+  <ArrowRightIcon />
+</button>
+```
+
+### Play Button Triangles
+
+Play icons are triangular and their geometric center is not their visual center. Shift slightly right:
+
+```css
+/* Good — optically centered */
+.play-button svg {
+  margin-left: 2px; /* shift right to account for triangle shape */
+}
+
+/* Bad — geometrically centered but looks off */
+.play-button svg {
+  /* no adjustment */
+}
+```
+
+### Asymmetric Icons (Stars, Arrows, Carets)
+
+Some icons have uneven visual weight. The best fix is adjusting the SVG directly so no extra margin/padding is needed in the component code.
+
+```tsx
+// Best — fix in the SVG itself
+// Adjust the viewBox or path to visually center the icon
+
+// Fallback — adjust with margin
+<span className="ml-px">
+  <StarIcon />
+</span>
+```
+
+## Shadows Instead of Borders
+
+For **buttons, cards, and containers** that use a border for depth or elevation, prefer replacing it with a subtle `box-shadow`. Shadows adapt to any background since they use transparency; solid borders don't. This also helps when using images or multiple colors as backgrounds — solid border colors don't work well on backgrounds other than the ones they were designed for.
+
+**Do not apply this to dividers** (`border-b`, `border-t`, side borders) or any border whose purpose is layout separation rather than element depth. Those should stay as borders.
+
+### Shadow as Border (Light Mode)
+
+The shadow is comprised of three layers. The first acts as a 1px border ring, the second adds subtle lift, and the third provides ambient depth:
+
+```css
+:root {
+  --shadow-border:
+    0px 0px 0px 1px rgba(0, 0, 0, 0.06),
+    0px 1px 2px -1px rgba(0, 0, 0, 0.06),
+    0px 2px 4px 0px rgba(0, 0, 0, 0.04);
+  --shadow-border-hover:
+    0px 0px 0px 1px rgba(0, 0, 0, 0.08),
+    0px 1px 2px -1px rgba(0, 0, 0, 0.08),
+    0px 2px 4px 0px rgba(0, 0, 0, 0.06);
+}
+```
+
+### Shadow as Border (Dark Mode)
+
+In dark mode, simplify to a single white ring — layered depth shadows aren't visible on dark backgrounds:
+
+```css
+/* Dark mode — adapt to whatever setup the project uses
+   (prefers-color-scheme, class, data attribute, etc.) */
+--shadow-border: 0 0 0 1px rgba(255, 255, 255, 0.08);
+--shadow-border-hover: 0 0 0 1px rgba(255, 255, 255, 0.13);
+```
+
+### Usage with Hover Transition
+
+Apply the variable and add `transition-[box-shadow]` for a smooth hover:
+
+```css
+.card {
+  box-shadow: var(--shadow-border);
+  transition-property: box-shadow;
+  transition-duration: 150ms;
+  transition-timing-function: ease-out;
+}
+
+.card:hover {
+  box-shadow: var(--shadow-border-hover);
+}
+```
+
+### When to Use Shadows vs. Borders
+
+| Use shadows | Use borders |
+| --- | --- |
+| Cards, containers with depth | Dividers between list items |
+| Buttons with bordered styles | Table cell boundaries |
+| Elevated elements (dropdowns, modals) | Form input outlines (for accessibility) |
+| Elements on varied backgrounds | Hairline separators in dense UI |
+| Hover/focus states for lift effect | |
+
+## Image Outlines
+
+Add a subtle `1px` outline with low opacity to images. This creates consistent depth, especially in design systems where other elements use borders or shadows.
+
+### Color rules (non-negotiable)
+
+- **Light mode**: pure black — `rgba(0, 0, 0, 0.1)`. Exact values: R=0, G=0, B=0.
+- **Dark mode**: pure white — `rgba(255, 255, 255, 0.1)`. Exact values: R=255, G=255, B=255.
+- Never use a near-black or near-white from the project palette (e.g. slate-900, zinc-900, `#0a0a0a`, `#111827`, `#f5f5f7`). Tinted outlines pick up the surrounding surface color and read as dirt on the image edge.
+- Never match the outline to the project's accent or ink color. The outline is a neutral separator, not a themed element.
+
+### Light Mode
+
+```css
+img {
+  outline: 1px solid rgba(0, 0, 0, 0.1);
+  outline-offset: -1px; /* inset so it doesn't add to layout */
+}
+```
+
+### Dark Mode
+
+```css
+img {
+  outline: 1px solid rgba(255, 255, 255, 0.1);
+  outline-offset: -1px;
+}
+```
+
+### Tailwind with Dark Mode
+
+```tsx
+<img
+  className="outline outline-1 -outline-offset-1 outline-black/10 dark:outline-white/10"
+  src={src}
+  alt={alt}
+/>
+```
+
+Use `outline-black/10` and `outline-white/10` specifically — not `outline-slate-*`, `outline-zinc-*`, `outline-neutral-*`, or any tinted scale.
+
+**Why outline instead of border?** `outline` doesn't affect layout (no added width/height), and `outline-offset: -1px` keeps it inset so images stay their intended size.
+
+## Minimum Hit Area
+
+Interactive elements should have a minimum hit area of 44×44px (WCAG) or at least 40×40px. If the visible element is smaller (e.g., a 20×20 checkbox), extend the hit area with a pseudo-element.
+
+### CSS Example
+
+```css
+/* Small checkbox with expanded hit area */
+.checkbox {
+  position: relative;
+  width: 20px;
+  height: 20px;
+}
+
+.checkbox::after {
+  content: "";
+  position: absolute;
+  top: 50%;
+  left: 50%;
+  transform: translate(-50%, -50%);
+  width: 40px;
+  height: 40px;
+}
+```
+
+### Tailwind Example
+
+```tsx
+<button className="relative size-5 after:absolute after:top-1/2 after:left-1/2 after:size-10 after:-translate-1/2">
+  <CheckIcon />
+</button>
+```
+
+### Collision Rule
+
+If the extended hit area overlaps another interactive element, shrink the pseudo-element — but make it as large as possible without colliding. Two interactive elements should never have overlapping hit areas.
diff --git a/.claude/skills/make-interfaces-feel-better/typography.md b/.claude/skills/make-interfaces-feel-better/typography.md
new file mode 100644
index 00000000..6ca7ac7e
--- /dev/null
+++ b/.claude/skills/make-interfaces-feel-better/typography.md
@@ -0,0 +1,135 @@
+# Typography
+
+Typography rendering details that make interfaces feel better.
+
+## Text Wrapping
+
+### text-wrap: balance
+
+Distributes text evenly across lines, preventing orphaned words on headings and short text blocks. **Only works on blocks of 6 lines or fewer** (Chromium) or 10 lines or fewer (Firefox) — the balancing algorithm is computationally expensive, so browsers limit it to short text.
+
+```css
+/* Good — even line lengths on short text */
+h1, h2, h3 {
+  text-wrap: balance;
+}
+```
+
+```css
+/* Bad — default wrapping leaves orphans */
+h1 {
+  /* no text-wrap rule → "Read our
+     blog" instead of balanced lines */
+}
+```
+
+```css
+/* Bad — balance on long paragraphs (silently ignored, wastes intent) */
+.article-body p {
+  text-wrap: balance;
+}
+```
+
+**Tailwind:** `text-balance`
+
+### text-wrap: pretty
+
+Prevents orphaned words (a single word dangling on the last line) by adjusting line breaks throughout the paragraph. Unlike `balance`, it doesn't try to equalize line lengths — it just ensures the last line isn't embarrassingly short. Works on text of any length with no line-count limit.
+
+This should be your **default for short-to-medium text** — paragraphs, descriptions, captions, list items, card text. For very long text (10+ lines), skip both `pretty` and `balance` — the browser's default wrapping is fine and you avoid unnecessary layout cost.
+
+```css
+/* Good — descriptions, captions, short paragraphs */
+p, li, figcaption, blockquote {
+  text-wrap: pretty;
+}
+```
+
+```tsx
+// Tailwind
+<p className="text-pretty">
+  A short paragraph that won't leave an orphan on the last line.
+</p>
+```
+
+**Tailwind:** `text-pretty`
+
+### When to Use Which
+
+| Scenario | Use |
+| --- | --- |
+| Headings, titles where even distribution matters | `text-wrap: balance` |
+| Short-to-medium text — paragraphs, descriptions, captions, UI text | `text-wrap: pretty` |
+| Long text (10+ lines), code blocks, pre-formatted text | Neither — leave default |
+
+## Font Smoothing (macOS)
+
+On macOS, text renders heavier than intended by default. Apply antialiased smoothing to the root layout so all text renders crisper and thinner.
+
+```css
+/* CSS */
+html {
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+}
+```
+
+```tsx
+// Tailwind — apply to root layout
+<html className="antialiased">
+```
+
+### Good vs. Bad
+
+```css
+/* Good — applied once at the root */
+html {
+  -webkit-font-smoothing: antialiased;
+}
+
+/* Bad — applied per-element, inconsistent */
+.heading {
+  -webkit-font-smoothing: antialiased;
+}
+.body {
+  /* no smoothing → heavier than heading */
+}
+```
+
+**Note:** This only affects macOS rendering. Other platforms ignore these properties, so it's safe to apply universally.
+
+## Tabular Numbers
+
+When numbers update dynamically (counters, prices, timers, table columns), use tabular-nums to make all digits equal width. This prevents layout shift as values change.
+
+```css
+/* CSS */
+.counter {
+  font-variant-numeric: tabular-nums;
+}
+```
+
+```tsx
+// Tailwind
+<span className="tabular-nums">{count}</span>
+```
+
+### When to Use
+
+| Use tabular-nums | Don't use tabular-nums |
+| --- | --- |
+| Counters and timers | Static display numbers |
+| Prices that update | Decorative large numbers |
+| Table columns with numbers | Phone numbers, zip codes |
+| Animated number transitions | Version numbers (v2.1.0) |
+| Scoreboards, dashboards | |
+
+### Caveat
+
+Some fonts (like Inter) change the visual appearance of numerals with this property — specifically, the digit `1` becomes wider and centered. This is expected behavior and usually desirable for alignment, but verify it looks right in your specific font.
+
+```css
+/* With Inter font:
+   Default:  1234  → proportional, "1" is narrow
+   Tabular:  1234  → all digits equal width, "1" centered */
+```
diff --git a/.claude/skills/supabase-postgres-best-practices/CHANGELOG.md b/.claude/skills/supabase-postgres-best-practices/CHANGELOG.md
new file mode 100644
index 00000000..94aee487
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/CHANGELOG.md
@@ -0,0 +1,29 @@
+# Changelog
+
+## [1.3.0](https://github.com/supabase/agent-skills/compare/v1.2.0...v1.3.0) (2026-06-05)
+
+
+### Features
+
+* add schema-constraints reference for safe migration patterns ([#30](https://github.com/supabase/agent-skills/issues/30)) ([9b236f3](https://github.com/supabase/agent-skills/commit/9b236f3ebd65d76a2c570f19931353da9c858d5a))
+* using Supabase agent skills ([#12](https://github.com/supabase/agent-skills/issues/12)) ([7c2e389](https://github.com/supabase/agent-skills/commit/7c2e3894fddfde8eb6c77d2a8921904543b9be7a))
+
+
+### Bug Fixes
+
+* correct broken reference link in postgres best practices skill ([#58](https://github.com/supabase/agent-skills/issues/58)) ([f4e2277](https://github.com/supabase/agent-skills/commit/f4e22777fd8573537297b568c16e5a45a25927da))
+* cover SECURITY DEFINER, auth.role() deprecation, and BOLA in security checklist ([#85](https://github.com/supabase/agent-skills/issues/85)) ([133f43e](https://github.com/supabase/agent-skills/commit/133f43e8c2ffc48823ff0630c692cabecea3e3a3))
+
+## [1.2.0](https://github.com/supabase/agent-skills/compare/v1.1.1...v1.2.0) (2026-06-02)
+
+
+### Features
+
+* add schema-constraints reference for safe migration patterns ([#30](https://github.com/supabase/agent-skills/issues/30)) ([9b236f3](https://github.com/supabase/agent-skills/commit/9b236f3ebd65d76a2c570f19931353da9c858d5a))
+* using Supabase agent skills ([#12](https://github.com/supabase/agent-skills/issues/12)) ([7c2e389](https://github.com/supabase/agent-skills/commit/7c2e3894fddfde8eb6c77d2a8921904543b9be7a))
+
+
+### Bug Fixes
+
+* correct broken reference link in postgres best practices skill ([#58](https://github.com/supabase/agent-skills/issues/58)) ([f4e2277](https://github.com/supabase/agent-skills/commit/f4e22777fd8573537297b568c16e5a45a25927da))
+* cover SECURITY DEFINER, auth.role() deprecation, and BOLA in security checklist ([#85](https://github.com/supabase/agent-skills/issues/85)) ([133f43e](https://github.com/supabase/agent-skills/commit/133f43e8c2ffc48823ff0630c692cabecea3e3a3))
diff --git a/.claude/skills/supabase-postgres-best-practices/SKILL.md b/.claude/skills/supabase-postgres-best-practices/SKILL.md
new file mode 100644
index 00000000..d9ef1949
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/SKILL.md
@@ -0,0 +1,64 @@
+---
+name: supabase-postgres-best-practices
+description: Postgres performance optimization and best practices from Supabase. Use this skill when writing, reviewing, or optimizing Postgres queries, schema designs, or database configurations.
+license: MIT
+metadata:
+  author: supabase
+  version: "1.1.1"
+  organization: Supabase
+  date: January 2026
+  abstract: Comprehensive Postgres performance optimization guide for developers using Supabase and Postgres. Contains performance rules across 8 categories, prioritized by impact from critical (query performance, connection management) to incremental (advanced features). Each rule includes detailed explanations, incorrect vs. correct SQL examples, query plan analysis, and specific performance metrics to guide automated optimization and code generation.
+---
+
+# Supabase Postgres Best Practices
+
+Comprehensive performance optimization guide for Postgres, maintained by Supabase. Contains rules across 8 categories, prioritized by impact to guide automated query optimization and schema design.
+
+## When to Apply
+
+Reference these guidelines when:
+- Writing SQL queries or designing schemas
+- Implementing indexes or query optimization
+- Reviewing database performance issues
+- Configuring connection pooling or scaling
+- Optimizing for Postgres-specific features
+- Working with Row-Level Security (RLS)
+
+## Rule Categories by Priority
+
+| Priority | Category | Impact | Prefix |
+|----------|----------|--------|--------|
+| 1 | Query Performance | CRITICAL | `query-` |
+| 2 | Connection Management | CRITICAL | `conn-` |
+| 3 | Security & RLS | CRITICAL | `security-` |
+| 4 | Schema Design | HIGH | `schema-` |
+| 5 | Concurrency & Locking | MEDIUM-HIGH | `lock-` |
+| 6 | Data Access Patterns | MEDIUM | `data-` |
+| 7 | Monitoring & Diagnostics | LOW-MEDIUM | `monitor-` |
+| 8 | Advanced Features | LOW | `advanced-` |
+
+## How to Use
+
+Read individual rule files for detailed explanations and SQL examples:
+
+```
+references/query-missing-indexes.md
+references/query-partial-indexes.md
+references/_sections.md
+```
+
+Each rule file contains:
+- Brief explanation of why it matters
+- Incorrect SQL example with explanation
+- Correct SQL example with explanation
+- Optional EXPLAIN output or metrics
+- Additional context and references
+- Supabase-specific notes (when applicable)
+
+## References
+
+- https://www.postgresql.org/docs/current/
+- https://supabase.com/docs
+- https://wiki.postgresql.org/wiki/Performance_Optimization
+- https://supabase.com/docs/guides/database/overview
+- https://supabase.com/docs/guides/auth/row-level-security
diff --git a/.claude/skills/supabase-postgres-best-practices/references/_contributing.md b/.claude/skills/supabase-postgres-best-practices/references/_contributing.md
new file mode 100644
index 00000000..1c055aff
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/_contributing.md
@@ -0,0 +1,170 @@
+# Writing Guidelines for Postgres References
+
+This document provides guidelines for creating effective Postgres best
+practice references that work well with AI agents and LLMs.
+
+## Key Principles
+
+### 1. Concrete Transformation Patterns
+
+Show exact SQL rewrites. Avoid philosophical advice.
+
+**Good:** "Use `WHERE id = ANY(ARRAY[...])` instead of
+`WHERE id IN (SELECT ...)`" **Bad:** "Design good schemas"
+
+### 2. Error-First Structure
+
+Always show the problematic pattern first, then the solution. This trains agents
+to recognize anti-patterns.
+
+```markdown
+**Incorrect (sequential queries):** [bad example]
+
+**Correct (batched query):** [good example]
+```
+
+### 3. Quantified Impact
+
+Include specific metrics. Helps agents prioritize fixes.
+
+**Good:** "10x faster queries", "50% smaller index", "Eliminates N+1" 
+**Bad:** "Faster", "Better", "More efficient"
+
+### 4. Self-Contained Examples
+
+Examples should be complete and runnable (or close to it). Include `CREATE TABLE`
+if context is needed.
+
+```sql
+-- Include table definition when needed for clarity
+CREATE TABLE users (
+  id bigint PRIMARY KEY,
+  email text NOT NULL,
+  deleted_at timestamptz
+);
+
+-- Now show the index
+CREATE INDEX users_active_email_idx ON users(email) WHERE deleted_at IS NULL;
+```
+
+### 5. Semantic Naming
+
+Use meaningful table/column names. Names carry intent for LLMs.
+
+**Good:** `users`, `email`, `created_at`, `is_active`
+**Bad:** `table1`, `col1`, `field`, `flag`
+
+---
+
+## Code Example Standards
+
+### SQL Formatting
+
+```sql
+-- Use lowercase keywords, clear formatting
+CREATE INDEX CONCURRENTLY users_email_idx
+  ON users(email)
+  WHERE deleted_at IS NULL;
+
+-- Not cramped or ALL CAPS
+CREATE INDEX CONCURRENTLY USERS_EMAIL_IDX ON USERS(EMAIL) WHERE DELETED_AT IS NULL;
+```
+
+### Comments
+
+- Explain _why_, not _what_
+- Highlight performance implications
+- Point out common pitfalls
+
+### Language Tags
+
+- `sql` - Standard SQL queries
+- `plpgsql` - Stored procedures/functions
+- `typescript` - Application code (when needed)
+- `python` - Application code (when needed)
+
+---
+
+## When to Include Application Code
+
+**Default: SQL Only**
+
+Most references should focus on pure SQL patterns. This keeps examples portable.
+
+**Include Application Code When:**
+
+- Connection pooling configuration
+- Transaction management in application context
+- ORM anti-patterns (N+1 in Prisma/TypeORM)
+- Prepared statement usage
+
+**Format for Mixed Examples:**
+
+````markdown
+**Incorrect (N+1 in application):**
+
+```typescript
+for (const user of users) {
+  const posts = await db.query("SELECT * FROM posts WHERE user_id = $1", [
+    user.id,
+  ]);
+}
+```
+````
+
+**Correct (batch query):**
+
+```typescript
+const posts = await db.query("SELECT * FROM posts WHERE user_id = ANY($1)", [
+  userIds,
+]);
+```
+
+---
+
+## Impact Level Guidelines
+
+| Level | Improvement | Use When |
+|-------|-------------|----------|
+| **CRITICAL** | 10-100x | Missing indexes, connection exhaustion, sequential scans on large tables |
+| **HIGH** | 5-20x | Wrong index types, poor partitioning, missing covering indexes |
+| **MEDIUM-HIGH** | 2-5x | N+1 queries, inefficient pagination, RLS optimization |
+| **MEDIUM** | 1.5-3x | Redundant indexes, query plan instability |
+| **LOW-MEDIUM** | 1.2-2x | VACUUM tuning, configuration tweaks |
+| **LOW** | Incremental | Advanced patterns, edge cases |
+
+---
+
+## Reference Standards
+
+**Primary Sources:**
+
+- Official Postgres documentation
+- Supabase documentation
+- Postgres wiki
+- Established blogs (2ndQuadrant, Crunchy Data)
+
+**Format:**
+
+```markdown
+Reference:
+[Postgres Indexes](https://www.postgresql.org/docs/current/indexes.html)
+```
+
+---
+
+## Review Checklist
+
+Before submitting a reference:
+
+- [ ] Title is clear and action-oriented
+- [ ] Impact level matches the performance gain
+- [ ] impactDescription includes quantification
+- [ ] Explanation is concise (1-2 sentences)
+- [ ] Has at least 1 **Incorrect** SQL example
+- [ ] Has at least 1 **Correct** SQL example
+- [ ] SQL uses semantic naming
+- [ ] Comments explain _why_, not _what_
+- [ ] Trade-offs mentioned if applicable
+- [ ] Reference links included
+- [ ] `pnpm test` passes
diff --git a/.claude/skills/supabase-postgres-best-practices/references/_sections.md b/.claude/skills/supabase-postgres-best-practices/references/_sections.md
new file mode 100644
index 00000000..8ba57c23
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/_sections.md
@@ -0,0 +1,39 @@
+# Section Definitions
+
+This file defines the rule categories for Postgres best practices. Rules are automatically assigned to sections based on their filename prefix.
+
+Take the examples below as pure demonstrative. Replace each section with the actual rule categories for Postgres best practices.
+
+---
+
+## 1. Query Performance (query)
+**Impact:** CRITICAL
+**Description:** Slow queries, missing indexes, inefficient query plans. The most common source of Postgres performance issues.
+
+## 2. Connection Management (conn)
+**Impact:** CRITICAL
+**Description:** Connection pooling, limits, and serverless strategies. Critical for applications with high concurrency or serverless deployments.
+
+## 3. Security & RLS (security)
+**Impact:** CRITICAL
+**Description:** Row-Level Security policies, privilege management, and authentication patterns.
+
+## 4. Schema Design (schema)
+**Impact:** HIGH
+**Description:** Table design, index strategies, partitioning, and data type selection. Foundation for long-term performance.
+
+## 5. Concurrency & Locking (lock)
+**Impact:** MEDIUM-HIGH
+**Description:** Transaction management, isolation levels, deadlock prevention, and lock contention patterns.
+
+## 6. Data Access Patterns (data)
+**Impact:** MEDIUM
+**Description:** N+1 query elimination, batch operations, cursor-based pagination, and efficient data fetching.
+
+## 7. Monitoring & Diagnostics (monitor)
+**Impact:** LOW-MEDIUM
+**Description:** Using pg_stat_statements, EXPLAIN ANALYZE, metrics collection, and performance diagnostics.
+
+## 8. Advanced Features (advanced)
+**Impact:** LOW
+**Description:** Full-text search, JSONB optimization, PostGIS, extensions, and advanced Postgres features.
diff --git a/.claude/skills/supabase-postgres-best-practices/references/_template.md b/.claude/skills/supabase-postgres-best-practices/references/_template.md
new file mode 100644
index 00000000..91ace90e
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/_template.md
@@ -0,0 +1,34 @@
+---
+title: Clear, Action-Oriented Title (e.g., "Use Partial Indexes for Filtered Queries")
+impact: MEDIUM
+impactDescription: 5-20x query speedup for filtered queries
+tags: indexes, query-optimization, performance
+---
+
+## [Rule Title]
+
+[1-2 sentence explanation of the problem and why it matters. Focus on performance impact.]
+
+**Incorrect (describe the problem):**
+
+```sql
+-- Comment explaining what makes this slow/problematic
+CREATE INDEX users_email_idx ON users(email);
+
+SELECT * FROM users WHERE email = 'user@example.com' AND deleted_at IS NULL;
+-- This scans deleted records unnecessarily
+```
+
+**Correct (describe the solution):**
+
+```sql
+-- Comment explaining why this is better
+CREATE INDEX users_active_email_idx ON users(email) WHERE deleted_at IS NULL;
+
+SELECT * FROM users WHERE email = 'user@example.com' AND deleted_at IS NULL;
+-- Only indexes active users, 10x smaller index, faster queries
+```
+
+[Optional: Additional context, edge cases, or trade-offs]
+
+Reference: [Postgres Docs](https://www.postgresql.org/docs/current/)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/advanced-full-text-search.md b/.claude/skills/supabase-postgres-best-practices/references/advanced-full-text-search.md
new file mode 100644
index 00000000..582cbeaa
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/advanced-full-text-search.md
@@ -0,0 +1,55 @@
+---
+title: Use tsvector for Full-Text Search
+impact: MEDIUM
+impactDescription: 100x faster than LIKE, with ranking support
+tags: full-text-search, tsvector, gin, search
+---
+
+## Use tsvector for Full-Text Search
+
+LIKE with wildcards can't use indexes. Full-text search with tsvector is orders of magnitude faster.
+
+**Incorrect (LIKE pattern matching):**
+
+```sql
+-- Cannot use index, scans all rows
+select * from articles where content like '%postgresql%';
+
+-- Case-insensitive makes it worse
+select * from articles where lower(content) like '%postgresql%';
+```
+
+**Correct (full-text search with tsvector):**
+
+```sql
+-- Add tsvector column and index
+alter table articles add column search_vector tsvector
+  generated always as (to_tsvector('english', coalesce(title,'') || ' ' || coalesce(content,''))) stored;
+
+create index articles_search_idx on articles using gin (search_vector);
+
+-- Fast full-text search
+select * from articles
+where search_vector @@ to_tsquery('english', 'postgresql & performance');
+
+-- With ranking
+select *, ts_rank(search_vector, query) as rank
+from articles, to_tsquery('english', 'postgresql') query
+where search_vector @@ query
+order by rank desc;
+```
+
+Search multiple terms:
+
+```sql
+-- AND: both terms required
+to_tsquery('postgresql & performance')
+
+-- OR: either term
+to_tsquery('postgresql | mysql')
+
+-- Prefix matching
+to_tsquery('post:*')
+```
+
+Reference: [Full Text Search](https://supabase.com/docs/guides/database/full-text-search)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/advanced-jsonb-indexing.md b/.claude/skills/supabase-postgres-best-practices/references/advanced-jsonb-indexing.md
new file mode 100644
index 00000000..e3d261ea
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/advanced-jsonb-indexing.md
@@ -0,0 +1,49 @@
+---
+title: Index JSONB Columns for Efficient Querying
+impact: MEDIUM
+impactDescription: 10-100x faster JSONB queries with proper indexing
+tags: jsonb, gin, indexes, json
+---
+
+## Index JSONB Columns for Efficient Querying
+
+JSONB queries without indexes scan the entire table. Use GIN indexes for containment queries.
+
+**Incorrect (no index on JSONB):**
+
+```sql
+create table products (
+  id bigint primary key,
+  attributes jsonb
+);
+
+-- Full table scan for every query
+select * from products where attributes @> '{"color": "red"}';
+select * from products where attributes->>'brand' = 'Nike';
+```
+
+**Correct (GIN index for JSONB):**
+
+```sql
+-- GIN index for containment operators (@>, ?, ?&, ?|)
+create index products_attrs_gin on products using gin (attributes);
+
+-- Now containment queries use the index
+select * from products where attributes @> '{"color": "red"}';
+
+-- For specific key lookups, use expression index
+create index products_brand_idx on products ((attributes->>'brand'));
+select * from products where attributes->>'brand' = 'Nike';
+```
+
+Choose the right operator class:
+
+```sql
+-- jsonb_ops (default): supports all operators, larger index
+create index idx1 on products using gin (attributes);
+
+-- jsonb_path_ops: only @> operator, but 2-3x smaller index
+create index idx2 on products using gin (attributes jsonb_path_ops);
+```
+
+Reference: [JSONB Indexes](https://www.postgresql.org/docs/current/datatype-json.html#JSON-INDEXING)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/conn-idle-timeout.md b/.claude/skills/supabase-postgres-best-practices/references/conn-idle-timeout.md
new file mode 100644
index 00000000..40b9cc50
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/conn-idle-timeout.md
@@ -0,0 +1,46 @@
+---
+title: Configure Idle Connection Timeouts
+impact: HIGH
+impactDescription: Reclaim 30-50% of connection slots from idle clients
+tags: connections, timeout, idle, resource-management
+---
+
+## Configure Idle Connection Timeouts
+
+Idle connections waste resources. Configure timeouts to automatically reclaim them.
+
+**Incorrect (connections held indefinitely):**
+
+```sql
+-- No timeout configured
+show idle_in_transaction_session_timeout;  -- 0 (disabled)
+
+-- Connections stay open forever, even when idle
+select pid, state, state_change, query
+from pg_stat_activity
+where state = 'idle in transaction';
+-- Shows transactions idle for hours, holding locks
+```
+
+**Correct (automatic cleanup of idle connections):**
+
+```sql
+-- Terminate connections idle in transaction after 30 seconds
+alter system set idle_in_transaction_session_timeout = '30s';
+
+-- Terminate completely idle connections after 10 minutes
+alter system set idle_session_timeout = '10min';
+
+-- Reload configuration
+select pg_reload_conf();
+```
+
+For pooled connections, configure at the pooler level:
+
+```ini
+# pgbouncer.ini
+server_idle_timeout = 60
+client_idle_timeout = 300
+```
+
+Reference: [Connection Timeouts](https://www.postgresql.org/docs/current/runtime-config-client.html#GUC-IDLE-IN-TRANSACTION-SESSION-TIMEOUT)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/conn-limits.md b/.claude/skills/supabase-postgres-best-practices/references/conn-limits.md
new file mode 100644
index 00000000..cb3e400c
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/conn-limits.md
@@ -0,0 +1,44 @@
+---
+title: Set Appropriate Connection Limits
+impact: CRITICAL
+impactDescription: Prevent database crashes and memory exhaustion
+tags: connections, max-connections, limits, stability
+---
+
+## Set Appropriate Connection Limits
+
+Too many connections exhaust memory and degrade performance. Set limits based on available resources.
+
+**Incorrect (unlimited or excessive connections):**
+
+```sql
+-- Default max_connections = 100, but often increased blindly
+show max_connections;  -- 500 (way too high for 4GB RAM)
+
+-- Each connection uses 1-3MB RAM
+-- 500 connections * 2MB = 1GB just for connections!
+-- Out of memory errors under load
+```
+
+**Correct (calculate based on resources):**
+
+```sql
+-- Formula: max_connections = (RAM in MB / 5MB per connection) - reserved
+-- For 4GB RAM: (4096 / 5) - 10 = ~800 theoretical max
+-- But practically, 100-200 is better for query performance
+
+-- Recommended settings for 4GB RAM
+alter system set max_connections = 100;
+
+-- Also set work_mem appropriately
+-- work_mem * max_connections should not exceed 25% of RAM
+alter system set work_mem = '8MB';  -- 8MB * 100 = 800MB max
+```
+
+Monitor connection usage:
+
+```sql
+select count(*), state from pg_stat_activity group by state;
+```
+
+Reference: [Database Connections](https://supabase.com/docs/guides/platform/performance#connection-management)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/conn-pooling.md b/.claude/skills/supabase-postgres-best-practices/references/conn-pooling.md
new file mode 100644
index 00000000..e2ebd581
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/conn-pooling.md
@@ -0,0 +1,41 @@
+---
+title: Use Connection Pooling for All Applications
+impact: CRITICAL
+impactDescription: Handle 10-100x more concurrent users
+tags: connection-pooling, pgbouncer, performance, scalability
+---
+
+## Use Connection Pooling for All Applications
+
+Postgres connections are expensive (1-3MB RAM each). Without pooling, applications exhaust connections under load.
+
+**Incorrect (new connection per request):**
+
+```sql
+-- Each request creates a new connection
+-- Application code: db.connect() per request
+-- Result: 500 concurrent users = 500 connections = crashed database
+
+-- Check current connections
+select count(*) from pg_stat_activity;  -- 487 connections!
+```
+
+**Correct (connection pooling):**
+
+```sql
+-- Use a pooler like PgBouncer between app and database
+-- Application connects to pooler, pooler reuses a small pool to Postgres
+
+-- Configure pool_size based on: (CPU cores * 2) + spindle_count
+-- Example for 4 cores: pool_size = 10
+
+-- Result: 500 concurrent users share 10 actual connections
+select count(*) from pg_stat_activity;  -- 10 connections
+```
+
+Pool modes:
+
+- **Transaction mode**: connection returned after each transaction (best for most apps)
+- **Session mode**: connection held for entire session (needed for prepared statements, temp tables)
+
+Reference: [Connection Pooling](https://supabase.com/docs/guides/database/connecting-to-postgres#connection-pooler)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/conn-prepared-statements.md b/.claude/skills/supabase-postgres-best-practices/references/conn-prepared-statements.md
new file mode 100644
index 00000000..555547d8
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/conn-prepared-statements.md
@@ -0,0 +1,46 @@
+---
+title: Use Prepared Statements Correctly with Pooling
+impact: HIGH
+impactDescription: Avoid prepared statement conflicts in pooled environments
+tags: prepared-statements, connection-pooling, transaction-mode
+---
+
+## Use Prepared Statements Correctly with Pooling
+
+Prepared statements are tied to individual database connections. In transaction-mode pooling, connections are shared, causing conflicts.
+
+**Incorrect (named prepared statements with transaction pooling):**
+
+```sql
+-- Named prepared statement
+prepare get_user as select * from users where id = $1;
+
+-- In transaction mode pooling, next request may get different connection
+execute get_user(123);
+-- ERROR: prepared statement "get_user" does not exist
+```
+
+**Correct (use unnamed statements or session mode):**
+
+```sql
+-- Option 1: Use unnamed prepared statements (most ORMs do this automatically)
+-- The query is prepared and executed in a single protocol message
+
+-- Option 2: Deallocate after use in transaction mode
+prepare get_user as select * from users where id = $1;
+execute get_user(123);
+deallocate get_user;
+
+-- Option 3: Use session mode pooling (port 5432 vs 6543)
+-- Connection is held for entire session, prepared statements persist
+```
+
+Check your driver settings:
+
+```sql
+-- Many drivers use prepared statements by default
+-- Node.js pg: { prepare: false } to disable
+-- JDBC: prepareThreshold=0 to disable
+```
+
+Reference: [Prepared Statements with Pooling](https://supabase.com/docs/guides/database/connecting-to-postgres#connection-pool-modes)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/data-batch-inserts.md b/.claude/skills/supabase-postgres-best-practices/references/data-batch-inserts.md
new file mode 100644
index 00000000..997947cb
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/data-batch-inserts.md
@@ -0,0 +1,54 @@
+---
+title: Batch INSERT Statements for Bulk Data
+impact: MEDIUM
+impactDescription: 10-50x faster bulk inserts
+tags: batch, insert, bulk, performance, copy
+---
+
+## Batch INSERT Statements for Bulk Data
+
+Individual INSERT statements have high overhead. Batch multiple rows in single statements or use COPY.
+
+**Incorrect (individual inserts):**
+
+```sql
+-- Each insert is a separate transaction and round trip
+insert into events (user_id, action) values (1, 'click');
+insert into events (user_id, action) values (1, 'view');
+insert into events (user_id, action) values (2, 'click');
+-- ... 1000 more individual inserts
+
+-- 1000 inserts = 1000 round trips = slow
+```
+
+**Correct (batch insert):**
+
+```sql
+-- Multiple rows in single statement
+insert into events (user_id, action) values
+  (1, 'click'),
+  (1, 'view'),
+  (2, 'click'),
+  -- ... up to ~1000 rows per batch
+  (999, 'view');
+
+-- One round trip for 1000 rows
+```
+
+For large imports, use COPY:
+
+```sql
+-- COPY is fastest for bulk loading
+copy events (user_id, action, created_at)
+from '/path/to/data.csv'
+with (format csv, header true);
+
+-- Or from stdin in application
+copy events (user_id, action) from stdin with (format csv);
+1,click
+1,view
+2,click
+\.
+```
+
+Reference: [COPY](https://www.postgresql.org/docs/current/sql-copy.html)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/data-n-plus-one.md b/.claude/skills/supabase-postgres-best-practices/references/data-n-plus-one.md
new file mode 100644
index 00000000..2109186f
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/data-n-plus-one.md
@@ -0,0 +1,53 @@
+---
+title: Eliminate N+1 Queries with Batch Loading
+impact: MEDIUM-HIGH
+impactDescription: 10-100x fewer database round trips
+tags: n-plus-one, batch, performance, queries
+---
+
+## Eliminate N+1 Queries with Batch Loading
+
+N+1 queries execute one query per item in a loop. Batch them into a single query using arrays or JOINs.
+
+**Incorrect (N+1 queries):**
+
+```sql
+-- First query: get all users
+select id from users where active = true;  -- Returns 100 IDs
+
+-- Then N queries, one per user
+select * from orders where user_id = 1;
+select * from orders where user_id = 2;
+select * from orders where user_id = 3;
+-- ... 97 more queries!
+
+-- Total: 101 round trips to database
+```
+
+**Correct (single batch query):**
+
+```sql
+-- Collect IDs and query once with ANY
+select * from orders where user_id = any(array[1, 2, 3, ...]);
+
+-- Or use JOIN instead of loop
+select u.id, u.name, o.*
+from users u
+left join orders o on o.user_id = u.id
+where u.active = true;
+
+-- Total: 1 round trip
+```
+
+Application pattern:
+
+```sql
+-- Instead of looping in application code:
+-- for user in users: db.query("SELECT * FROM orders WHERE user_id = $1", user.id)
+
+-- Pass array parameter:
+select * from orders where user_id = any($1::bigint[]);
+-- Application passes: [1, 2, 3, 4, 5, ...]
+```
+
+Reference: [N+1 Query Problem](https://supabase.com/docs/guides/database/query-optimization)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/data-pagination.md b/.claude/skills/supabase-postgres-best-practices/references/data-pagination.md
new file mode 100644
index 00000000..633d8393
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/data-pagination.md
@@ -0,0 +1,50 @@
+---
+title: Use Cursor-Based Pagination Instead of OFFSET
+impact: MEDIUM-HIGH
+impactDescription: Consistent O(1) performance regardless of page depth
+tags: pagination, cursor, keyset, offset, performance
+---
+
+## Use Cursor-Based Pagination Instead of OFFSET
+
+OFFSET-based pagination scans all skipped rows, getting slower on deeper pages. Cursor pagination is O(1).
+
+**Incorrect (OFFSET pagination):**
+
+```sql
+-- Page 1: scans 20 rows
+select * from products order by id limit 20 offset 0;
+
+-- Page 100: scans 2000 rows to skip 1980
+select * from products order by id limit 20 offset 1980;
+
+-- Page 10000: scans 200,000 rows!
+select * from products order by id limit 20 offset 199980;
+```
+
+**Correct (cursor/keyset pagination):**
+
+```sql
+-- Page 1: get first 20
+select * from products order by id limit 20;
+-- Application stores last_id = 20
+
+-- Page 2: start after last ID
+select * from products where id > 20 order by id limit 20;
+-- Uses index, always fast regardless of page depth
+
+-- Page 10000: same speed as page 1
+select * from products where id > 199980 order by id limit 20;
+```
+
+For multi-column sorting:
+
+```sql
+-- Cursor must include all sort columns
+select * from products
+where (created_at, id) > ('2024-01-15 10:00:00', 12345)
+order by created_at, id
+limit 20;
+```
+
+Reference: [Pagination](https://supabase.com/docs/guides/database/pagination)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/data-upsert.md b/.claude/skills/supabase-postgres-best-practices/references/data-upsert.md
new file mode 100644
index 00000000..bc95e230
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/data-upsert.md
@@ -0,0 +1,50 @@
+---
+title: Use UPSERT for Insert-or-Update Operations
+impact: MEDIUM
+impactDescription: Atomic operation, eliminates race conditions
+tags: upsert, on-conflict, insert, update
+---
+
+## Use UPSERT for Insert-or-Update Operations
+
+Using separate SELECT-then-INSERT/UPDATE creates race conditions. Use INSERT ... ON CONFLICT for atomic upserts.
+
+**Incorrect (check-then-insert race condition):**
+
+```sql
+-- Race condition: two requests check simultaneously
+select * from settings where user_id = 123 and key = 'theme';
+-- Both find nothing
+
+-- Both try to insert
+insert into settings (user_id, key, value) values (123, 'theme', 'dark');
+-- One succeeds, one fails with duplicate key error!
+```
+
+**Correct (atomic UPSERT):**
+
+```sql
+-- Single atomic operation
+insert into settings (user_id, key, value)
+values (123, 'theme', 'dark')
+on conflict (user_id, key)
+do update set value = excluded.value, updated_at = now();
+
+-- Returns the inserted/updated row
+insert into settings (user_id, key, value)
+values (123, 'theme', 'dark')
+on conflict (user_id, key)
+do update set value = excluded.value
+returning *;
+```
+
+Insert-or-ignore pattern:
+
+```sql
+-- Insert only if not exists (no update)
+insert into page_views (page_id, user_id)
+values (1, 123)
+on conflict (page_id, user_id) do nothing;
+```
+
+Reference: [INSERT ON CONFLICT](https://www.postgresql.org/docs/current/sql-insert.html#SQL-ON-CONFLICT)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/lock-advisory.md b/.claude/skills/supabase-postgres-best-practices/references/lock-advisory.md
new file mode 100644
index 00000000..572eaf0d
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/lock-advisory.md
@@ -0,0 +1,56 @@
+---
+title: Use Advisory Locks for Application-Level Locking
+impact: MEDIUM
+impactDescription: Efficient coordination without row-level lock overhead
+tags: advisory-locks, coordination, application-locks
+---
+
+## Use Advisory Locks for Application-Level Locking
+
+Advisory locks provide application-level coordination without requiring database rows to lock.
+
+**Incorrect (creating rows just for locking):**
+
+```sql
+-- Creating dummy rows to lock on
+create table resource_locks (
+  resource_name text primary key
+);
+
+insert into resource_locks values ('report_generator');
+
+-- Lock by selecting the row
+select * from resource_locks where resource_name = 'report_generator' for update;
+```
+
+**Correct (advisory locks):**
+
+```sql
+-- Session-level advisory lock (released on disconnect or unlock)
+select pg_advisory_lock(hashtext('report_generator'));
+-- ... do exclusive work ...
+select pg_advisory_unlock(hashtext('report_generator'));
+
+-- Transaction-level lock (released on commit/rollback)
+begin;
+select pg_advisory_xact_lock(hashtext('daily_report'));
+-- ... do work ...
+commit;  -- Lock automatically released
+```
+
+Try-lock for non-blocking operations:
+
+```sql
+-- Returns immediately with true/false instead of waiting
+select pg_try_advisory_lock(hashtext('resource_name'));
+
+-- Use in application
+if (acquired) {
+  -- Do work
+  select pg_advisory_unlock(hashtext('resource_name'));
+} else {
+  -- Skip or retry later
+}
+```
+
+Reference: [Advisory Locks](https://www.postgresql.org/docs/current/explicit-locking.html#ADVISORY-LOCKS)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/lock-deadlock-prevention.md b/.claude/skills/supabase-postgres-best-practices/references/lock-deadlock-prevention.md
new file mode 100644
index 00000000..974da5ed
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/lock-deadlock-prevention.md
@@ -0,0 +1,68 @@
+---
+title: Prevent Deadlocks with Consistent Lock Ordering
+impact: MEDIUM-HIGH
+impactDescription: Eliminate deadlock errors, improve reliability
+tags: deadlocks, locking, transactions, ordering
+---
+
+## Prevent Deadlocks with Consistent Lock Ordering
+
+Deadlocks occur when transactions lock resources in different orders. Always
+acquire locks in a consistent order.
+
+**Incorrect (inconsistent lock ordering):**
+
+```sql
+-- Transaction A                    -- Transaction B
+begin;                              begin;
+update accounts                     update accounts
+set balance = balance - 100         set balance = balance - 50
+where id = 1;                       where id = 2;  -- B locks row 2
+
+update accounts                     update accounts
+set balance = balance + 100         set balance = balance + 50
+where id = 2;  -- A waits for B     where id = 1;  -- B waits for A
+
+-- DEADLOCK! Both waiting for each other
+```
+
+**Correct (lock rows in consistent order first):**
+
+```sql
+-- Explicitly acquire locks in ID order before updating
+begin;
+select * from accounts where id in (1, 2) order by id for update;
+
+-- Now perform updates in any order - locks already held
+update accounts set balance = balance - 100 where id = 1;
+update accounts set balance = balance + 100 where id = 2;
+commit;
+```
+
+Alternative: use a single statement to update atomically:
+
+```sql
+-- Single statement acquires all locks atomically
+begin;
+update accounts
+set balance = balance + case id
+  when 1 then -100
+  when 2 then 100
+end
+where id in (1, 2);
+commit;
+```
+
+Detect deadlocks in logs:
+
+```sql
+-- Check for recent deadlocks
+select * from pg_stat_database where deadlocks > 0;
+
+-- Enable deadlock logging
+set log_lock_waits = on;
+set deadlock_timeout = '1s';
+```
+
+Reference:
+[Deadlocks](https://www.postgresql.org/docs/current/explicit-locking.html#LOCKING-DEADLOCKS)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/lock-short-transactions.md b/.claude/skills/supabase-postgres-best-practices/references/lock-short-transactions.md
new file mode 100644
index 00000000..e6b8ef26
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/lock-short-transactions.md
@@ -0,0 +1,50 @@
+---
+title: Keep Transactions Short to Reduce Lock Contention
+impact: MEDIUM-HIGH
+impactDescription: 3-5x throughput improvement, fewer deadlocks
+tags: transactions, locking, contention, performance
+---
+
+## Keep Transactions Short to Reduce Lock Contention
+
+Long-running transactions hold locks that block other queries. Keep transactions as short as possible.
+
+**Incorrect (long transaction with external calls):**
+
+```sql
+begin;
+select * from orders where id = 1 for update;  -- Lock acquired
+
+-- Application makes HTTP call to payment API (2-5 seconds)
+-- Other queries on this row are blocked!
+
+update orders set status = 'paid' where id = 1;
+commit;  -- Lock held for entire duration
+```
+
+**Correct (minimal transaction scope):**
+
+```sql
+-- Validate data and call APIs outside transaction
+-- Application: response = await paymentAPI.charge(...)
+
+-- Only hold lock for the actual update
+begin;
+update orders
+set status = 'paid', payment_id = $1
+where id = $2 and status = 'pending'
+returning *;
+commit;  -- Lock held for milliseconds
+```
+
+Use `statement_timeout` to prevent runaway transactions:
+
+```sql
+-- Abort queries running longer than 30 seconds
+set statement_timeout = '30s';
+
+-- Or per-session
+set local statement_timeout = '5s';
+```
+
+Reference: [Transaction Management](https://www.postgresql.org/docs/current/tutorial-transactions.html)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/lock-skip-locked.md b/.claude/skills/supabase-postgres-best-practices/references/lock-skip-locked.md
new file mode 100644
index 00000000..77bdbb97
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/lock-skip-locked.md
@@ -0,0 +1,54 @@
+---
+title: Use SKIP LOCKED for Non-Blocking Queue Processing
+impact: MEDIUM-HIGH
+impactDescription: 10x throughput for worker queues
+tags: skip-locked, queue, workers, concurrency
+---
+
+## Use SKIP LOCKED for Non-Blocking Queue Processing
+
+When multiple workers process a queue, SKIP LOCKED allows workers to process different rows without waiting.
+
+**Incorrect (workers block each other):**
+
+```sql
+-- Worker 1 and Worker 2 both try to get next job
+begin;
+select * from jobs where status = 'pending' order by created_at limit 1 for update;
+-- Worker 2 waits for Worker 1's lock to release!
+```
+
+**Correct (SKIP LOCKED for parallel processing):**
+
+```sql
+-- Each worker skips locked rows and gets the next available
+begin;
+select * from jobs
+where status = 'pending'
+order by created_at
+limit 1
+for update skip locked;
+
+-- Worker 1 gets job 1, Worker 2 gets job 2 (no waiting)
+
+update jobs set status = 'processing' where id = $1;
+commit;
+```
+
+Complete queue pattern:
+
+```sql
+-- Atomic claim-and-update in one statement
+update jobs
+set status = 'processing', worker_id = $1, started_at = now()
+where id = (
+  select id from jobs
+  where status = 'pending'
+  order by created_at
+  limit 1
+  for update skip locked
+)
+returning *;
+```
+
+Reference: [SELECT FOR UPDATE SKIP LOCKED](https://www.postgresql.org/docs/current/sql-select.html#SQL-FOR-UPDATE-SHARE)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/monitor-explain-analyze.md b/.claude/skills/supabase-postgres-best-practices/references/monitor-explain-analyze.md
new file mode 100644
index 00000000..542978c3
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/monitor-explain-analyze.md
@@ -0,0 +1,45 @@
+---
+title: Use EXPLAIN ANALYZE to Diagnose Slow Queries
+impact: LOW-MEDIUM
+impactDescription: Identify exact bottlenecks in query execution
+tags: explain, analyze, diagnostics, query-plan
+---
+
+## Use EXPLAIN ANALYZE to Diagnose Slow Queries
+
+EXPLAIN ANALYZE executes the query and shows actual timings, revealing the true performance bottlenecks.
+
+**Incorrect (guessing at performance issues):**
+
+```sql
+-- Query is slow, but why?
+select * from orders where customer_id = 123 and status = 'pending';
+-- "It must be missing an index" - but which one?
+```
+
+**Correct (use EXPLAIN ANALYZE):**
+
+```sql
+explain (analyze, buffers, format text)
+select * from orders where customer_id = 123 and status = 'pending';
+
+-- Output reveals the issue:
+-- Seq Scan on orders (cost=0.00..25000.00 rows=50 width=100) (actual time=0.015..450.123 rows=50 loops=1)
+--   Filter: ((customer_id = 123) AND (status = 'pending'::text))
+--   Rows Removed by Filter: 999950
+--   Buffers: shared hit=5000 read=15000
+-- Planning Time: 0.150 ms
+-- Execution Time: 450.500 ms
+```
+
+Key things to look for:
+
+```sql
+-- Seq Scan on large tables = missing index
+-- Rows Removed by Filter = poor selectivity or missing index
+-- Buffers: read >> hit = data not cached, needs more memory
+-- Nested Loop with high loops = consider different join strategy
+-- Sort Method: external merge = work_mem too low
+```
+
+Reference: [EXPLAIN](https://supabase.com/docs/guides/database/inspect)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/monitor-pg-stat-statements.md b/.claude/skills/supabase-postgres-best-practices/references/monitor-pg-stat-statements.md
new file mode 100644
index 00000000..d7e82f1a
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/monitor-pg-stat-statements.md
@@ -0,0 +1,55 @@
+---
+title: Enable pg_stat_statements for Query Analysis
+impact: LOW-MEDIUM
+impactDescription: Identify top resource-consuming queries
+tags: pg-stat-statements, monitoring, statistics, performance
+---
+
+## Enable pg_stat_statements for Query Analysis
+
+pg_stat_statements tracks execution statistics for all queries, helping identify slow and frequent queries.
+
+**Incorrect (no visibility into query patterns):**
+
+```sql
+-- Database is slow, but which queries are the problem?
+-- No way to know without pg_stat_statements
+```
+
+**Correct (enable and query pg_stat_statements):**
+
+```sql
+-- Enable the extension
+create extension if not exists pg_stat_statements;
+
+-- Find slowest queries by total time
+select
+  calls,
+  round(total_exec_time::numeric, 2) as total_time_ms,
+  round(mean_exec_time::numeric, 2) as mean_time_ms,
+  query
+from pg_stat_statements
+order by total_exec_time desc
+limit 10;
+
+-- Find most frequent queries
+select calls, query
+from pg_stat_statements
+order by calls desc
+limit 10;
+
+-- Reset statistics after optimization
+select pg_stat_statements_reset();
+```
+
+Key metrics to monitor:
+
+```sql
+-- Queries with high mean time (candidates for optimization)
+select query, mean_exec_time, calls
+from pg_stat_statements
+where mean_exec_time > 100  -- > 100ms average
+order by mean_exec_time desc;
+```
+
+Reference: [pg_stat_statements](https://supabase.com/docs/guides/database/extensions/pg_stat_statements)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/monitor-vacuum-analyze.md b/.claude/skills/supabase-postgres-best-practices/references/monitor-vacuum-analyze.md
new file mode 100644
index 00000000..e0e8ea0b
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/monitor-vacuum-analyze.md
@@ -0,0 +1,55 @@
+---
+title: Maintain Table Statistics with VACUUM and ANALYZE
+impact: MEDIUM
+impactDescription: 2-10x better query plans with accurate statistics
+tags: vacuum, analyze, statistics, maintenance, autovacuum
+---
+
+## Maintain Table Statistics with VACUUM and ANALYZE
+
+Outdated statistics cause the query planner to make poor decisions. VACUUM reclaims space, ANALYZE updates statistics.
+
+**Incorrect (stale statistics):**
+
+```sql
+-- Table has 1M rows but stats say 1000
+-- Query planner chooses wrong strategy
+explain select * from orders where status = 'pending';
+-- Shows: Seq Scan (because stats show small table)
+-- Actually: Index Scan would be much faster
+```
+
+**Correct (maintain fresh statistics):**
+
+```sql
+-- Manually analyze after large data changes
+analyze orders;
+
+-- Analyze specific columns used in WHERE clauses
+analyze orders (status, created_at);
+
+-- Check when tables were last analyzed
+select
+  relname,
+  last_vacuum,
+  last_autovacuum,
+  last_analyze,
+  last_autoanalyze
+from pg_stat_user_tables
+order by last_analyze nulls first;
+```
+
+Autovacuum tuning for busy tables:
+
+```sql
+-- Increase frequency for high-churn tables
+alter table orders set (
+  autovacuum_vacuum_scale_factor = 0.05,     -- Vacuum at 5% dead tuples (default 20%)
+  autovacuum_analyze_scale_factor = 0.02     -- Analyze at 2% changes (default 10%)
+);
+
+-- Check autovacuum status
+select * from pg_stat_progress_vacuum;
+```
+
+Reference: [VACUUM](https://supabase.com/docs/guides/database/database-size#vacuum-operations)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/query-composite-indexes.md b/.claude/skills/supabase-postgres-best-practices/references/query-composite-indexes.md
new file mode 100644
index 00000000..fea64523
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/query-composite-indexes.md
@@ -0,0 +1,44 @@
+---
+title: Create Composite Indexes for Multi-Column Queries
+impact: HIGH
+impactDescription: 5-10x faster multi-column queries
+tags: indexes, composite-index, multi-column, query-optimization
+---
+
+## Create Composite Indexes for Multi-Column Queries
+
+When queries filter on multiple columns, a composite index is more efficient than separate single-column indexes.
+
+**Incorrect (separate indexes require bitmap scan):**
+
+```sql
+-- Two separate indexes
+create index orders_status_idx on orders (status);
+create index orders_created_idx on orders (created_at);
+
+-- Query must combine both indexes (slower)
+select * from orders where status = 'pending' and created_at > '2024-01-01';
+```
+
+**Correct (composite index):**
+
+```sql
+-- Single composite index (leftmost column first for equality checks)
+create index orders_status_created_idx on orders (status, created_at);
+
+-- Query uses one efficient index scan
+select * from orders where status = 'pending' and created_at > '2024-01-01';
+```
+
+**Column order matters** - place equality columns first, range columns last:
+
+```sql
+-- Good: status (=) before created_at (>)
+create index idx on orders (status, created_at);
+
+-- Works for: WHERE status = 'pending'
+-- Works for: WHERE status = 'pending' AND created_at > '2024-01-01'
+-- Does NOT work for: WHERE created_at > '2024-01-01' (leftmost prefix rule)
+```
+
+Reference: [Multicolumn Indexes](https://www.postgresql.org/docs/current/indexes-multicolumn.html)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/query-covering-indexes.md b/.claude/skills/supabase-postgres-best-practices/references/query-covering-indexes.md
new file mode 100644
index 00000000..9d2a4947
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/query-covering-indexes.md
@@ -0,0 +1,40 @@
+---
+title: Use Covering Indexes to Avoid Table Lookups
+impact: MEDIUM-HIGH
+impactDescription: 2-5x faster queries by eliminating heap fetches
+tags: indexes, covering-index, include, index-only-scan
+---
+
+## Use Covering Indexes to Avoid Table Lookups
+
+Covering indexes include all columns needed by a query, enabling index-only scans that skip the table entirely.
+
+**Incorrect (index scan + heap fetch):**
+
+```sql
+create index users_email_idx on users (email);
+
+-- Must fetch name and created_at from table heap
+select email, name, created_at from users where email = 'user@example.com';
+```
+
+**Correct (index-only scan with INCLUDE):**
+
+```sql
+-- Include non-searchable columns in the index
+create index users_email_idx on users (email) include (name, created_at);
+
+-- All columns served from index, no table access needed
+select email, name, created_at from users where email = 'user@example.com';
+```
+
+Use INCLUDE for columns you SELECT but don't filter on:
+
+```sql
+-- Searching by status, but also need customer_id and total
+create index orders_status_idx on orders (status) include (customer_id, total);
+
+select status, customer_id, total from orders where status = 'shipped';
+```
+
+Reference: [Index-Only Scans](https://www.postgresql.org/docs/current/indexes-index-only-scans.html)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/query-index-types.md b/.claude/skills/supabase-postgres-best-practices/references/query-index-types.md
new file mode 100644
index 00000000..93b32590
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/query-index-types.md
@@ -0,0 +1,48 @@
+---
+title: Choose the Right Index Type for Your Data
+impact: HIGH
+impactDescription: 10-100x improvement with correct index type
+tags: indexes, btree, gin, gist, brin, hash, index-types
+---
+
+## Choose the Right Index Type for Your Data
+
+Different index types excel at different query patterns. The default B-tree isn't always optimal.
+
+**Incorrect (B-tree for JSONB containment):**
+
+```sql
+-- B-tree cannot optimize containment operators
+create index products_attrs_idx on products (attributes);
+select * from products where attributes @> '{"color": "red"}';
+-- Full table scan - B-tree doesn't support @> operator
+```
+
+**Correct (GIN for JSONB):**
+
+```sql
+-- GIN supports @>, ?, ?&, ?| operators
+create index products_attrs_idx on products using gin (attributes);
+select * from products where attributes @> '{"color": "red"}';
+```
+
+Index type guide:
+
+```sql
+-- B-tree (default): =, <, >, BETWEEN, IN, IS NULL
+create index users_created_idx on users (created_at);
+
+-- GIN: arrays, JSONB, full-text search
+create index posts_tags_idx on posts using gin (tags);
+
+-- GiST: geometric data, range types, nearest-neighbor (KNN) queries
+create index locations_idx on places using gist (location);
+
+-- BRIN: large time-series tables (10-100x smaller)
+create index events_time_idx on events using brin (created_at);
+
+-- Hash: equality-only (slightly faster than B-tree for =)
+create index sessions_token_idx on sessions using hash (token);
+```
+
+Reference: [Index Types](https://www.postgresql.org/docs/current/indexes-types.html)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/query-missing-indexes.md b/.claude/skills/supabase-postgres-best-practices/references/query-missing-indexes.md
new file mode 100644
index 00000000..e6daace7
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/query-missing-indexes.md
@@ -0,0 +1,43 @@
+---
+title: Add Indexes on WHERE and JOIN Columns
+impact: CRITICAL
+impactDescription: 100-1000x faster queries on large tables
+tags: indexes, performance, sequential-scan, query-optimization
+---
+
+## Add Indexes on WHERE and JOIN Columns
+
+Queries filtering or joining on unindexed columns cause full table scans, which become exponentially slower as tables grow.
+
+**Incorrect (sequential scan on large table):**
+
+```sql
+-- No index on customer_id causes full table scan
+select * from orders where customer_id = 123;
+
+-- EXPLAIN shows: Seq Scan on orders (cost=0.00..25000.00 rows=100 width=85)
+```
+
+**Correct (index scan):**
+
+```sql
+-- Create index on frequently filtered column
+create index orders_customer_id_idx on orders (customer_id);
+
+select * from orders where customer_id = 123;
+
+-- EXPLAIN shows: Index Scan using orders_customer_id_idx (cost=0.42..8.44 rows=100 width=85)
+```
+
+For JOIN columns, always index the foreign key side:
+
+```sql
+-- Index the referencing column
+create index orders_customer_id_idx on orders (customer_id);
+
+select c.name, o.total
+from customers c
+join orders o on o.customer_id = c.id;
+```
+
+Reference: [Query Optimization](https://supabase.com/docs/guides/database/query-optimization)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/query-partial-indexes.md b/.claude/skills/supabase-postgres-best-practices/references/query-partial-indexes.md
new file mode 100644
index 00000000..3e61a341
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/query-partial-indexes.md
@@ -0,0 +1,45 @@
+---
+title: Use Partial Indexes for Filtered Queries
+impact: HIGH
+impactDescription: 5-20x smaller indexes, faster writes and queries
+tags: indexes, partial-index, query-optimization, storage
+---
+
+## Use Partial Indexes for Filtered Queries
+
+Partial indexes only include rows matching a WHERE condition, making them smaller and faster when queries consistently filter on the same condition.
+
+**Incorrect (full index includes irrelevant rows):**
+
+```sql
+-- Index includes all rows, even soft-deleted ones
+create index users_email_idx on users (email);
+
+-- Query always filters active users
+select * from users where email = 'user@example.com' and deleted_at is null;
+```
+
+**Correct (partial index matches query filter):**
+
+```sql
+-- Index only includes active users
+create index users_active_email_idx on users (email)
+where deleted_at is null;
+
+-- Query uses the smaller, faster index
+select * from users where email = 'user@example.com' and deleted_at is null;
+```
+
+Common use cases for partial indexes:
+
+```sql
+-- Only pending orders (status rarely changes once completed)
+create index orders_pending_idx on orders (created_at)
+where status = 'pending';
+
+-- Only non-null values
+create index products_sku_idx on products (sku)
+where sku is not null;
+```
+
+Reference: [Partial Indexes](https://www.postgresql.org/docs/current/indexes-partial.html)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/schema-constraints.md b/.claude/skills/supabase-postgres-best-practices/references/schema-constraints.md
new file mode 100644
index 00000000..1d2ef8f9
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/schema-constraints.md
@@ -0,0 +1,80 @@
+---
+title: Add Constraints Safely in Migrations
+impact: HIGH
+impactDescription: Prevents migration failures and enables idempotent schema changes
+tags: constraints, migrations, schema, alter-table
+---
+
+## Add Constraints Safely in Migrations
+
+PostgreSQL does not support `ADD CONSTRAINT IF NOT EXISTS`. Migrations using this syntax will fail.
+
+**Incorrect (causes syntax error):**
+
+```sql
+-- ERROR: syntax error at or near "not" (SQLSTATE 42601)
+alter table public.profiles
+add constraint if not exists profiles_birthchart_id_unique unique (birthchart_id);
+```
+
+**Correct (idempotent constraint creation):**
+
+```sql
+-- Use DO block to check before adding
+do $$
+begin
+  if not exists (
+    select 1 from pg_constraint
+    where conname = 'profiles_birthchart_id_unique'
+    and conrelid = 'public.profiles'::regclass
+  ) then
+    alter table public.profiles
+    add constraint profiles_birthchart_id_unique unique (birthchart_id);
+  end if;
+end $$;
+```
+
+For all constraint types:
+
+```sql
+-- Check constraints
+do $$
+begin
+  if not exists (
+    select 1 from pg_constraint
+    where conname = 'check_age_positive'
+  ) then
+    alter table users add constraint check_age_positive check (age > 0);
+  end if;
+end $$;
+
+-- Foreign keys
+do $$
+begin
+  if not exists (
+    select 1 from pg_constraint
+    where conname = 'profiles_birthchart_id_fkey'
+  ) then
+    alter table profiles
+    add constraint profiles_birthchart_id_fkey
+    foreign key (birthchart_id) references birthcharts(id);
+  end if;
+end $$;
+```
+
+Check if constraint exists:
+
+```sql
+-- Query to check constraint existence
+select conname, contype, pg_get_constraintdef(oid)
+from pg_constraint
+where conrelid = 'public.profiles'::regclass;
+
+-- contype values:
+-- 'p' = PRIMARY KEY
+-- 'f' = FOREIGN KEY
+-- 'u' = UNIQUE
+-- 'c' = CHECK
+```
+
+Reference: [Constraints](https://www.postgresql.org/docs/current/ddl-constraints.html)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/schema-data-types.md b/.claude/skills/supabase-postgres-best-practices/references/schema-data-types.md
new file mode 100644
index 00000000..f253a581
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/schema-data-types.md
@@ -0,0 +1,46 @@
+---
+title: Choose Appropriate Data Types
+impact: HIGH
+impactDescription: 50% storage reduction, faster comparisons
+tags: data-types, schema, storage, performance
+---
+
+## Choose Appropriate Data Types
+
+Using the right data types reduces storage, improves query performance, and prevents bugs.
+
+**Incorrect (wrong data types):**
+
+```sql
+create table users (
+  id int,                    -- Will overflow at 2.1 billion
+  email varchar(255),        -- Unnecessary length limit
+  created_at timestamp,      -- Missing timezone info
+  is_active varchar(5),      -- String for boolean
+  price varchar(20)          -- String for numeric
+);
+```
+
+**Correct (appropriate data types):**
+
+```sql
+create table users (
+  id bigint generated always as identity primary key,  -- 9 quintillion max
+  email text,                     -- No artificial limit, same performance as varchar
+  created_at timestamptz,         -- Always store timezone-aware timestamps
+  is_active boolean default true, -- 1 byte vs variable string length
+  price numeric(10,2)             -- Exact decimal arithmetic
+);
+```
+
+Key guidelines:
+
+```sql
+-- IDs: use bigint, not int (future-proofing)
+-- Strings: use text, not varchar(n) unless constraint needed
+-- Time: use timestamptz, not timestamp
+-- Money: use numeric, not float (precision matters)
+-- Enums: use text with check constraint or create enum type
+```
+
+Reference: [Data Types](https://www.postgresql.org/docs/current/datatype.html)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/schema-foreign-key-indexes.md b/.claude/skills/supabase-postgres-best-practices/references/schema-foreign-key-indexes.md
new file mode 100644
index 00000000..6c3d6ff6
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/schema-foreign-key-indexes.md
@@ -0,0 +1,59 @@
+---
+title: Index Foreign Key Columns
+impact: HIGH
+impactDescription: 10-100x faster JOINs and CASCADE operations
+tags: foreign-key, indexes, joins, schema
+---
+
+## Index Foreign Key Columns
+
+Postgres does not automatically index foreign key columns. Missing indexes cause slow JOINs and CASCADE operations.
+
+**Incorrect (unindexed foreign key):**
+
+```sql
+create table orders (
+  id bigint generated always as identity primary key,
+  customer_id bigint references customers(id) on delete cascade,
+  total numeric(10,2)
+);
+
+-- No index on customer_id!
+-- JOINs and ON DELETE CASCADE both require full table scan
+select * from orders where customer_id = 123;  -- Seq Scan
+delete from customers where id = 123;          -- Locks table, scans all orders
+```
+
+**Correct (indexed foreign key):**
+
+```sql
+create table orders (
+  id bigint generated always as identity primary key,
+  customer_id bigint references customers(id) on delete cascade,
+  total numeric(10,2)
+);
+
+-- Always index the FK column
+create index orders_customer_id_idx on orders (customer_id);
+
+-- Now JOINs and cascades are fast
+select * from orders where customer_id = 123;  -- Index Scan
+delete from customers where id = 123;          -- Uses index, fast cascade
+```
+
+Find missing FK indexes:
+
+```sql
+select
+  conrelid::regclass as table_name,
+  a.attname as fk_column
+from pg_constraint c
+join pg_attribute a on a.attrelid = c.conrelid and a.attnum = any(c.conkey)
+where c.contype = 'f'
+  and not exists (
+    select 1 from pg_index i
+    where i.indrelid = c.conrelid and a.attnum = any(i.indkey)
+  );
+```
+
+Reference: [Foreign Keys](https://www.postgresql.org/docs/current/ddl-constraints.html#DDL-CONSTRAINTS-FK)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/schema-lowercase-identifiers.md b/.claude/skills/supabase-postgres-best-practices/references/schema-lowercase-identifiers.md
new file mode 100644
index 00000000..f0072940
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/schema-lowercase-identifiers.md
@@ -0,0 +1,55 @@
+---
+title: Use Lowercase Identifiers for Compatibility
+impact: MEDIUM
+impactDescription: Avoid case-sensitivity bugs with tools, ORMs, and AI assistants
+tags: naming, identifiers, case-sensitivity, schema, conventions
+---
+
+## Use Lowercase Identifiers for Compatibility
+
+PostgreSQL folds unquoted identifiers to lowercase. Quoted mixed-case identifiers require quotes forever and cause issues with tools, ORMs, and AI assistants that may not recognize them.
+
+**Incorrect (mixed-case identifiers):**
+
+```sql
+-- Quoted identifiers preserve case but require quotes everywhere
+CREATE TABLE "Users" (
+  "userId" bigint PRIMARY KEY,
+  "firstName" text,
+  "lastName" text
+);
+
+-- Must always quote or queries fail
+SELECT "firstName" FROM "Users" WHERE "userId" = 1;
+
+-- This fails - Users becomes users without quotes
+SELECT firstName FROM Users;
+-- ERROR: relation "users" does not exist
+```
+
+**Correct (lowercase snake_case):**
+
+```sql
+-- Unquoted lowercase identifiers are portable and tool-friendly
+CREATE TABLE users (
+  user_id bigint PRIMARY KEY,
+  first_name text,
+  last_name text
+);
+
+-- Works without quotes, recognized by all tools
+SELECT first_name FROM users WHERE user_id = 1;
+```
+
+Common sources of mixed-case identifiers:
+
+```sql
+-- ORMs often generate quoted camelCase - configure them to use snake_case
+-- Migrations from other databases may preserve original casing
+-- Some GUI tools quote identifiers by default - disable this
+
+-- If stuck with mixed-case, create views as a compatibility layer
+CREATE VIEW users AS SELECT "userId" AS user_id, "firstName" AS first_name FROM "Users";
+```
+
+Reference: [Identifiers and Key Words](https://www.postgresql.org/docs/current/sql-syntax-lexical.html#SQL-SYNTAX-IDENTIFIERS)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/schema-partitioning.md b/.claude/skills/supabase-postgres-best-practices/references/schema-partitioning.md
new file mode 100644
index 00000000..13137a03
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/schema-partitioning.md
@@ -0,0 +1,55 @@
+---
+title: Partition Large Tables for Better Performance
+impact: MEDIUM-HIGH
+impactDescription: 5-20x faster queries and maintenance on large tables
+tags: partitioning, large-tables, time-series, performance
+---
+
+## Partition Large Tables for Better Performance
+
+Partitioning splits a large table into smaller pieces, improving query performance and maintenance operations.
+
+**Incorrect (single large table):**
+
+```sql
+create table events (
+  id bigint generated always as identity,
+  created_at timestamptz,
+  data jsonb
+);
+
+-- 500M rows, queries scan everything
+select * from events where created_at > '2024-01-01';  -- Slow
+vacuum events;  -- Takes hours, locks table
+```
+
+**Correct (partitioned by time range):**
+
+```sql
+create table events (
+  id bigint generated always as identity,
+  created_at timestamptz not null,
+  data jsonb
+) partition by range (created_at);
+
+-- Create partitions for each month
+create table events_2024_01 partition of events
+  for values from ('2024-01-01') to ('2024-02-01');
+
+create table events_2024_02 partition of events
+  for values from ('2024-02-01') to ('2024-03-01');
+
+-- Queries only scan relevant partitions
+select * from events where created_at > '2024-01-15';  -- Only scans events_2024_01+
+
+-- Drop old data instantly
+drop table events_2023_01;  -- Instant vs DELETE taking hours
+```
+
+When to partition:
+
+- Tables > 100M rows
+- Time-series data with date-based queries
+- Need to efficiently drop old data
+
+Reference: [Table Partitioning](https://www.postgresql.org/docs/current/ddl-partitioning.html)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/schema-primary-keys.md b/.claude/skills/supabase-postgres-best-practices/references/schema-primary-keys.md
new file mode 100644
index 00000000..fb0fbb16
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/schema-primary-keys.md
@@ -0,0 +1,61 @@
+---
+title: Select Optimal Primary Key Strategy
+impact: HIGH
+impactDescription: Better index locality, reduced fragmentation
+tags: primary-key, identity, uuid, serial, schema
+---
+
+## Select Optimal Primary Key Strategy
+
+Primary key choice affects insert performance, index size, and replication
+efficiency.
+
+**Incorrect (problematic PK choices):**
+
+```sql
+-- identity is the SQL-standard approach
+create table users (
+  id serial primary key  -- Works, but IDENTITY is recommended
+);
+
+-- Random UUIDs (v4) cause index fragmentation
+create table orders (
+  id uuid default gen_random_uuid() primary key  -- UUIDv4 = random = scattered inserts
+);
+```
+
+**Correct (optimal PK strategies):**
+
+```sql
+-- Use IDENTITY for sequential IDs (SQL-standard, best for most cases)
+create table users (
+  id bigint generated always as identity primary key
+);
+
+-- For distributed systems needing UUIDs, use UUIDv7 (time-ordered)
+-- Requires pg_uuidv7 extension: create extension pg_uuidv7;
+create table orders (
+  id uuid default uuid_generate_v7() primary key  -- Time-ordered, no fragmentation
+);
+
+-- Alternative: time-prefixed IDs for sortable, distributed IDs (no extension needed)
+create table events (
+  id text default concat(
+    to_char(now() at time zone 'utc', 'YYYYMMDDHH24MISSMS'),
+    gen_random_uuid()::text
+  ) primary key
+);
+```
+
+Guidelines:
+
+- Single database: `bigint identity` (sequential, 8 bytes, SQL-standard)
+- Distributed/exposed IDs: UUIDv7 (requires pg_uuidv7) or ULID (time-ordered, no
+  fragmentation)
+- `serial` works but `identity` is SQL-standard and preferred for new
+  applications
+- Avoid random UUIDs (v4) as primary keys on large tables (causes index
+  fragmentation)
+
+Reference:
+[Identity Columns](https://www.postgresql.org/docs/current/sql-createtable.html#SQL-CREATETABLE-PARMS-GENERATED-IDENTITY)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/security-privileges.md b/.claude/skills/supabase-postgres-best-practices/references/security-privileges.md
new file mode 100644
index 00000000..448ec345
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/security-privileges.md
@@ -0,0 +1,54 @@
+---
+title: Apply Principle of Least Privilege
+impact: MEDIUM
+impactDescription: Reduced attack surface, better audit trail
+tags: privileges, security, roles, permissions
+---
+
+## Apply Principle of Least Privilege
+
+Grant only the minimum permissions required. Never use superuser for application queries.
+
+**Incorrect (overly broad permissions):**
+
+```sql
+-- Application uses superuser connection
+-- Or grants ALL to application role
+grant all privileges on all tables in schema public to app_user;
+grant all privileges on all sequences in schema public to app_user;
+
+-- Any SQL injection becomes catastrophic
+-- drop table users; cascades to everything
+```
+
+**Correct (minimal, specific grants):**
+
+```sql
+-- Create role with no default privileges
+create role app_readonly nologin;
+
+-- Grant only SELECT on specific tables
+grant usage on schema public to app_readonly;
+grant select on public.products, public.categories to app_readonly;
+
+-- Create role for writes with limited scope
+create role app_writer nologin;
+grant usage on schema public to app_writer;
+grant select, insert, update on public.orders to app_writer;
+grant usage on sequence orders_id_seq to app_writer;
+-- No DELETE permission
+
+-- Login role inherits from these
+create role app_user login password 'xxx';
+grant app_writer to app_user;
+```
+
+Revoke public defaults:
+
+```sql
+-- Revoke default public access
+revoke all on schema public from public;
+revoke all on all tables in schema public from public;
+```
+
+Reference: [Roles and Privileges](https://supabase.com/blog/postgres-roles-and-privileges)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/security-rls-basics.md b/.claude/skills/supabase-postgres-best-practices/references/security-rls-basics.md
new file mode 100644
index 00000000..c61e1a85
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/security-rls-basics.md
@@ -0,0 +1,50 @@
+---
+title: Enable Row Level Security for Multi-Tenant Data
+impact: CRITICAL
+impactDescription: Database-enforced tenant isolation, prevent data leaks
+tags: rls, row-level-security, multi-tenant, security
+---
+
+## Enable Row Level Security for Multi-Tenant Data
+
+Row Level Security (RLS) enforces data access at the database level, ensuring users only see their own data.
+
+**Incorrect (application-level filtering only):**
+
+```sql
+-- Relying only on application to filter
+select * from orders where user_id = $current_user_id;
+
+-- Bug or bypass means all data is exposed!
+select * from orders;  -- Returns ALL orders
+```
+
+**Correct (database-enforced RLS):**
+
+```sql
+-- Enable RLS on the table
+alter table orders enable row level security;
+
+-- Create policy for users to see only their orders
+create policy orders_user_policy on orders
+  for all
+  using (user_id = current_setting('app.current_user_id')::bigint);
+
+-- Force RLS even for table owners
+alter table orders force row level security;
+
+-- Set user context and query
+set app.current_user_id = '123';
+select * from orders;  -- Only returns orders for user 123
+```
+
+Policy for authenticated role:
+
+```sql
+create policy orders_user_policy on orders
+  for all
+  to authenticated
+  using (user_id = auth.uid());
+```
+
+Reference: [Row Level Security](https://supabase.com/docs/guides/database/postgres/row-level-security)
diff --git a/.claude/skills/supabase-postgres-best-practices/references/security-rls-performance.md b/.claude/skills/supabase-postgres-best-practices/references/security-rls-performance.md
new file mode 100644
index 00000000..c3c7c416
--- /dev/null
+++ b/.claude/skills/supabase-postgres-best-practices/references/security-rls-performance.md
@@ -0,0 +1,63 @@
+---
+title: Optimize RLS Policies for Performance
+impact: HIGH
+impactDescription: 5-10x faster RLS queries with proper patterns
+tags: rls, performance, security, optimization
+---
+
+## Optimize RLS Policies for Performance
+
+Poorly written RLS policies can cause severe performance issues. Use subqueries and indexes strategically.
+
+**Incorrect (function called for every row):**
+
+```sql
+create policy orders_policy on orders
+  using (auth.uid() = user_id);  -- auth.uid() called per row!
+
+-- With 1M rows, auth.uid() is called 1M times
+```
+
+**Correct (wrap functions in SELECT):**
+
+```sql
+create policy orders_policy on orders
+  using ((select auth.uid()) = user_id);  -- Called once, cached
+
+-- 100x+ faster on large tables
+```
+
+Use security definer functions for complex checks:
+
+`SECURITY DEFINER` functions run with the creator's privileges and bypass RLS on any tables they touch — which is what makes them useful for internal lookups, but also what makes them dangerous if misused. Always include an explicit `auth.uid()` check inside the function body, keep them in a non-exposed schema, and revoke `EXECUTE` from any role that shouldn't call them directly.
+
+```sql
+-- Create helper function in a private schema
+create or replace function private.is_team_member(team_id bigint)
+returns boolean
+language sql
+security definer
+set search_path = ''
+as $$
+  select exists (
+    select 1 from public.team_members
+    -- always check the calling user's identity inside the function
+    where team_id = $1 and user_id = (select auth.uid())
+  );
+$$;
+
+-- Revoke direct execution from public roles
+revoke execute on function private.is_team_member(bigint) from PUBLIC, anon, authenticated, service_role;
+
+-- Use in policy (indexed lookup, not per-row check)
+create policy team_orders_policy on orders
+  using ((select private.is_team_member(team_id)));
+```
+
+Always add indexes on columns used in RLS policies:
+
+```sql
+create index orders_user_id_idx on orders (user_id);
+```
+
+Reference: [RLS Performance](https://supabase.com/docs/guides/database/postgres/row-level-security#rls-performance-recommendations)
diff --git a/.fallowrc.json b/.fallowrc.json
new file mode 100644
index 00000000..af846625
--- /dev/null
+++ b/.fallowrc.json
@@ -0,0 +1,39 @@
+{
+  "$schema": "https://raw.githubusercontent.com/fallow-rs/fallow/main/schema.json",
+  "entry": [
+    "src/index.{ts,tsx,js,jsx}",
+    "src/main.{ts,tsx,js,jsx}",
+    // Agent server entry — loaded by the `mastra` CLI, not imported anywhere,
+    // so without this its routes/agents/tools look "dead".
+    "src/mastra/index.ts",
+    // Standalone webhook server (port 4112) + channel webhook entry.
+    "src/webhook-server.ts",
+    "scripts/**/*.{ts,mjs}"
+  ],
+  "workspaces": {
+    "packages": [
+      "packages/*"
+    ]
+  },
+  // preview-template is the agent's code-generation scaffold (a full shadcn
+  // component library the agent builds previews from) — its "unused" components
+  // are intentional, not dead code. Exclude it from analysis.
+  "ignorePatterns": [
+    "packages/agents/preview-template/**"
+  ],
+  "duplicates": {
+    // Hide pair-only clones; focus on widespread copy-paste
+    // worth refactoring. Lower to 2 to report every duplicate pair.
+    "minOccurrences": 3
+    // Common additions (uncomment to enable):
+    // "ignore": [
+    //   "**/lib/**",          // for repos that publish transpiled output to lib/
+    //   "**/legacy/**",       // for repos with legacy-build artifacts
+    //   "**/__generated__/**", // Relay, GraphQL Code Generator
+    //   "**/generated/**"     // OpenAPI, Protobuf codegen
+    // ]
+  },
+  "rules": {
+    "unused-dependencies": "warn"
+  }
+}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ba78d1f9..15138398 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -37,6 +37,22 @@ jobs:
           NODE_ENV: test
           DUCKDB_PATH: ./data/test.duckdb
 
+  typecheck:
+    name: agents (tsc)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      # `mastra build` / vitest transpile with esbuild (no type-checking), so
+      # type errors never gated before — this runs `tsc --noEmit` over src + tests.
+      - name: Typecheck agents
+        run: cd packages/agents && npm run typecheck
+
   web:
     name: web (next build)
     runs-on: ubuntu-latest
@@ -97,10 +113,20 @@ jobs:
           # newest version — that call is rate-limited on shared runners and
           # flaked this job ("Failed to resolve latest Supabase CLI release:
           # rate limit exceeded", foreman-fjl3). Bump deliberately when needed.
-          version: 2.107.0
+          version: 2.109.0
       - run: npm ci
-      - name: Start local Supabase
-        run: npx supabase start
+      - name: Start local Supabase (db + meta only)
+        # `db:types:check` only needs the database + postgres-meta to introspect
+        # the schema, but a full `supabase start` also pulls studio, inbucket, …
+        # from public.ecr.aws unauthenticated. Anonymous ECR pulls are capped at
+        # 1/sec per IP, so on shared runners the extra images intermittently trip
+        # "toomanyrequests" (exit 125) — and that error can also mask a Docker
+        # disk-space exhaustion. Excluding the heavy unneeded images cuts both
+        # the pull count and disk use; the CLI already retries pulls with
+        # exponential backoff internally (foreman-x8rj). Keep kong/rest/auth so
+        # the post-start health check still passes. Escalation levers if it ever
+        # recurs: SUPABASE_INTERNAL_IMAGE_REGISTRY=docker.io, or a free-disk step.
+        run: npx supabase start -x studio,inbucket
       - name: Verify generated types match migrations
         # The latest supabase CLI checks for an access token *before* it will run
         # local type-gen in CI; the value is never used (--local introspects the
diff --git a/.gitignore b/.gitignore
index a119cb36..cd95957f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -65,3 +65,17 @@ next-env.d.ts
 
 # Zapier SDK/CLI update watcher state (per-machine throttle + notify watermark)
 scripts/.zapier-sdk-watch.json
+preview-auth.json
+
+# Local dev-server logs (packages/agents/server-dev.log, packages/web/web-dev.log)
+*-dev.log
+.fallow/
+
+# Agent skills: .claude/skills/ is the canonical (CC-read) copy and is tracked.
+# .agents/skills/ is a byte-identical mirror written by the skills tool — ignore it
+# so the same content isn't vendored twice. skills-lock.json is committed for provenance.
+.agents/skills/
+
+# Personal Claude Code local settings — machine-specific permission allowlist.
+# The shared project config is .claude/settings.json (tracked); this one is per-machine.
+.claude/settings.local.json
diff --git a/CLAUDE.md b/CLAUDE.md
index 2ef304cc..debf047e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,5 +1,11 @@
 @AGENTS.md
 
+<!-- Project coding rules (imperative conventions; see rules/index.md). -->
+@rules/index.md
+@rules/zapier-sdk.md
+@rules/mastra.md
+@rules/testing-and-db.md
+
 ## Monorepo Layout
 
 ```
@@ -13,12 +19,16 @@ packages/web/      → Next.js 16 frontend (port 3000)
 
 | Agent             | File                                     | Model      | Tools                                                   |
 | ----------------- | ---------------------------------------- | ---------- | ------------------------------------------------------- |
-| Foreman (primary) | `agents/src/mastra/agents/foreman.ts`    | sonnet 4.6 | All SDK tools (via ToolSearchProcessor), 3 custom tools |
+| Foreman (primary) | `agents/src/mastra/agents/foreman.ts`    | sonnet 4.6 | All SDK tools (via ToolSearchProcessor) + 7 custom-tool modules |
 | Supervisor        | `agents/src/mastra/agents/supervisor.ts` | sonnet 4.6 | Routes to discovery/execution/history agents            |
-| Discovery         | `agents/src/mastra/agents/discovery.ts`  | haiku 4.5  | 9 read-only SDK tools                                   |
-| Execution         | `agents/src/mastra/agents/execution.ts`  | sonnet 4.6 | run-action, fetch, request, connect_zapier              |
+| Discovery         | `agents/src/mastra/agents/discovery.ts`  | haiku 4.5  | 8 read-only SDK tools (`DISCOVERY_TOOL_NAMES`)          |
+| Execution         | `agents/src/mastra/agents/execution.ts`  | sonnet 4.6 | run-action, fetch, connect_zapier                       |
 | History           | `agents/src/mastra/agents/history.ts`    | haiku 4.5  | search_history                                          |
 
+Models are centralized in `agents/src/lib/providers/models.ts` (`AGENT_MODELS`) and are
+env-overridable (`FOREMAN_MODEL`, `DISCOVERY_MODEL`, `EXECUTION_MODEL`, …). Tier defaults:
+`default` = `claude-sonnet-4-6`, `fast` = `claude-haiku-4-5-20251001`, `heavy` = `claude-opus-4-6`.
+
 Mastra instance + server config: `agents/src/mastra/index.ts`
 
 ### Zapier SDK Tools
@@ -29,35 +39,45 @@ Mastra instance + server config: `agents/src/mastra/index.ts`
   - Table operations use `table` (not `tableId`)
   - Record creation uses `{ data: {...} }` wrapper per record
 - `APPROVAL_REQUIRED` set: 9 write/delete tools need human approval
-- `READ_ONLY` set: 17 discovery tools
-- `DEPRECATED_METHODS` set: 5 excluded (request, listAuthentications, etc.)
-- `zapier-mcp.ts` — old MCP stdio approach, deprecated but still in tree
+- `READ_ONLY` set: 17 discovery tools (used for MCP annotations + agent-level background execution)
+- `EXCLUDED_METHODS` set: 14 methods skipped during tool generation — deprecated wrappers (`request`, the `*Authentication` duplicates of the `connection`-prefixed methods, the `*InputField*` aliases) plus surfaces Foreman doesn't expose (Connect-Builder OAuth client-credentials; the blocking `createConnection`/`getConnectionStartUrl`/`waitForNewConnection` helpers)
 - **Auth model** — which auth (client-creds vs per-user userJwt) works on which SDK surface, and why durable is internal-scope-walled: [`docs/zapier-auth-model.md`](docs/zapier-auth-model.md)
 
 ### Custom Tools
 
-| Tool              | File                                           |
-| ----------------- | ---------------------------------------------- |
-| connect_zapier    | `agents/src/mastra/tools/connect-zapier.ts`    |
-| search_history    | `agents/src/mastra/tools/search-history.ts`    |
-| fork_conversation | `agents/src/mastra/tools/fork-conversation.ts` |
+| Tool                            | File                                           |
+| ------------------------------- | ---------------------------------------------- |
+| connect_zapier                  | `agents/src/mastra/tools/connect-zapier.ts`    |
+| search_history                  | `agents/src/mastra/tools/search-history.ts`    |
+| fork_conversation               | `agents/src/mastra/tools/fork-conversation.ts` |
+| create_dashboard                | `agents/src/mastra/tools/create-dashboard.ts`  |
+| preview_app                     | `agents/src/mastra/tools/preview-app.ts`       |
+| save_document                   | `agents/src/mastra/tools/save-document.ts`     |
+| create/run/inspect/list_automation | `agents/src/mastra/tools/automations.ts`   |
 
 ### API Routes
 
 All custom routes: `agents/src/routes/index.ts` (Hono, mounted as Mastra middleware)
 
-| Route               | File                       | Purpose                       |
-| ------------------- | -------------------------- | ----------------------------- |
-| `/conversations/*`  | `routes/conversations.ts`  | CRUD + SSE message streaming  |
-| `/proposals/*`      | `routes/proposals.ts`      | Approve/decline/field-choices |
-| `/workflows/*`      | `routes/workflows.ts`      | Workflow CRUD + SSE run       |
-| `/zapier/*`         | `routes/zapier-connect.ts` | OAuth callback flow           |
-| `/capabilities`     | `routes/capabilities.ts`   | Per-user feature flags        |
-| `/guardrails`       | `routes/guardrails.ts`     | Safety settings               |
-| `/voice`            | `routes/voice.ts`          | STT/TTS endpoints             |
-| `/telegram/webhook` | `telegram/webhook.ts`      | Telegram bot                  |
-| `/slack/webhook`    | `slack/webhook.ts`         | Slack bot                     |
-| `/discord/webhook`  | `discord/webhook.ts`       | Discord bot                   |
+| Route               | File                       | Purpose                          |
+| ------------------- | -------------------------- | -------------------------------- |
+| `/conversations/*`  | `routes/conversations.ts`  | CRUD + SSE message streaming     |
+| `/proposals/*`      | `routes/proposals.ts`      | Approve/decline/field-choices    |
+| `/automations/*`    | `routes/automations.ts`    | Durable automation CRUD + run    |
+| `/apps/*`           | `routes/apps.ts`           | App catalog/search + pulled data |
+| `/documents/*`      | `routes/documents.ts`      | Document CRUD + import           |
+| `/workspaces/*`     | `routes/workspaces.ts`     | Workspace CRUD + settings        |
+| `/stored/agents/*`  | `routes/stored-agents.ts`  | Saved/preview agents             |
+| `/zapier/*` `/oauth`| `routes/zapier-connect.ts` | OAuth connect + callback flow    |
+| `/webhooks/*`       | `routes/webhooks.ts`       | Inbound webhook ingestion        |
+| `/capabilities`     | `routes/capabilities.ts`   | Per-user feature flags           |
+| `/guardrails`       | `routes/guardrails.ts`     | Safety settings                  |
+| `/api-keys/*`       | `routes/api-keys.ts`       | `fmn_` API key CRUD              |
+| `/channel-links/*`  | `routes/channel-links.ts`  | Channel pairing/link codes       |
+| `/voice`            | `routes/voice.ts`          | STT/TTS endpoints                |
+| `/telegram/webhook` | `telegram/webhook.ts`      | Telegram bot                     |
+| `/slack/webhook` `/slack/oauth` | `slack/webhook.ts` | Slack bot + OAuth              |
+| `/discord/webhook`  | `discord/webhook.ts`       | Discord bot                      |
 
 Mastra built-in routes (not ours): `/api/agents`, `/a2a/foreman`, `/mcp/*`
 
@@ -65,13 +85,13 @@ Mastra built-in routes (not ours): `/api/agents`, `/a2a/foreman`, `/mcp/*`
 
 - **Middleware**: `agents/src/routes/middleware.ts` — Supabase JWT validation via `getSupabase().auth.getUser(token)`
 - **Identity resolution**: `agents/src/lib/identity.ts` — maps channel users to Foreman users; validates web JWTs via `resolveFromSupabaseJwt`
-- **API auth**: `agents/src/lib/api-auth.ts` — JWT + API key (`fmn_` prefix)
+- **API auth**: `agents/src/lib/identity.ts` — `resolveFromRequest` handles JWT + API key (`fmn_` prefix, via `resolveFromApiKey`/`createApiKey`); key CRUD lives in `routes/api-keys.ts`
 - **Web auth**: `@supabase/ssr` — `lib/server.ts` (server components), `lib/client.ts` (browser), `lib/middleware.ts` (session refresh)
 - **Auth pages**: `/auth/login`, `/auth/sign-up`, `/auth/forgot-password`, `/auth/update-password`
 
 ### Database
 
-- **Schema**: `agents/src/lib/db/schema.ts` — plain TypeScript interfaces (snake_case, mirrors DB columns)
+- **Schema / types**: `agents/src/lib/db/database.types.ts` — the typed DB schema, codegen'd from the live local DB (snake_case, mirrors columns). There is no hand-written `schema.ts`; see the **Generated types** note below for the regen workflow.
 - **Client**: `agents/src/lib/db/index.ts` — `getSupabase()` returns supabase-js service_role client
 - **Mastra storage**: `PostgresStore` from `@mastra/pg` (direct `DATABASE_URL` connection, separate from supabase-js)
 - **Vector**: `PgVector` from `@mastra/pg`
@@ -81,9 +101,10 @@ Mastra built-in routes (not ours): `/api/agents`, `/a2a/foreman`, `/mcp/*`
   - Postgres: 127.0.0.1:54422 (user: `postgres`, pass: `postgres`, db: `postgres`)
   - Studio: http://127.0.0.1:54423
   - `DATABASE_URL=postgres://postgres:postgres@127.0.0.1:54422/postgres`
-  - `supabase/config.toml` disables unused services (storage, auth, realtime, inbucket, analytics, edge_runtime) — they fail health checks on Windows and Foreman doesn't use them
+  - Mailpit/Inbucket: http://127.0.0.1:54424 (local email testing — **enabled**)
+  - `supabase/config.toml` disables the services Foreman doesn't use (storage, realtime, analytics, edge_runtime) — they fail health checks on Windows. **auth and inbucket stay enabled** (Foreman uses Supabase auth + local email).
 - **Generated types**: `agents/src/lib/db/database.types.ts` is codegen'd from the live local DB. Regenerate with `cd packages/agents && npm run db:types`; CI diffs it via `db:types:check` (the `db types fresh` job). Both run `supabase gen types --local --workdir ../..`. The **`--workdir ../..` is required**: the scripts run from `packages/agents` but `supabase/config.toml` is at the repo root, so plain `--local` can't find the stack and silently falls back to the cloud/token path (`"Access token not provided"`, empty output). Do **NOT** swap in `--db-url`: newer CLIs introspect via a `postgres-meta` container that can't reach the host's `127.0.0.1` in CI (works on Windows Docker, fails on Linux). Run `npx supabase start` first.
-- Tables: user, zapier_identity, conversation, action_proposal, action_run, workflow, workflow_step, workflow_run, capability_flag, channel_identity, api_key
+- Tables (~90 in `public` — see `database.types.ts` for the authoritative list): core Foreman — `user`, `workspaces`, `zapier_identity`, `connection_alias`, `conversation`, `conversation_share`, `action_proposal`, `action_run`, `automation`, `automation_run`, `app_catalog`, `app_data_snapshot`, `app_settings`, `artifact`, `stored_agent`, `capability_flag`, `channel_identity`, `channel_link_code`, `api_key`; plus `billing_*` (Stripe) and Mastra system tables (`mastra_*`). The former `workflow`/`workflow_step`/`workflow_run` tables are gone — superseded by `automation`/`automation_run`.
 
 ### Key Lib Files
 
@@ -99,17 +120,19 @@ Mastra built-in routes (not ours): `/api/agents`, `/a2a/foreman`, `/mcp/*`
 | `lib/validation.ts`      | Shared Zod schemas                               |
 | `lib/voice.ts`           | STT (Whisper) + TTS (ElevenLabs/OpenAI)          |
 | `lib/guardrails.ts`      | Rate limiting, risk assessment                   |
-| `lib/workflows/`         | Daily summary, health check workflows            |
+| `lib/providers/`         | Central model registry (`AGENT_MODELS`), cost, capabilities, params |
+| `lib/zapier/`            | SDK client factory, connection-alias resolution, deprecation relay |
+| `lib/automations/` + `lib/trigger-inbox/` | Durable automations: store, worker, lease/ack inbox layer |
 
 ### Frontend
 
 | What           | Where                                                                    |
 | -------------- | ------------------------------------------------------------------------ |
-| App layout     | `web/src/app/layout.tsx`                                                 |
-| Chat UI        | `web/src/components/chat-shell.tsx`, `chat-pane.tsx`, `chat-message.tsx` |
-| Approval cards | `web/src/components/approval-card.tsx`                                   |
-| API client     | `web/src/lib/api-client.ts` — all agent server calls                     |
-| Workflows page | `web/src/app/workflows/`                                                 |
+| App layout     | `web/src/app/layout.tsx`; app shell `web/src/components/app-shell.tsx`   |
+| Chat UI        | `web/src/components/chat/` — `shell.tsx`, `messages.tsx`, `message.tsx`, `chat-header.tsx` (artifacts/preview panel alongside) |
+| Approval / tool UI | rendered inline in the message stream via `web/src/components/ai-elements/tool.tsx` (no standalone approval-card) |
+| API client     | domain clients `web/src/lib/{conversations,apps,documents,stored-agents}-client.ts` + `web/src/app/api/*` proxy routes (hit `NEXT_PUBLIC_AGENT_SERVER_URL`) |
+| Key pages      | `web/src/app/{chat,apps,automations,documents,workspaces,inbox,editor,settings}/` (the old `workflows/` page is now `automations/`) |
 
 ## Evaluation pipeline
 
@@ -128,14 +151,16 @@ Foreman uses Mastra's Datasets API to score the agent against a labeled set of r
 
 ## CI
 
-`.github/workflows/test.yml` runs four jobs on every push to `main` and every PR:
+`.github/workflows/test.yml` runs six jobs on every push to `main` and every PR:
 
 | Job | What |
 |---|---|
 | **agents** | `npm test` — vitest workspace projects. AIMock starts in-process via `tests/aimock-setup.ts` globalSetup. |
+| **typecheck** | `tsc` over `packages/agents` (no emit). |
 | **web** | `next build` for `packages/web` (also type-checks). |
-| **lint** | `npm run lint` — Biome. |
+| **lint** | Biome check (lint + format). |
 | **deps** | `npm ci` — postinstall runs `scripts/check-dep-uniqueness.mjs`. |
+| **db-types** | `db:types:check` — diffs `database.types.ts` against a fresh `supabase gen types` (starts the local stack first). |
 
 Real provider keys are deliberately absent from CI. Anything that leaks into a non-mocked path fails loudly.
 
@@ -143,6 +168,44 @@ Real provider keys are deliberately absent from CI. Anything that leaks into a n
 
 For requirements, full quick-start, env vars, ngrok, deployment, and the testing tier table — see [README.md](README.md). This file is for navigating the codebase; the README is for running it.
 
+## Gotchas (hard-won — read before debugging the agent server)
+
+- **Run the agents server through Infisical.** Secrets (incl. `ANTHROPIC_API_KEY`)
+  live in Infisical (`otaku-internal`/`dev`), **not** in `agents/.env.local`
+  (those keys are commented out). Start with:
+  `cd packages/agents && infisical run --projectId e56e0da5-6460-4bab-bdd6-2fd12ac5447b --env dev --recursive --silent -- npm run dev`.
+  Plain `npm run dev` → no Anthropic key → every chat 500s with `invalid x-api-key`.
+  Local infra (`DATABASE_URL`, local `SUPABASE_URL`) stays in `.env.local` and is
+  baked in by `mastra dev`, so Infisical's cloud values don't clobber it.
+- **Keep `@mastra/core`, `@mastra/deployer`, `@mastra/server` on the SAME version.**
+  Only core has a root override; deployer/server are transitive (the `mastra` CLI
+  pulls them via `^`) and float UP to the latest minor. When they drift ahead of
+  core, the server calls APIs core lacks — e.g. deployer `1.43.0` called
+  `mastra.getStudio()` while core was `1.42.0-alpha.3`, throwing in route-auth so
+  **every authed HTTP route 500'd while agents still worked in-process** (cost a
+  whole session). The **entire `@mastra/*` set** is pinned to exact versions in root
+  `overrides` for reproducibility (so unpinned transitive alphas can't float either),
+  and `scripts/check-dep-uniqueness.mjs` fails the install if core/deployer/server
+  diverge. To intentionally bump the Mastra alpha: update every `@mastra/*` pin in
+  `overrides` together, then `rm -rf node_modules package-lock.json && npm install`.
+- **Mastra swallows route errors.** Its default handler returns a bare
+  `{"error":"Internal Server Error"}` and logs the real error as `{}` (mangled
+  pino). `index.ts` wires `server.onError` to `console.error` the real stack — keep
+  it. When a route 500s with no detail, that log (server console, not the pino
+  line) is where the truth is.
+- **Don't set `strict: true` on `createTool`.** It forces Anthropic's
+  grammar-constrained tool mode, which rejects `additionalProperties: object`,
+  `propertyNames`, and caps aggregate optional params at 24. The custom tools used
+  to set it and broke Foreman entirely.
+- **`server.middleware` must not consume the request body.** A Web `Request` body
+  is a single-read stream and `.clone()` shares it. `customMiddleware` only
+  pre-routes paths the custom Hono app owns (prefix list in `index.ts`); everything
+  else falls straight through to Mastra with the body intact. Don't revert it to a
+  fetch-everything fall-through — that 500s `POST /chat/:agentId` before the handler.
+- **Inline images need an explicit `mediaType`.** The `/chat` route splits the data
+  URL and forwards `{ type: "image", image: <base64>, mediaType }`; without the
+  media type the AI SDK defaults to `image/jpeg` and Anthropic rejects PNGs.
+
 ## Versioning & Tagging
 
 Foreman uses **SemVer** (`MAJOR.MINOR.PATCH`) with **annotated** git tags at release points.
diff --git a/biome.json b/biome.json
index 21407784..c702a0f9 100644
--- a/biome.json
+++ b/biome.json
@@ -17,7 +17,9 @@
       "!**/dist",
       "!**/drizzle",
       "!**/*.min.js",
-      "!packages/web/components.json"
+      "!packages/web/components.json",
+      "!**/package-lock.json",
+      "!**/.fallowrc.json"
     ]
   },
   "formatter": {
diff --git a/docs/schema-and-identity-cleanup.md b/docs/schema-and-identity-cleanup.md
new file mode 100644
index 00000000..ac1308f4
--- /dev/null
+++ b/docs/schema-and-identity-cleanup.md
@@ -0,0 +1,153 @@
+# Schema & Identity Cleanup — Plan of Record
+
+> Epic: **foreman-qhbp**. Owner direction (2026-06-25): make Foreman's DB clean and
+> properly multi-tenant, with migrations **grouped one file per domain**, and **no DROP
+> migrations** (re-baseline at source — there are zero production users). Phase 1 (hand-rolled
+> workflow engine removal) already shipped in `82b24fb`.
+
+Foreman's schema was seeded from a Supabase SaaS starter that groups its migrations **one file
+per domain** (`user.sql`, `workspaces.sql`, `billing.sql`, …). Foreman already matches that for
+the platform tables — the divergence was Foreman's own `foreman_core.sql` monolith and a
+half-wired multi-tenant layer.
+
+---
+
+## 1. Current state — the two-worlds straddle
+
+| World | Tables | Keying | Status |
+|---|---|---|---|
+| **Platform / Supabase-auth** | `auth.users` → `user_profiles`, `workspaces`, `workspace_members`, `user_roles`, billing_* | **UUID**, RLS via `auth.uid()` | Fully built, **mostly inert** |
+| **Foreman runtime** | `user` (legacy Better-Auth), `conversation`, `action_proposal`, `action_run`, `zapier_identity`, `connection_alias`, `channel_identity`, `api_key`, `capability_flag`, `app_catalog`, dashboards (`artifact`/`app_data_snapshot`/`dashboard_share`), `stored_agent`, `channel_link_code` | **TEXT** `user_id` → `public."user".id` | What the app actually runs on |
+
+**The bridge already exists for web users:** `resolveFromSupabaseJwt` returns the `auth.users`
+UUID, and `ensureUserExists` writes a `public."user"` row with **that same UUID** as its text id.
+So `public.user.id == auth.users.id == user_profiles.id` for every web user. Channel-only users
+(Slack/Discord/…) get a `randomUUID()` principal with **no** `auth.users` row; the
+`channel_link_code` flow re-points them to a web user when they link.
+
+**`public."user"` is therefore a unified *principal* table** spanning auth-backed (web) and
+non-auth (channel) identities. That's a sound pattern — we keep it, we don't fight it.
+
+**Multi-tenancy is built but unwired:** `workspaces` (solo/team), `workspace_members`
+(→ `user_profiles`), `is_workspace_member`/`is_workspace_admin` SECURITY-DEFINER helpers, RLS,
+and a signup trigger that auto-creates a personal solo workspace — all present. But Foreman's
+runtime tables don't reference workspaces. `orgId` rides in the JWT `user_metadata` and reaches
+the auth middleware, yet is only consumed by a **stubbed** guardrails config. `workspace_id`
+columns exist on `conversation`/`channel_identity`/`zapier_identity` (migration `…018`) and
+`artifact`/`app_data_snapshot`, but are **never filtered on** (one exception: `zapier/sdk.ts`
+reads `workspace_id` first for shared connections, falling back to `user_id`).
+
+---
+
+## 2. Target identity & tenancy model
+
+- **`auth.users`** stays the canonical auth for **web** users; **`user_profiles`** the platform profile.
+- **`public."user"` stays the runtime *principal*** every Foreman table references. Web principals'
+  id == `auth.users.id`; channel principals are standalone UUIDs. (Cleanup: document it as the
+  principal/account table; snake_case the Better-Auth camelCase columns is *optional* later churn.)
+- **`workspaces` becomes the tenant boundary.** Every Foreman resource belongs to a **workspace**;
+  `user_id` stays as creator attribution. Solo user → their personal solo workspace (equivalent to
+  today). Team workspace → members share resources. Channel-only principals get their own solo
+  workspace too (extend the signup-trigger pattern to channel registration).
+- **Resolution:** identity resolution also resolves the **active `workspace_id`** (default solo, or
+  selected team) and threads it through middleware **and** Mastra `RequestContext`. Reads/writes
+  scope by `workspace_id`.
+
+---
+
+## 3. Migration reorganization (one file per domain)
+
+### 3a. Decompose `foreman_core.sql` → per-domain files  ✅ done (`fa51547`)
+`foreman_core.sql` crammed 8 Foreman runtime tables + FKs into one file. Now split into
+per-domain migrations (dated `20260425*` so they precede the platform migrations and `…018`):
+
+| File | Tables |
+|---|---|
+| `foreman_principal.sql` | `public."user"` (principal) |
+| `foreman_conversation.sql` | `conversation` |
+| `foreman_proposals.sql` | `action_proposal`, `action_run` |
+| `foreman_zapier.sql` | `zapier_identity`, `connection_alias`, `app_catalog` |
+| `foreman_channels.sql` | `channel_identity` |
+| `foreman_api_keys.sql` | `api_key` |
+| `foreman_capabilities.sql` | `capability_flag` |
+
+(Foreman's later additions — `mastra.sql`, `stored_agent.sql`, `app_data_snapshot.sql`,
+`artifact.sql`, `dashboard_share.sql`, `conversation_archive.sql`,
+`mastra_channels_and_schedules.sql` — are already one-domain-per-file; kept as-is.)
+
+### 3b. Keep / Cut
+- **KEEP (multi-tenant platform foundation — multi-tenant is a must):** `enums`, `user` (profiles),
+  `workspaces`, `user_triggers`, `workspace_triggers`, `custom_access_token_hook`, `app_settings`,
+  `workspace_permissions`, `application_admin`, `is_application_admin`, `org_id_to_workspace_id`,
+  `rls`, `revoke_anon_grants`, `catalog_vectors_rls`.
+- **KEEP (Foreman runtime + storage):** everything in §3a + the later domain files + `mastra`.
+- **CUT — dead marketing/feedback CMS** ✅ done (`67a4b25`): `marketing`, `marketing_blog`,
+  `marketing_changelog`, `marketing_feedback`, `feedback_boards`, `feedback_subscriptions` +
+  their orphaned enums. Zero code references; Foreman's marketing is a bespoke landing page.
+- **KEEP but currently inert — `billing`** (Stripe): the org/team monetization foundation.
+
+### 3c. No DROP migrations
+All removals happen **at source** (delete/edit the CREATE migration). `db reset` re-baselines from
+clean files.
+
+---
+
+## 4. Multi-tenancy wiring (Phase 2b — the behavior change)
+
+From the blast-radius map (foreman-qhbp), the work is bounded:
+
+- **Add `workspace_id UUID` (FK → workspaces)** to the runtime tables that lack it: `stored_agent`
+  (+ `stored_agent_version` via parent), `api_key`, `capability_flag`, `channel_link_code`,
+  `connection_alias`. Already present on `conversation`, `channel_identity`, `zapier_identity`,
+  `artifact`, `app_data_snapshot`.
+- **`action_proposal` / `action_run` need nothing** — they resolve ownership through
+  `conversation` (`loadOwnedProposal` INNER-JOINs `conversation.user_id`); scoping `conversation`
+  covers them transitively.
+- **Resolve + thread `workspace_id`:** in `identity.ts` (resolve active workspace for the principal),
+  `middleware.ts` (`c.set("workspace_id", …)`), and the `/chat` route's `RequestContext`
+  (add `workspaceId`). Channel bots inherit it via the principal's solo workspace.
+- **Scope reads/writes:** the ~20 `user_id`-filtered reads (conversations ×5, snapshots ×6,
+  stored_agent ×3, etc.) move to workspace scoping (or `workspace_id` + `user_id` where personal).
+- **Give channel principals a solo workspace** at `registerChannelUser` time (mirror the web signup
+  trigger).
+
+Staged **after** the reorg so each diff stays reviewable.
+
+---
+
+## 5. New tables for the Zapier durable / trigger-inbox SDK surface (Phase 2c)
+
+Designed now, landed when durable EA arrives (foreman-13mw). Sketch (workspace-scoped):
+
+- **`durable_workflow`** — maps a Foreman workspace to a Zapier durable workflow:
+  `(id, workspace_id, user_id, zapier_workflow_id, name, definition_ref, status, created_at, updated_at)`.
+- **`durable_run`** — run-tracking mirror of `runDurable`/`getDurableRun`:
+  `(id, durable_workflow_id, workspace_id, zapier_run_id, status, started_at, finished_at, error)`.
+- **`trigger_inbox_subscription`** — Foreman's binding to a Zapier trigger-inbox (unwalled today):
+  `(id, workspace_id, user_id, app_key, inbox_id, config, enabled, last_event_at, created_at)`.
+
+These replace the removed `workflow`/`workflow_step`/`workflow_run`/`workflow_trigger` 1:1, but
+as thin pointers to Zapier-side durable state rather than a hand-rolled engine. Finalize against
+the live SDK schema when EA lands.
+
+---
+
+## 6. Phased execution
+
+- **Phase 2a — Migration reorg (no behavior change):** ✅ done — decomposed `foreman_core`
+  (`fa51547`), cut the marketing/feedback CMS (`67a4b25`). `db reset` + `db:types:check` +
+  vitest green.
+- **Phase 2b — Multi-tenancy wiring:** add `workspace_id` to remaining tables; resolve/thread it;
+  scope reads/writes; solo workspace for channel principals. Code + schema.
+- **Phase 2c — Durable/trigger-inbox tables:** land §5 schema (gated on EA for the code that uses it).
+
+Each phase: `npm test` (vitest) + `biome lint` + `next build` + `db:types:check` must stay green.
+
+---
+
+## 7. Open decisions
+
+1. ~~Cut the marketing/feedback CMS~~ → **done** (cut).
+2. **Keep `billing`** inert as the monetization foundation → **yes**.
+3. Identity model (§2) — keep `public."user"` as the unified principal, workspace as tenant
+   boundary → **yes** (matches what the code already does + the workspace tenancy model).
diff --git a/docs/zapier-auth-model.md b/docs/zapier-auth-model.md
index 8e15e938..df9a0404 100644
--- a/docs/zapier-auth-model.md
+++ b/docs/zapier-auth-model.md
@@ -3,8 +3,10 @@
 > How Foreman authenticates to `@zapier/zapier-sdk`, and — critically — **which
 > auth works on which SDK surface.** Some experimental surfaces require a scope no
 > public SDK client can obtain. Snapshot: 2026-06-11, `@zapier/zapier-sdk@0.69.3`;
-> durable wall re-confirmed 2026-06-16 on `0.70.4` across **all 18** durable/workflow
+> durable wall re-confirmed 2026-06-16 on `0.70.4` and again 2026-06-22 on the current `0.76.0` across **all 18** durable/workflow
 > endpoints under both credential types (see [`zapier-durable-questions-for-engineers.md`](zapier-durable-questions-for-engineers.md)).
+>
+> **🔴 UPDATE 2026-07-05 (v0.81.0, foreman-e1ob/eln1) — THE DURABLE WALL IS OPEN.** Re-probed live on both credential types: client-credentials → 0/18 walled; a real per-user PKCE user-JWT → `runDurable` accepted → run finished. The PKCE token is still granted only `external` scope — **durable now accepts `external` where it previously required `internal`**. The "durable is walled / unavailable" statements below are **superseded** (kept for history). Whether it's GA/permanent is tracked in foreman-13mw.
 
 ## The three credential types the SDK accepts
 
@@ -35,7 +37,7 @@ redirecting to one of a fixed set of localhost ports Zapier allow-lists for it.
 |---|---|---|---|
 | `runAction`, discovery, `apps.*`, tables | ✅ | ✅ | The everyday action layer — any user auth works |
 | Trigger inboxes (`/experimental`) | ✅ | ✅ | `ensureTriggerInbox` / `lease` / `ack` all accept client-creds |
-| **Durable / workflow** (all 18 endpoints, `/experimental`) | ❌ **403** | ❌ **403** | `"None of the security schemes (userJwt)…"` — 18/18 swept under both auth types (2026-06-16, `0.70.4`); see below |
+| **Durable / workflow** (all 18 endpoints, `/experimental`) | ✅ (v0.81.0) | ✅ (v0.81.0) | Both **403 through 0.79.0**, then **OPEN on 0.81.0** (foreman-eln1): client-creds 0/18 walled; per-user PKCE `runDurable`→finished. Still `external`-scope — durable relaxed to accept it. |
 
 **Durable is walled for every token a public SDK client can produce.** Proven
 2026-06-11 by `packages/agents/scripts/durable-pkce-probe.ts`: it mints a *real*
@@ -65,10 +67,12 @@ Foreman integration gap. (See [`durable-workflow-spike.md`](durable-workflow-spi
   via the PKCE `connect` flow; the resulting per-user JWT drives `runAction` + discovery
   + trigger inboxes. Requires `ZAPIER_CLIENT_ID` / `ZAPIER_CLIENT_SECRET` for the
   app-level client-credentials path where used.
-- **Durable execution is currently unavailable** to Foreman via any public-SDK auth.
-  Do not architect around it for v1 (reinforces `foreman-98j3`: keep the home-grown
-  workflow engine). Revisit only after Zapier opens the scope — open question tracked in
-  `foreman-8bh9` / `foreman-d8qq`.
+- **Durable execution is AVAILABLE as of v0.81.0** (foreman-e1ob/eln1, 2026-07-05) — via both
+  app client-credentials AND the per-user PKCE token (external scope). Foreman's Phase-3
+  automation pipeline runs on it live end-to-end, incl. `createCallback` human-approval gates.
+  The remaining open question is **GA/permanence** (foreman-13mw) — the wall opened between
+  0.79.0 and 0.81.0, so confirm with Zapier it won't re-close before hard-depending on it.
+  (History: durable was unavailable via any public-SDK auth through 0.79.0 — the notes above.)
 
 ## Related
 
diff --git a/docs/zapier-durable-questions-for-engineers.md b/docs/zapier-durable-questions-for-engineers.md
index ae816585..dfdfda4a 100644
--- a/docs/zapier-durable-questions-for-engineers.md
+++ b/docs/zapier-durable-questions-for-engineers.md
@@ -1,8 +1,25 @@
 # Durable Execution — Questions for Zapier Engineers
 
+> ## ✅ UPDATE 2026-07-05 (SDK 0.81.0) — durables now WORK; questions narrowed
+>
+> The two original blockers below are **RESOLVED** on `@zapier/zapier-sdk@0.81.0`:
+> - **Auth:** a live re-probe (`scripts/durable-endpoints-probe.ts`, app-level **client-credentials**) returns **0/18 durable methods walled** — `runDurable` / `createWorkflow` / `listWorkflows` all `2xx`. The `internal`-scope `userJwt` wall is gone for the client-creds token.
+> - **Source-file contract:** `defineDurable(...)` + `ctx.step` / `ctx.wait` / `ctx.createCallback` deploy and run end-to-end. Verified live: ephemeral `runDurable` → finished; `createWorkflow`+`publishWorkflowVersion` → `triggerWorkflow` → finished; a `createCallback` gate parks in `execution.status="waiting"` and resumes on a POST.
+>
+> **The remaining questions (evidence-backed, 2026-07-05):**
+>
+> 1. **Is durable GA / permanent now?** On 0.81.0 durable is open for us on **both** auth paths we tested: app **client-credentials** (0/18 endpoints walled) AND a real **per-user PKCE user-JWT** (`runDurable` → run **finished**). Both were **403 in June**. One tell: the PKCE token is **still granted only `external`** scope (unchanged) — durable's `userJwt` scheme now simply **accepts `external`** where it previously required `internal`. **Is that intentional and generally available for public-SDK clients, or an early-access state that could re-close?** The wall opened silently between 0.79.0 and 0.81.0 (no changelog note), so before we hard-depend on it — running every end-user's automations on durable — we need to know it's permanent.
+> 2. **Human-approval callback URL is not obtainable from outside.** `getDurableRun.execution.operations[]` exposes a callback op's `callback_token`, `payload_schema`, `expires_at` — but **not the callback URL**. The real URL is `https://code-substrate-runner.zapier.com/api/v0/callbacks/<opaque-id>`, and `<opaque-id>` is **different** from `callback_token`, so it can't be reconstructed. Today an external orchestrator can only obtain the URL by having the durable **self-report it** via a step output. **Will you expose the callback URL (or add a resume-by-token endpoint / `resumeDurableRun({ run, operation, payload })`) on `getDurableRun`** so the self-report convention isn't required? There is no `resumeDurableRun`/`postCallback` in the SDK today (only `resumeTriggerInbox`, which is inbox-not-durable).
+> 3. **Callback security model.** The callback URL is a **public, unauthenticated bearer endpoint** — a `POST {json}` with no auth header returns `200 {"ok":true}` and resumes the run. Is that the intended model (possession = capability)? Any plans for a **signed / account-authenticated** resume, and what are the **expiry / single-use** semantics? (We observed `expires_at` ~30 days.)
+> 4. **`payload_schema` enforcement.** Is the POSTed callback payload validated against the callback's `payloadSchema` **server-side**, or passed through to the durable unchecked? (We POSTed arbitrary JSON and it was accepted + delivered.)
+>
+> Everything below is the **original (now-resolved) auth/contract report**, kept for history.
+
+---
+
 **From:** Foreman team (admin@otakusolutions.io)
 **Re:** `@zapier/zapier-sdk/experimental` durable-workflow API (`runDurable` / `publishWorkflowVersion`)
-**Date of findings:** 2026-06-11 (SDK `0.69.3`); re-confirmed 2026-06-16 on the latest SDK `0.70.4`
+**Date of findings:** 2026-06-11 (SDK `0.69.3`); re-confirmed 2026-06-16 on `0.70.4`, and again 2026-06-22 on the current `0.76.0` — both credential types, identical 403; `defineDurable` still a "not callable — Phase 2" stub on 0.76.0
 **Status:** Blocked — durable is unreachable with every credential a public SDK client can mint.
 
 ---
@@ -24,13 +41,13 @@ A complete, self-contained reproduction script is included at the end — it nee
 
 | Package | Version |
 |---|---|
-| `@zapier/zapier-sdk` | `0.70.4` (latest; originally found on `0.69.3`, reproduced identically on `0.70.4`) |
+| `@zapier/zapier-sdk` | `0.76.0` (current latest; found on `0.69.3`, reproduced identically on `0.70.4` and `0.76.0`) |
 | `@zapier/zapier-sdk-cli` | `0.54.3` |
 | `@zapier/zapier-durable` | referenced from npm at `0.5.4` (not installed as a repo dep) |
 | `zod` | `4.4.3` |
 | Node | 22 |
 
-We reviewed the full `0.70.0`–`0.70.4` changelog: every durable-touching change is response-schema / field-parity / streaming work — **no auth, scope, or security-scheme changes** — consistent with the 403 being a server-side OAuth wall rather than an SDK artifact. We then re-ran the reproduction (below) on `0.70.4` and got the identical 403.
+We reviewed the full `0.70.0`–`0.70.4` changelog: every durable-touching change is response-schema / field-parity / streaming work — **no auth, scope, or security-scheme changes** — consistent with the 403 being a server-side OAuth wall rather than an SDK artifact. We then re-ran the reproduction (below) on `0.70.4` and got the identical 403. We re-ran it again on the current `0.76.0` (2026-06-22): 18/18 endpoints walled under client-credentials, and a freshly-minted PKCE user JWT still 403s with scope downgraded `internal`→`external` — unchanged. (The `0.71`–`0.76` changes are connection-creation, telemetry headers, camelCase param aliases, and workflow field-parity — none touch durable's auth or scope.)
 
 OAuth client used (the SDK's **public** PKCE client — the same one `zapier-sdk login` uses):
 `grwWZD5hUWGvb4V8ODBuOtXer3h0DBEZ2HR8aay6`, redirecting to one of the localhost ports Zapier allow-lists for it: `49505, 50575, 52804, 55981, 61010, 63851`.
diff --git a/docs/zapier-sdk-capability-map.md b/docs/zapier-sdk-capability-map.md
index 4308fdae..f515061f 100644
--- a/docs/zapier-sdk-capability-map.md
+++ b/docs/zapier-sdk-capability-map.md
@@ -2,49 +2,51 @@
 
 > **Living ledger.** Foreman is a product built on `@zapier/zapier-sdk`. This file is the authoritative map of the SDK surface, what Foreman uses, and what we've deliberately decided *not* to build. Refresh it on every SDK bump.
 >
-> - **Snapshot date:** 2026-06-16 — **live-introspected** against `@zapier/zapier-sdk@0.70.4` (installed, nested under `packages/agents`).
+> - **🔴 UPDATE 2026-07-05 (v0.81.0, foreman-e1ob/eln1) — the durable wall is GONE, verified on BOTH credential types.** `scripts/durable-endpoints-probe.ts` (**client-credentials**) → **0/18 walled** (`runDurable`/`createWorkflow`/`listWorkflows` all 2xx). `scripts/durable-pkce-probe.ts` (**real per-user PKCE user-JWT** — Foreman's production auth via `getExperimentalSdkForUser`) → `runDurable` **ACCEPTED** → run **finished** with correct output. Both were **403 in June**. Full Phase-3 pipeline + human-approval callback resume verified live (`durable-smoke.ts`, `durable-callback-resume-probe.ts`). The 0.79.0 wall notes below are **superseded**.
+> - **The scope tell:** the PKCE token is **still granted only `external`** scope (unchanged from June) — Zapier did **not** start issuing `internal`. Durable simply **now accepts an `external`-scope token** where it previously required `internal`. So the wall opened by relaxing the *requirement*, not by widening our *grant*. Whether this is GA/permanent is the open Zapier question (foreman-13mw).
+> - **Snapshot date:** 2026-06-25 — **live-introspected** against `@zapier/zapier-sdk@0.79.0` (installed; hoisted to the workspace-root `node_modules`, deduped — no longer nested under `packages/agents`).
 > - **How this snapshot was produced:** `npx tsx packages/agents/scripts/sdk-surface-sweep.ts` — imports the installed package and enumerates every entrypoint, `getRegistry()` variant, instance method, and named export. This is **not** changelog-reading; it is what the code on disk actually exposes. Re-run it on every bump (it's the "prove it" tool for the Zapier community showcase).
 > - **Version delta watcher:** `npm run sdk:check` (root) — watches `@zapier/zapier-sdk` + `@zapier/zapier-sdk-cli`, fires a quiet notice on session start via `scripts/zapier-sdk-watch.mjs`.
-> - **Tracking:** open decisions live in beads (see [Open decisions](#open-decisions)). Sweep tracked under **foreman-xb68**.
+> - **Tracking:** open decisions live in beads (see [Open decisions](#open-decisions)). Sweep tracked under **foreman-xb68**; the 0.70.4 → 0.79.0 bump under **foreman-9t9g**.
 
 ## TL;DR — the whole surface in one breath
 
-`@zapier/zapier-sdk@0.70.4` is **four things behind one package**:
+`@zapier/zapier-sdk@0.79.0` is **four things behind one package**:
 
-1. **A typed API client** — `createZapierSdk()` → **37 stable methods** (apps/actions discovery, `runAction`, connections, tables/records, profile, raw `fetch`).
-2. **An experimental control plane** — `@zapier/zapier-sdk/experimental` → the same 37 **+ 36 more** (trigger inboxes, durable runs, durable workflows). 18 of those (the durable/workflow write+read endpoints) are **scope-walled** for any public-SDK token (see auth model).
+1. **A typed API client** — `createZapierSdk()` → **40 stable methods** in the `mcp` cut (apps/actions discovery, `runAction`, connections — incl. the in-flow `createConnection` / `getConnectionStartUrl` / `waitForNewConnection` trio added in 0.71 —, tables/records, profile, raw `fetch`).
+2. **An experimental control plane** — `@zapier/zapier-sdk/experimental` → the same 40 **+ 36 more** (trigger inboxes, durable runs, durable workflows). Those 18 durable methods were blocked through 0.79.0 (14 scope-walled + 4 early-access-gated); **as of v0.81.0 (re-probed 2026-07-05) all 18 authenticate — the wall is gone** (see the durable wall note).
 3. **An authoring framework** — `@zapier/zapier-sdk/define` → `defineDurable` / `defineTool` / `defineComponent` with durable `step`/`wait`/`createCallback` primitives. This is *code-mode durable workflows*: you author them locally, deploy/run via the (walled) experimental endpoints.
-4. **A composable plugin runtime** — 208 named exports on the main entrypoint: every method ships as a `*Plugin`, composable via `composePlugins`/`createPluginStack`; plus a resolver layer, a Zod schema library, a telemetry/event system, credential helpers, and a low-level HTTP client (`createZapierApi`).
+4. **A composable plugin runtime** — 223 named exports on the main entrypoint: every method ships as a `*Plugin`, composable via `composePlugins`/`createPluginStack`; plus a resolver layer, a Zod schema library, a telemetry/event system (now incl. the `DEPRECATION_NOTICE_EVENT` / `api:deprecation_notice` event added in 0.79), credential helpers, and a low-level HTTP client (`createZapierApi`).
 
 The action-type enum is still **read · read_bulk · write · run · search · search_or_write · search_and_write · filter** — **there is no "create a Zap" action type**. Persisted automation is the experimental durable API, which is walled. This is why Foreman owns its own workflow engine.
 
-## Live surface totals (2026-06-16, v0.70.4)
+## Live surface totals (2026-06-25, v0.79.0)
 
 | Entrypoint | `createZapierSdk()` instance methods | `getRegistry({package:"mcp"})` | Named exports |
 |---|---|---|---|
-| `.` (main) | **39** (37 API + `getRegistry` + `addPlugin`) | **37** | **208** |
-| `./experimental` | **75** (37 + 36 experimental + meta) | **71** | **208** |
+| `.` (main) | **42** (40 API + `getRegistry` + `addPlugin`) | **40** | **223** |
+| `./experimental` | **78** (40 + 36 experimental + meta) | **74** | **223** |
 | `./define` | n/a (authoring fns, not an SDK instance) | n/a | **5** |
 | `./apps` | n/a (generated-types anchor) | n/a | **1** (`App`) |
 
-**Experimental-only methods (36)** = 18 trigger-inbox + 5 durable-run + 13 durable-workflow (full list below).
+**Delta from 0.70.4:** main + experimental each gained the **3 in-flow connection methods** (`createConnection`, `getConnectionStartUrl`, `waitForNewConnection`, new in 0.71) → mcp cut 37 → 40; named exports 208 → 223. **Experimental-only methods (36)** = 18 trigger-inbox + 5 durable-run + 13 durable-workflow (full list below) — unchanged.
 
 ### `getRegistry({ package })` is a curated view, not the whole SDK
 
-The registry exists so hosts (MCP servers, CLIs, AI tool layers) can advertise a *subset* of methods. The `package` arg changes the cut — **live counts at 0.70.4**:
+The registry exists so hosts (MCP servers, CLIs, AI tool layers) can advertise a *subset* of methods. The `package` arg changes the cut — **live counts at 0.79.0**:
 
 | `package` | main | experimental | Notes |
 |---|---|---|---|
-| `undefined` (default) | 39 | 75 | includes the 2 app-proxy pseudo-entries |
-| `"mcp"` | **37** | 71 | **what Foreman uses** — drops the proxy entries (can't express a fluent proxy as one MCP tool) |
-| `"sdk"` | 34 | 70 | |
-| `"cli"` | 37 | 71 | |
-| `"all"` | 31 | 65 | |
-| `"ai"` | 31 | 65 | leanest curated set |
+| `undefined` (default) | 42 | 78 | includes the 2 app-proxy pseudo-entries |
+| `"mcp"` | **40** | 74 | **what Foreman uses** — drops the proxy entries (can't express a fluent proxy as one MCP tool) |
+| `"sdk"` | 37 | 73 | |
+| `"cli"` | 40 | 74 | |
+| `"all"` | 34 | 68 | |
+| `"ai"` | 34 | 68 | leanest curated set |
 
-Foreman's choice of `"mcp"` on the **main** entrypoint loses nothing real vs. the default (only the 2 proxy pseudo-entries `apps.{appKey}` / `apps.{appKey}.{actionType}.{actionKey}`, which Foreman deliberately doesn't use). If we ever want a tighter agent toolset, `"ai"` is a pre-curated 31. **Foreman never imports `./experimental`, so none of the 36 experimental methods are ever generated as tools today.**
+Foreman's choice of `"mcp"` on the **main** entrypoint loses nothing real vs. the default (only the 2 proxy pseudo-entries `apps.{appKey}` / `apps.{appKey}.{actionType}.{actionKey}`, which Foreman deliberately doesn't use). If we ever want a tighter agent toolset, `"ai"` is a pre-curated 34. **Foreman never imports `./experimental`, so none of the 36 experimental methods are ever generated as tools today.**
 
-## The 37 stable methods (main `mcp` registry)
+## The 40 stable methods (main `mcp` registry)
 
 | Domain | Methods |
 |---|---|
@@ -54,6 +56,7 @@ Foreman's choice of `"mcp"` on the **main** entrypoint loses nothing real vs. th
 | Run | `runAction` |
 | Connections | `listConnections`, `getConnection`, `findFirstConnection`, `findUniqueConnection` |
 | Connections (**deprecated aliases**) | `listAuthentications`→`listConnections`, `getAuthentication`→`getConnection`, `findFirstAuthentication`→`findFirstConnection`, `findUniqueAuthentication`→`findUniqueConnection` |
+| Connections (**in-flow, new in 0.71**) | `createConnection`, `getConnectionStartUrl`, `waitForNewConnection` — all ⛔ **excluded from auto-gen**. But `getConnectionStartUrl` is now **used inside the `connect_zapier` custom tool** (foreman-mcwn shipped): connected users get a signed, account-bound connect URL, with the engine deep-link as fallback. `createConnection`/`waitForNewConnection` stay excluded (block up to 5 min). |
 | HTTP / profile | `fetch`, `request` (deprecated alias of `fetch`), `getProfile` |
 | Client credentials (Connect Builder) | `listClientCredentials`, `createClientCredentials`, `deleteClientCredentials` |
 | Tables | `listTables`, `getTable`, `createTable`, `deleteTable`, `listTableFields`, `createTableFields`, `deleteTableFields` |
@@ -78,13 +81,15 @@ getInputFieldsSchema     -> getActionInputFieldsSchema
 **Trigger Inboxes (18)** — app-event subscriptions (client-creds OK):
 `listTriggers`, `listTriggerInputFields`, `getTriggerInputFieldsSchema`, `listTriggerInputFieldChoices`, `listTriggerInboxes`, `createTriggerInbox`, `getTriggerInbox`, `ensureTriggerInbox`, `updateTriggerInbox`, `deleteTriggerInbox`, `pauseTriggerInbox`, `resumeTriggerInbox`, `listTriggerInboxMessages`, `leaseTriggerInboxMessages`, `ackTriggerInboxMessages`, `releaseTriggerInboxMessages`, `drainTriggerInbox`, `watchTriggerInbox` (SSE, real-time since 0.69; retries transient drain failures since 0.70.0).
 
-**Durable Runs (5)** — ⛔ scope-walled:
-`runDurable`, `cancelDurableRun`, `listDurableRuns`, `getDurableRun`, `getTriggerRun`.
+**Durable Runs (5)** — split as of 0.79.0 (see wall note):
+`runDurable`, `cancelDurableRun`, `listDurableRuns`, `getDurableRun` — 🟡 **auth now passes** (client-creds), gated by an **early-access allowlist**; `getTriggerRun` — ⛔ still userJwt-walled.
 
 **Durable Workflows (13)** — ⛔ scope-walled:
 `listWorkflows`, `getWorkflow`, `createWorkflow`, `updateWorkflow`, `enableWorkflow`, `disableWorkflow`, `deleteWorkflow`, `publishWorkflowVersion`, `listWorkflowVersions`, `getWorkflowVersion`, `listWorkflowRuns`, `getWorkflowRun`, `triggerWorkflow`.
 
-> ⛔ **The durable wall.** All 18 durable+workflow endpoints return **HTTP 403 "None of the security schemes (userJwt)…"** under **both** client-credentials **and** a real per-user PKCE JWT. 18/18 swept 2026-06-16 (`scripts/durable-endpoints-probe.ts`). Root cause: the public PKCE client is granted `external` scope but durable's `userJwt` scheme requires `internal`. This is a Zapier-side wall, not a Foreman gap. Trigger inboxes are **not** walled. Full write-up: [`zapier-auth-model.md`](zapier-auth-model.md) + [`zapier-durable-questions-for-engineers.md`](zapier-durable-questions-for-engineers.md).
+> ✅ **The durable wall is OPEN as of v0.81.0 (re-probed 2026-07-05, foreman-e1ob, client-creds) — 0/18 walled, 18/18 authenticate.** `runDurable`, `createWorkflow`, `listWorkflows`, `listDurableRuns` return 2xx; the rest return 404 only because the probe passes placeholder ids (i.e. the token authenticated). **End-to-end verified live** (`scripts/durable-smoke.ts`): ephemeral `runDurable` → finished; `createWorkflow`+`publishWorkflowVersion` → `triggerWorkflow` → bridge → finished; trigger-inbox reachable. **Human-approval callbacks work too:** a `ctx.createCallback` run parks in `execution.status="waiting"`; the callback URL is `https://code-substrate-runner.zapier.com/api/v0/callbacks/<opaque-id>` (a PUBLIC, unauthenticated bearer URL — the opaque id is **not** the `callback_token` on the op, so it can't be reconstructed from `getDurableRun`; the durable must self-report it via a step), and a plain `POST {json}` to it returns `200 {"ok":true}` and resumes the run to finished (`scripts/durable-callback-resume-probe.ts`). **The v0.79.0 history below is superseded — kept for the record.**
+>
+> ⛔ **[HISTORY — v0.79.0, 2026-06-25]** Previously **18/18** returned `403 "None of the security schemes (userJwt)…"` (2026-06-16, v0.70.4). At 0.79.0 **14/18 stayed userJwt-walled** (all 13 durable *workflow* endpoints + `getTriggerRun`) — the public PKCE/client-creds token has `external` scope but the `userJwt` scheme requires `internal`. But **4/18 now authenticate**: the durable *run-execution* family (`runDurable`, `cancelDurableRun`, `listDurableRuns`, `getDurableRun`) returns `403 "This feature is in early access and is available only to select users. If you're interested to use it, please get in touch with Zapier at https://next-gen-zaps.zapier.app/"` — i.e. the auth scheme is satisfied; the remaining block is a **feature allowlist**, not a scope wall. **Early-access intake: https://next-gen-zaps.zapier.app/** (surfaced in the 403 itself). Net: **durable workflows are still unusable end-to-end** (you can't define/publish a workflow), but the run family is now an early-access request away rather than scope-walled. Trigger inboxes remain unwalled. Whether the shift is an SDK or a Zapier-server change is undetermined; the observable state on 0.79.0 is as above. Full write-up: [`zapier-auth-model.md`](zapier-auth-model.md) + [`zapier-durable-questions-for-engineers.md`](zapier-durable-questions-for-engineers.md).
 
 ## `./define` — the durable-workflow authoring DSL (previously undocumented)
 
@@ -107,7 +112,7 @@ ctx.createCallback(name)     // human-in-the-loop: returns [Promise<payload>, ca
 ctx.zapier.fetch(url, opts)  // call connected apps from inside the workflow
 ```
 
-So Zapier's durable platform = **author with `/define`** → **deploy/execute with the experimental durable endpoints**. Foreman can author and type-check durable code today; it cannot deploy it via a public-SDK token until Zapier opens the `internal` scope.
+So Zapier's durable platform = **author with `/define`** → **deploy/execute with the experimental durable endpoints**. Foreman authors + type-checks durable code AND — as of **v0.81.0** — deploys/executes it via a public-SDK **client-credentials** token: the `internal`-scope wall opened (foreman-e1ob, verified live end-to-end).
 
 ## The 208-export surface (main entrypoint) — taxonomy
 
@@ -128,20 +133,21 @@ Beyond the 37 methods, `import * as zapier from "@zapier/zapier-sdk"` exposes a
 
 ## Foreman usage map & categorization audit
 
-Source of truth: `packages/agents/src/lib/zapier-sdk-tools.ts`. Foreman imports the **main** entrypoint, reads `getRegistry({package:"mcp"})` (37 fns), drops `EXCLUDED_METHODS`, and generates a Mastra tool per remaining method.
+Source of truth: `packages/agents/src/lib/zapier-sdk-tools.ts`. Foreman imports the **main** entrypoint, reads `getRegistry({package:"mcp"})` (40 fns at 0.79.0), drops `EXCLUDED_METHODS`, and generates a Mastra tool per remaining method.
 
-**Live tool count: Foreman generates 28 tools** (37 mcp methods − 9 excluded):
+**Live tool count: Foreman generates 26 tools** (40 mcp methods − 14 excluded), with **0 uncategorized**:
 
 | Bucket | Count | Methods |
 |---|---|---|
 | `APPROVAL_REQUIRED` (`requireApproval:true`, `destructiveHint:true`) | 9 | `runAction`, `fetch`, `createTable`, `deleteTable`, `createTableRecords`, `updateTableRecords`, `deleteTableRecords`, `createTableFields`, `deleteTableFields` |
-| `READ_ONLY` (`readOnlyHint:true`) | 16 | `listApps`, `getApp`, `listActions`, `getAction`, `listConnections`, `findFirstConnection`, `findUniqueConnection`, `getConnection`, `getInputFieldsSchema`, `listInputFieldChoices`, `listTables`, `getTable`, `listTableFields`, `listTableRecords`, `getTableRecord`, `getProfile` |
-| **Auto-surfaced, NOT categorized** ⚠️ | 3 | `getActionInputFieldsSchema`, `listActionInputFields`, `listActionInputFieldChoices` |
-| `EXCLUDED_METHODS` (no tool) | 9 | `listAuthentications`, `findFirstAuthentication`, `findUniqueAuthentication`, `getAuthentication`, `request`, `listInputFields`, `createClientCredentials`, `deleteClientCredentials`, `listClientCredentials` |
+| `READ_ONLY` (`readOnlyHint:true`) | 17 | `listApps`, `getApp`, `listActions`, `getAction`, `listConnections`, `findFirstConnection`, `findUniqueConnection`, `getConnection`, `getActionInputFieldsSchema`, `listActionInputFields`, `listActionInputFieldChoices`, `listTables`, `getTable`, `listTableFields`, `listTableRecords`, `getTableRecord`, `getProfile` |
+| `EXCLUDED_METHODS` (no tool) | 14 | `listAuthentications`, `findFirstAuthentication`, `findUniqueAuthentication`, `getAuthentication`, `request`, `listInputFields`, `getInputFieldsSchema`, `listInputFieldChoices`, `createClientCredentials`, `deleteClientCredentials`, `listClientCredentials`, `createConnection`, `getConnectionStartUrl`, `waitForNewConnection` |
+
+> 📌 **History:** the 0.70.4 (pre-F1) snapshot showed **28 tools** (9 approval + 16 read-only + 3 uncategorized) with 9 excluded. Two changes since: **F1** (foreman-f1ef) moved the canonical input-field trio into `READ_ONLY` and the 3 deprecated aliases into `EXCLUDED` (→ 26 tools, 0 uncategorized); the **0.79.0 bump** (foreman-9t9g) added the 3 in-flow connection methods to the mcp registry and Foreman `EXCLUDED` all three (tool count stays **26**, excluded 11 → 14).
 
-> 📌 **Correction:** the prior (0.69.3, doc-derived) snapshot claimed "20 surfaced tools (9 + 11)". The live count is **28** (9 + 16 read-only + 3 un-annotated). The old read-only count and the 3 auto-surfaced tools were both undercounted.
+### ✅ Finding F1 — input-field categorization inverted — RESOLVED 2026-06-22 (foreman-f1ef)
 
-### ⚠️ Finding F1 — input-field categorization is inverted (foreman-xb68 follow-up)
+> **Resolved 2026-06-22 (foreman-f1ef, branch `fix/zapier-deprecated-aliases`):** canonical trio → `READ_ONLY`; all 3 deprecated input-field aliases → `EXCLUDED`; `discovery.ts` production calls migrated to canonical SDK methods. The lockstep was **wider than first scoped** — landed across 16 files including `prompt-template.ts`, both agent instruction files, `tool-catalog.ts`, `tool-schema-sanitizer.ts`, 2 more unit tests, and 2 web landing demos. 323 unit tests pass, biome clean. (Live SDK tier updated but not executed — needs creds.) Original analysis preserved below.
 
 The SDK's **canonical** input-field methods are `getActionInputFieldsSchema` / `listActionInputFields` / `listActionInputFieldChoices`; the `*InputField*` names are **deprecated aliases**. Foreman has it backwards:
 
@@ -165,7 +171,7 @@ Net: the agent sees **5 tools for 3 operations**, with the canonical ones mis-an
 | stubbed `poll` trigger type | Trigger Inboxes (`/experimental`, not walled) | **Evaluate trigger inboxes before building a poll-driver from scratch** (foreman-bdjp / foreman-ueep) |
 | `cron-driver.ts` minute-tick | `watchTriggerInbox` (SSE) / `triggerWorkflow` | Possible future real-time replacement |
 | manual rate-limit handling | `maxConcurrentRequests` option (default 200) | Adopt — set on `createZapierSdk` |
-| (none) | `/define` durable DSL (`step`/`wait`/`createCallback`) | Not buildable for us until the durable scope opens; document as the target shape |
+| (none) | `/define` durable DSL (`step`/`wait`/`createCallback`) | **Now buildable** — the durable scope opened at v0.81.0 (foreman-e1ob); Foreman's Phase-3 automations deploy + run on it live, incl. `createCallback` human-approval gates. |
 
 ## Action-type enum (verified from `dist/types/properties.js`)
 
@@ -173,15 +179,35 @@ Net: the agent sees **5 tools for 3 operations**, with the canonical ones mis-an
 
 Unchanged. **No "create a Zap" type** — automation persistence is the (walled) durable API, not an action type. This is the structural reason Foreman owns workflow persistence.
 
-## Changelog digest 0.69.3 → 0.70.4
+## Changelog digest 0.70.4 → 0.79.0
+
+**Main-surface (affects Foreman directly):**
+- **0.79.0** trusted-deprecation machinery: SDK sniffs `zapier-sdk-deprecation-*` response headers (never on relay), warns once per notice id per process (no opt-out), and emits an `api:deprecation_notice` event (`DEPRECATION_NOTICE_EVENT` export). CLI renders a boxed stderr warning; the MCP server attaches notices to every tool result so agents relay them. **Candidate: subscribe in Foreman and surface to users.**
+- **0.78.0** kitcore plugin-model refactor (compat-bridged, behavior unchanged). Removed the deprecated `sdk.addPlugin(...)` **chain** method + no-arg `createSdk()` doorway; main now re-exports the plugin-authoring helpers (`createSdk`, `defineMethod`/`definePlugin`/`declareMethod`, `selectExports`, `addPlugin`). Foreman uses none of the removed APIs.
+- **0.77.2 / 0.77.1** published-type-declaration packaging fix (stray `import("kitcore")` leak); `@zapier/policy-context` dep slimmed.
+- **0.71.0** **`createConnection` / `getConnectionStartUrl` / `waitForNewConnection`** — connect an app from code end-to-end (mint URL → open/print → poll for the new connection). Now in the main mcp registry → auto-surfaced unless excluded (Foreman `EXCLUDED` all 3; see usage map + foreman-mcwn). Also: private-beta streaming auto-mode approval review.
+
+**Experimental/durable surface (scope-walled for Foreman — tracked, not used):**
+- **0.77.0** `triggerWorkflow` now authenticates as the account; **return shape changed** to `{ id, workflow_id, created_at }` (was `{ workflow, status, body }`).
+- **0.75.0** `listWorkflowRuns` no longer returns `output` on list items — fetch via `getWorkflowRun`.
+- **0.74.1** trigger claim-failure reason + workflow `disabled_reason` on experimental `get`/`listWorkflows`.
+- **0.73.1** camelCased input params on `runDurable`/`publishWorkflowVersion` (`sourceFiles`, `zapierDurableVersion`, `appVersions`, nested fields); snake_case kept as **deprecated aliases**.
+- **0.72.0** `listWorkflows` now paginates (`pageSize`/`cursor`; >100 rejected).
+- **0.71.1** `createWorkflow`'s `is_private` input renamed to `private` (`is_private` kept as deprecated alias; wire field unchanged).
+- **0.76.0** `./define` durable `CallbackResult<T>` typing — awaiting a `timeoutSeconds` callback resolves `{ status: "delivered"|"expired", … }`; `CallbackOptionsWithTimeout` exported.
+
+**Telemetry headers:** **0.76.2** `zapier-sdk-agent`, **0.74.0** `zapier-sdk-package-operation`, **0.73.0** standard `zapier-sdk-version`/`zapier-service`/etc. headers (legacy `x-zapier-*` still sent).
+
+(0.70.4 → 0.70.0 and 0.48 → 0.69.3 digests preserved in git history of this file; auth/behavior notes that still matter are folded into the auth model + sections above.)
+
+## Live validation (2026-06-25, v0.79.0, foreman-9t9g)
 
-- **0.70.4** response-field parity for experimental code-substrate plugins: `updateWorkflow`/`getWorkflow`/`listWorkflows` restore `is_private`, `created_by_user_id`, `triggers` (live claim status); `publishWorkflowVersion`/`getWorkflowVersion`/`listWorkflowVersions` restore `trigger`, `connections`, `app_versions`; `runDurable` input accepts `notifications` (webhook subscribers for run lifecycle). New `shared-schemas.ts`.
-- **0.70.3** TTY + agent-caller context in SDK telemetry; `get-durable-run` accepts null `last_error`.
-- **0.70.2** `listActions` no longer hardcodes `public_only:"true"` (private/unlisted apps the caller can access now appear) — COSUB-562.
-- **0.70.1** reinstate `Schema.parse()` on workflow/durable response handlers; open RunStatus/ExecutionStatus/OperationType/OperationStatus enums for forward-compat; restore `DeleteWorkflowResponseSchema`; wire `outputSchema` on `cancelDurableRun`/`deleteWorkflow`.
-- **0.70.0** `watchTriggerInbox` retries transient drain failures (5xx/429/network) with bounded backoff; new `ApiClient.fetchJsonStream` + `JsonSseMessage`.
+Ran the live SDK test tier against the real Zapier API (client-credentials via Infisical):
 
-(Earlier 0.48→0.69.3 digest preserved in git history of this file; auth/behavior notes that still matter are folded into the auth model + sections above.)
+- **Read + error-handling:** 16 passed / 1 skipped (the skip needs a real user connection — client-creds has none). All discovery/read round-trips (`list-connections`, `list-apps`, `list-actions`, read `run-action`, `get-app`, `get-action`, input-field schemas) work on 0.79.0.
+- **Write cycle:** `create-table → create-table-fields → list-table-fields → create-table-records → list-table-records → delete-table` — green, but surfaced a **response-shape change**: ⚠️ **`list-table-fields` / `list-table-records` now return the paginated envelope `{ items: [...], count }`** on 0.79.0 (the SDK test previously assumed a bare array / `.data`; assertions updated to accept `items` ?? `data` ?? raw). Foreman's generated tools pass the raw response to the LLM, so this is **not** a production break — but any future code reading those lists should expect `.items`.
+- **New capability — `getConnectionStartUrl({ app })`** (0.71, non-blocking): returns `{ data: { url, expiresAt, startedAt, app } }` — a short-lived (5-min) signed `zapier.com/sdk/connect?…&sig=…` URL. **Now shipped (foreman-mcwn):** the `connect_zapier` tool mints this signed, account-bound URL for connected users (via `getSdkForUser`), falling back to the engine deep-link otherwise. `createConnection`/`waitForNewConnection` remain excluded (they block on the user finishing).
+- **Deprecation-notice relay shipped (foreman-xjyx):** every `createZapierSdk` instance now attaches an `onEvent` handler (`lib/zapier/deprecation.ts`) that logs `api:deprecation_notice` events (`[zapier:deprecation] …`, once per id) and records them via `getZapierDeprecations()`. No notices currently fire on Foreman's endpoints.
 
 ## Reproduce / verify
 
diff --git a/package-lock.json b/package-lock.json
index 263ee7fd..405264b5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -12,7 +12,7 @@
         "packages/*"
       ],
       "devDependencies": {
-        "@biomejs/biome": "^2.4.12",
+        "@biomejs/biome": "2.4.16",
         "@copilotkit/aimock": "^1.14.3",
         "@playwright/test": "^1.59.1",
         "@tailwindcss/postcss": "^4",
@@ -23,7 +23,7 @@
         "@types/react-dom": "^19",
         "@types/supertest": "^7.2.0",
         "@vitest/ui": "^4.1.4",
-        "@zapier/zapier-sdk-cli": "^0.54.3",
+        "@zapier/zapier-sdk-cli": "^0.62.0",
         "autoprefixer": "^10.5.0",
         "drizzle-kit": "^0.31.10",
         "jsdom": "^29.0.2",
@@ -63,6 +63,19 @@
         }
       }
     },
+    "node_modules/@a2a-js/sdk/node_modules/uuid": {
+      "version": "11.1.1",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.1.tgz",
+      "integrity": "sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==",
+      "funding": [
+        "https://github.com/sponsors/broofa",
+        "https://github.com/sponsors/ctavan"
+      ],
+      "license": "MIT",
+      "bin": {
+        "uuid": "dist/esm/bin/uuid"
+      }
+    },
     "node_modules/@adobe/css-tools": {
       "version": "4.5.0",
       "resolved": "https://registry.npmjs.org/@adobe/css-tools/-/css-tools-4.5.0.tgz",
@@ -71,13 +84,13 @@
       "license": "MIT"
     },
     "node_modules/@ai-sdk/gateway": {
-      "version": "3.0.133",
-      "resolved": "https://registry.npmjs.org/@ai-sdk/gateway/-/gateway-3.0.133.tgz",
-      "integrity": "sha512-Ebs+7iS9zUgJu5B0RlxM2JmDWzq79Cpd6YdiqcCzB5qFdpfQJPUDiXutqlQP89F2XGjOdDeidulBTXUdXWzOxw==",
+      "version": "3.0.143",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/gateway/-/gateway-3.0.143.tgz",
+      "integrity": "sha512-RCH60KsUaNiZkI/fBuyau4yvYrVBIEgAcN+Ain94QpL1kVm28GduQzFKfGffAiJU2We0ZrmN4BHkoCZzACK96Q==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@ai-sdk/provider": "3.0.10",
-        "@ai-sdk/provider-utils": "4.0.30",
+        "@ai-sdk/provider": "3.0.13",
+        "@ai-sdk/provider-utils": "4.0.35",
         "@vercel/oidc": "3.2.0"
       },
       "engines": {
@@ -88,9 +101,9 @@
       }
     },
     "node_modules/@ai-sdk/provider": {
-      "version": "3.0.10",
-      "resolved": "https://registry.npmjs.org/@ai-sdk/provider/-/provider-3.0.10.tgz",
-      "integrity": "sha512-Q3BZ27qfpYqnCYGvE3vt+Qi6LGOF9R5Nmzn+9JoM1lCRsD9mYaIhfJLkSunN48nfGXJ6n+XNV0J/XVpqGQl7Dw==",
+      "version": "3.0.13",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/provider/-/provider-3.0.13.tgz",
+      "integrity": "sha512-ZPtVYt5QIJzOta1kdUiDuCx4HhFkvNPv/rvmZ2b1iXwybYjJsCnNYR4PAw4kW7rgVfDARvHXcU64efWuqNp6bw==",
       "license": "Apache-2.0",
       "dependencies": {
         "json-schema": "^0.4.0"
@@ -100,12 +113,12 @@
       }
     },
     "node_modules/@ai-sdk/provider-utils": {
-      "version": "4.0.30",
-      "resolved": "https://registry.npmjs.org/@ai-sdk/provider-utils/-/provider-utils-4.0.30.tgz",
-      "integrity": "sha512-VO7I+vPffqI5sMnPoUq5DCSqKIgQIk/naJWRdQVpz2ma2zoprC/lqiJiUEl2s6DfvTD76TbhD3q39ROjlA6rGw==",
+      "version": "4.0.35",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/provider-utils/-/provider-utils-4.0.35.tgz",
+      "integrity": "sha512-bjYld/2KGPLt78kpqbya+fD4LYS7BqVQJyUjE3qAHrYB0FR2Q90BaWEVIBZaguTWXf/A8L6uG1zO1v9TxVlGWg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@ai-sdk/provider": "3.0.10",
+        "@ai-sdk/provider": "3.0.13",
         "@standard-schema/spec": "^1.1.0",
         "eventsource-parser": "^3.0.8"
       },
@@ -164,6 +177,18 @@
         "zod": "^3.25.76 || ^4.1.8"
       }
     },
+    "node_modules/@ai-sdk/provider-utils-v6/node_modules/@ai-sdk/provider": {
+      "version": "3.0.10",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/provider/-/provider-3.0.10.tgz",
+      "integrity": "sha512-Q3BZ27qfpYqnCYGvE3vt+Qi6LGOF9R5Nmzn+9JoM1lCRsD9mYaIhfJLkSunN48nfGXJ6n+XNV0J/XVpqGQl7Dw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "json-schema": "^0.4.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@ai-sdk/provider-v5": {
       "name": "@ai-sdk/provider",
       "version": "2.0.3",
@@ -191,13 +216,13 @@
       }
     },
     "node_modules/@ai-sdk/react": {
-      "version": "3.0.210",
-      "resolved": "https://registry.npmjs.org/@ai-sdk/react/-/react-3.0.210.tgz",
-      "integrity": "sha512-VprBlyc8yvwlpIdcIICL307vRncXrLlmcRTY/7JR5ND9+LvUcxJU16yW6prClFahqEWVza8Vr8P4Bgk5ZBtp4A==",
+      "version": "3.0.221",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/react/-/react-3.0.221.tgz",
+      "integrity": "sha512-5Zd+rF0YbjOqre0NEzdNE+FvNPrEuqfHm4KGxw9ovbAHv0ut/7sgYIn2kzr6ekvXHNqWz0HEmi+zYOXOZCJxJw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@ai-sdk/provider-utils": "4.0.30",
-        "ai": "6.0.208",
+        "@ai-sdk/provider-utils": "4.0.35",
+        "ai": "6.0.219",
         "swr": "^2.2.5",
         "throttleit": "2.1.0"
       },
@@ -208,6 +233,20 @@
         "react": "^18 || ~19.0.1 || ~19.1.2 || ^19.2.1"
       }
     },
+    "node_modules/@alcalzone/ansi-tokenize": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/@alcalzone/ansi-tokenize/-/ansi-tokenize-0.3.0.tgz",
+      "integrity": "sha512-p+CMKJ93HFmLkjXKlXiVGlMQEuRb6H0MokBSwUsX+S6BRX8eV5naFZpQJFfJHjRZY0Hmnqy1/r6UWl3x+19zYA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^6.2.1",
+        "is-fullwidth-code-point": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@alloc/quick-lru": {
       "version": "5.2.0",
       "resolved": "https://registry.npmjs.org/@alloc/quick-lru/-/quick-lru-5.2.0.tgz",
@@ -234,6 +273,128 @@
         "url": "https://github.com/sponsors/antfu"
       }
     },
+    "node_modules/@anush008/tokenizers": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/@anush008/tokenizers/-/tokenizers-0.6.0.tgz",
+      "integrity": "sha512-vbKFjlFM15Ljm6HMh2FSiyPq4236xHoe31XMveTMdwqowHf1/UCwySPT331wl/wRWpdHWdQ3eU5ENl5XbXnPQQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 10"
+      },
+      "optionalDependencies": {
+        "@anush008/tokenizers-darwin-universal": "0.6.0",
+        "@anush008/tokenizers-linux-arm64-gnu": "0.6.0",
+        "@anush008/tokenizers-linux-arm64-musl": "0.6.0",
+        "@anush008/tokenizers-linux-x64-gnu": "0.6.0",
+        "@anush008/tokenizers-linux-x64-musl": "0.6.0",
+        "@anush008/tokenizers-win32-x64-msvc": "0.6.0"
+      }
+    },
+    "node_modules/@anush008/tokenizers-darwin-universal": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/@anush008/tokenizers-darwin-universal/-/tokenizers-darwin-universal-0.6.0.tgz",
+      "integrity": "sha512-s27bL2x22NiDlhthi7UjGm+Is1tpAg4riLMBzna7Knzp26RdmnhbclWNEDd5UflRzFD49sdHzqv2XP0F2XFrqA==",
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@anush008/tokenizers-linux-arm64-gnu": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/@anush008/tokenizers-linux-arm64-gnu/-/tokenizers-linux-arm64-gnu-0.6.0.tgz",
+      "integrity": "sha512-Go1ssG7AylDFpsDzLkh+nqXt1RcIGhL9pSpPH1nLF504lutxkCZcihESUt6vobtjnCONOAIwCWe1AVEoHui+9A==",
+      "cpu": [
+        "arm64"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@anush008/tokenizers-linux-arm64-musl": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/@anush008/tokenizers-linux-arm64-musl/-/tokenizers-linux-arm64-musl-0.6.0.tgz",
+      "integrity": "sha512-xfnDkjmOUXkVp5jNCnFzd8hTfAbei6UnoYetiadqbfX1o/K+drCV6sHzKadhHuPQlqa+erXdSyQDOtWkAAjN8Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@anush008/tokenizers-linux-x64-gnu": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/@anush008/tokenizers-linux-x64-gnu/-/tokenizers-linux-x64-gnu-0.6.0.tgz",
+      "integrity": "sha512-4C9KiC0tdsOJCyOE2sD23zZHW16RbytRfMf81bdkDOLOrvOy0dYT9ZTnpwEl2k7jgzSdSpk9YKCkfEpkqbVvVg==",
+      "cpu": [
+        "x64"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@anush008/tokenizers-linux-x64-musl": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/@anush008/tokenizers-linux-x64-musl/-/tokenizers-linux-x64-musl-0.6.0.tgz",
+      "integrity": "sha512-4CiqyQEFQpr7xTHv2IGZAoOKr/hIN7obTCaLvxUEjv3MHcpCGYBFpKa5RiRrcskY5k3w06dN9cRaxwsITeAHjw==",
+      "cpu": [
+        "x64"
+      ],
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@anush008/tokenizers-win32-x64-msvc": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/@anush008/tokenizers-win32-x64-msvc/-/tokenizers-win32-x64-msvc-0.6.0.tgz",
+      "integrity": "sha512-ydjCu4wLdtcS8xOr0uMbRAOHviuFNEMCFM/T/Sw4zxLb+iHS9QboSJZtxMN1VF2dOkjRchtQmLiKK0ttE1iJEQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
     "node_modules/@arcadeai/arcadejs": {
       "version": "2.4.1",
       "resolved": "https://registry.npmjs.org/@arcadeai/arcadejs/-/arcadejs-2.4.1.tgz",
@@ -295,21 +456,21 @@
       "license": "MIT"
     },
     "node_modules/@azure/msal-common": {
-      "version": "16.9.0",
-      "resolved": "https://registry.npmjs.org/@azure/msal-common/-/msal-common-16.9.0.tgz",
-      "integrity": "sha512-1MWGjqgUCRAYgLmVFZKp7fs3Rg1TFvIMgywY8ze2olNVvLlJoRThuoziWSDJuwwyJI5L4rnLb9Tyt5D9GvSLPw==",
+      "version": "16.11.0",
+      "resolved": "https://registry.npmjs.org/@azure/msal-common/-/msal-common-16.11.0.tgz",
+      "integrity": "sha512-UikJOtMwkFpZNzTH6Dqk8UTUPbow15zH3e0UjGYZy69lYENW/S05gMLhbxI2eonz66uALhIljvhsSMEb6+O30g==",
       "license": "MIT",
       "engines": {
         "node": ">=0.8.0"
       }
     },
     "node_modules/@azure/msal-node": {
-      "version": "5.2.5",
-      "resolved": "https://registry.npmjs.org/@azure/msal-node/-/msal-node-5.2.5.tgz",
-      "integrity": "sha512-RUuewWk9JvWJS5Yiy8/74Lm1rQAWlrU/qg/Bgtk1jIauVRtnb9XKwS5Xg0J+Whwjesq9EVrBIFgQEP8vHxgezA==",
+      "version": "5.3.1",
+      "resolved": "https://registry.npmjs.org/@azure/msal-node/-/msal-node-5.3.1.tgz",
+      "integrity": "sha512-sqqv3L1UOI4KDXonNtbxPYUgbSWVXqxvmmb6BUw9n4P/UXgG+cVur3dLWQN4Cz7qQ+UJROCCxMXlksm7gIq0Sw==",
       "license": "MIT",
       "dependencies": {
-        "@azure/msal-common": "16.9.0",
+        "@azure/msal-common": "16.11.0",
         "jsonwebtoken": "^9.0.0"
       },
       "engines": {
@@ -449,6 +610,13 @@
         "semver": "bin/semver.js"
       }
     },
+    "node_modules/@babel/helper-compilation-targets/node_modules/yallist": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
+      "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==",
+      "devOptional": true,
+      "license": "ISC"
+    },
     "node_modules/@babel/helper-create-class-features-plugin": {
       "version": "7.29.7",
       "resolved": "https://registry.npmjs.org/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.29.7.tgz",
@@ -799,13 +967,13 @@
       }
     },
     "node_modules/@base-ui/react": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/@base-ui/react/-/react-1.5.0.tgz",
-      "integrity": "sha512-z1gSAlced1yY+iM+mHDEtIkD8UI3Ebs52MuBPxvV6f5hRutk+xvCH/wuB7hDqDzK9JG5FoMz5nhrqtSs1wjt1A==",
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/@base-ui/react/-/react-1.6.0.tgz",
+      "integrity": "sha512-/jzjTWJYXhRFO45Bev9lc3cHbmjzCMpUqbMZ2AgKy/z25mY9B6shGSNcXcjQar9n5doM0KYW1W8fcFv2jZBuMw==",
       "license": "MIT",
       "dependencies": {
         "@babel/runtime": "^7.29.2",
-        "@base-ui/utils": "0.2.9",
+        "@base-ui/utils": "0.3.1",
         "@floating-ui/react-dom": "^2.1.8",
         "@floating-ui/utils": "^0.2.11",
         "use-sync-external-store": "^1.6.0"
@@ -837,14 +1005,14 @@
       }
     },
     "node_modules/@base-ui/utils": {
-      "version": "0.2.9",
-      "resolved": "https://registry.npmjs.org/@base-ui/utils/-/utils-0.2.9.tgz",
-      "integrity": "sha512-x/PDDCYzoqPpjrdyb3VcyylTI2IjUXEtYDGi5foh7KsnmNJIIaVwA2GLgDH1dps1GgXiJbA60hM+AyuTfQzIvw==",
+      "version": "0.3.1",
+      "resolved": "https://registry.npmjs.org/@base-ui/utils/-/utils-0.3.1.tgz",
+      "integrity": "sha512-gFFiltORVmW/N6IILTGxizP3PBpVpysqML1ALY5Vk0mH+7faVkCknOU31goYHN5Aoek2dkjxva1XOD2Ce9WuIg==",
       "license": "MIT",
       "dependencies": {
         "@babel/runtime": "^7.29.2",
         "@floating-ui/utils": "^0.2.11",
-        "reselect": "^5.1.1",
+        "reselect": "^5.2.0",
         "use-sync-external-store": "^1.6.0"
       },
       "peerDependencies": {
@@ -859,9 +1027,9 @@
       }
     },
     "node_modules/@biomejs/biome": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/@biomejs/biome/-/biome-2.5.0.tgz",
-      "integrity": "sha512-4kURkd9hAPrdDM3C9n82ycYgx8hvQcW6MjKTEejruj8rK0N8P3OPpdy8BvI8kt3KWY4ycF5XtDOrktetEfhfuw==",
+      "version": "2.4.16",
+      "resolved": "https://registry.npmjs.org/@biomejs/biome/-/biome-2.4.16.tgz",
+      "integrity": "sha512-x9ajFh1zChVybCiM3TN6OD4phAqLgtPZjFrZF+aTMYCPjwBO+k529TX7PPsAqtGNLeV4UgzwQnowEgS7bGmzcA==",
       "dev": true,
       "license": "MIT OR Apache-2.0",
       "bin": {
@@ -875,20 +1043,20 @@
         "url": "https://opencollective.com/biome"
       },
       "optionalDependencies": {
-        "@biomejs/cli-darwin-arm64": "2.5.0",
-        "@biomejs/cli-darwin-x64": "2.5.0",
-        "@biomejs/cli-linux-arm64": "2.5.0",
-        "@biomejs/cli-linux-arm64-musl": "2.5.0",
-        "@biomejs/cli-linux-x64": "2.5.0",
-        "@biomejs/cli-linux-x64-musl": "2.5.0",
-        "@biomejs/cli-win32-arm64": "2.5.0",
-        "@biomejs/cli-win32-x64": "2.5.0"
+        "@biomejs/cli-darwin-arm64": "2.4.16",
+        "@biomejs/cli-darwin-x64": "2.4.16",
+        "@biomejs/cli-linux-arm64": "2.4.16",
+        "@biomejs/cli-linux-arm64-musl": "2.4.16",
+        "@biomejs/cli-linux-x64": "2.4.16",
+        "@biomejs/cli-linux-x64-musl": "2.4.16",
+        "@biomejs/cli-win32-arm64": "2.4.16",
+        "@biomejs/cli-win32-x64": "2.4.16"
       }
     },
     "node_modules/@biomejs/cli-darwin-arm64": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-arm64/-/cli-darwin-arm64-2.5.0.tgz",
-      "integrity": "sha512-Mn3Fwi3SA5fgmfCPqmzpWF2DLZnms3BVAhM088nTnGrTZmHS3wwIjcoZPqpXeNgd3DrrLH6xp8vTLIBuJoZiXw==",
+      "version": "2.4.16",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-arm64/-/cli-darwin-arm64-2.4.16.tgz",
+      "integrity": "sha512-wxPvu4XOA85YJk9ixSWUmq/QBHbid85BISbOAqqBM/5xQpPk9ayjk5375tOlSC0BeCwNSbPFafQBm+vBumXq0A==",
       "cpu": [
         "arm64"
       ],
@@ -903,9 +1071,9 @@
       }
     },
     "node_modules/@biomejs/cli-darwin-x64": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-x64/-/cli-darwin-x64-2.5.0.tgz",
-      "integrity": "sha512-rg3VPL5P8mYro6pqlXYXuJWph21slVp3SZtAqWSrkZs40d2gTzYmHF8E/X1iTID25btmNKltNDJ926sqVBp7DQ==",
+      "version": "2.4.16",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-x64/-/cli-darwin-x64-2.4.16.tgz",
+      "integrity": "sha512-xFCqGPwYusQJp4N4NJLi1XJiZqjwFdjhT+KqtNy+Ug3qgfczqnTa6MSDvxJF6TkuDLoYJItMapz6tAf7kCekFw==",
       "cpu": [
         "x64"
       ],
@@ -920,9 +1088,9 @@
       }
     },
     "node_modules/@biomejs/cli-linux-arm64": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64/-/cli-linux-arm64-2.5.0.tgz",
-      "integrity": "sha512-tl+LW8fdD96/xdeWtWwc82LIOc5CoY7N2AsogLTp5R4ECErYt+8Jl/N68ezN9vzSiqPTxw6vjcihoLPYKZHrlw==",
+      "version": "2.4.16",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64/-/cli-linux-arm64-2.4.16.tgz",
+      "integrity": "sha512-2kFb4//jxfZaP6D+Rj5VkHkxgyD9EoRAVBEQb8PKRv+s4NO2zYNJKXFaJmK1CmhufJOWEfpHKaRbOja7qjmdhQ==",
       "cpu": [
         "arm64"
       ],
@@ -940,9 +1108,9 @@
       }
     },
     "node_modules/@biomejs/cli-linux-arm64-musl": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.5.0.tgz",
-      "integrity": "sha512-vQdM4oSGaf7ZNeGO9w5+Y8SBtyser9M6znxYbm7Ec8wInxJu1WiKxFYZW5Auj2d80bcVvefuGGRxoFOE0eee8g==",
+      "version": "2.4.16",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.4.16.tgz",
+      "integrity": "sha512-oYxnW0ARfJkr72ezzF2OR8N/rtkgLUQeYtF8cFhVswbknHxtTcmzSsanVJP8yQKnGpGpc2ck6c5zLvHahL6Cbg==",
       "cpu": [
         "arm64"
       ],
@@ -960,9 +1128,9 @@
       }
     },
     "node_modules/@biomejs/cli-linux-x64": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64/-/cli-linux-x64-2.5.0.tgz",
-      "integrity": "sha512-zpEGf4RQbFEh8Vt7OmavLyyOzRbtcE9osCqrS1kfvt8jDvxwhKXLSf7n0ebr/ov0RJ9ssP+lhs6C8a9WwFvrQA==",
+      "version": "2.4.16",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64/-/cli-linux-x64-2.4.16.tgz",
+      "integrity": "sha512-NbcBbi/nJqn5baae6wqRXdS7Gadf2uRpehSh6vMSYpG8OhkXl/Xg8aorWrJ+9VWqAT5ml90alLvorkpMW0nBwQ==",
       "cpu": [
         "x64"
       ],
@@ -980,9 +1148,9 @@
       }
     },
     "node_modules/@biomejs/cli-linux-x64-musl": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64-musl/-/cli-linux-x64-musl-2.5.0.tgz",
-      "integrity": "sha512-+9hIcMngJ+yGUahXqZuZ8CoWKJE9SAZsFsM3QDvXpNsLbXZ9lqVzgBhOk/jTSYkOA0GLP9eu3teukqpLUojHMg==",
+      "version": "2.4.16",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64-musl/-/cli-linux-x64-musl-2.4.16.tgz",
+      "integrity": "sha512-iHDS+MCM65DPqWGu+ECC3uoALyj2H7F4nVUPxIPjz/PIl94EUu+EDfGZDzFP+NY1EOPVt9NQvwFqq7HdMmowdg==",
       "cpu": [
         "x64"
       ],
@@ -1000,9 +1168,9 @@
       }
     },
     "node_modules/@biomejs/cli-win32-arm64": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-arm64/-/cli-win32-arm64-2.5.0.tgz",
-      "integrity": "sha512-jB0wAvTLI4itx5VidqVUejPQFhRUxiZ9l9FvZ26D5fl6t3qme+ZB4PD3bTSeL1vZ8NI2Rx/zj6H9zcESuGHKGw==",
+      "version": "2.4.16",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-arm64/-/cli-win32-arm64-2.4.16.tgz",
+      "integrity": "sha512-0rgImMsNb5v/chhkIFe3wu7PEFClS6RBAYUijGL9UsYN3PanSaoK24HSSuSJb1pYbYYVjzAyZTl3gtjJ84BM8A==",
       "cpu": [
         "arm64"
       ],
@@ -1017,9 +1185,9 @@
       }
     },
     "node_modules/@biomejs/cli-win32-x64": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-x64/-/cli-win32-x64-2.5.0.tgz",
-      "integrity": "sha512-VT/lF+GId+67j8aDfLkxdxNoVApsPSTbyAtB3jJq0IWTrY77WXfbPfpngxq0bA6JCEv/7k8C9qWjDRKRznDlyw==",
+      "version": "2.4.16",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-x64/-/cli-win32-x64-2.4.16.tgz",
+      "integrity": "sha512-Kp85jgoBHa05gix6UIRjfCDiUV3w/8VIdZ247VyyO2gEjaw12WEVhdIjlxp/AMzXxqxQwbxNTDVZ3Mwd2RG5rw==",
       "cpu": [
         "x64"
       ],
@@ -1053,13 +1221,13 @@
       }
     },
     "node_modules/@chat-adapter/discord": {
-      "version": "4.31.0",
-      "resolved": "https://registry.npmjs.org/@chat-adapter/discord/-/discord-4.31.0.tgz",
-      "integrity": "sha512-1dVw1+6ZBwdVh5ynLK9D+SyHdPWIBbiPmKRC+WhzDSddR8eySswcBiDUKaDMUaOmvJavPvibJLwWbohUSBiJww==",
+      "version": "4.32.0",
+      "resolved": "https://registry.npmjs.org/@chat-adapter/discord/-/discord-4.32.0.tgz",
+      "integrity": "sha512-npJGIv0jjhhupKdLSF6Di+64mJXFkwEDfx/DOlDn41x66KnJjx2QcqvkuPBpx557kSwWXLgwIq5KWx/rQ+tEPg==",
       "license": "MIT",
       "dependencies": {
-        "@chat-adapter/shared": "4.31.0",
-        "chat": "4.31.0",
+        "@chat-adapter/shared": "4.32.0",
+        "chat": "4.32.0",
         "discord-api-types": "^0.37.119",
         "discord-interactions": "^4.4.0",
         "discord.js": "^14.25.1"
@@ -1069,126 +1237,126 @@
       }
     },
     "node_modules/@chat-adapter/gchat": {
-      "version": "4.31.0",
-      "resolved": "https://registry.npmjs.org/@chat-adapter/gchat/-/gchat-4.31.0.tgz",
-      "integrity": "sha512-4g7k7rJjTJJmtkuAoU3uGp87zNlebhzP+IJcxd9YrfK83/kApB/El5PGtn2P2SF/x5fl+EkOR9r/hWmH1U7Iyg==",
+      "version": "4.32.0",
+      "resolved": "https://registry.npmjs.org/@chat-adapter/gchat/-/gchat-4.32.0.tgz",
+      "integrity": "sha512-QQRRpTmsIt1seYeZONalIurzpxJqHC1g8GEG+TJaCD5OamL65c4GTQJhRdA7FBgOZHEkvwT/TiKNwp4twK0cCA==",
       "license": "MIT",
       "dependencies": {
-        "@chat-adapter/shared": "4.31.0",
+        "@chat-adapter/shared": "4.32.0",
         "@googleapis/chat": "^44.6.0",
         "@googleapis/workspaceevents": "^9.1.0",
-        "chat": "4.31.0"
+        "chat": "4.32.0"
       },
       "engines": {
         "node": ">=20"
       }
     },
     "node_modules/@chat-adapter/github": {
-      "version": "4.31.0",
-      "resolved": "https://registry.npmjs.org/@chat-adapter/github/-/github-4.31.0.tgz",
-      "integrity": "sha512-yMKNR5WWMoCP1jGCxOigI6NrgC7Dm60zuy6ey1BgNPjgA6n769ZI8dvf+N6wgwqFHOeqSNIYhNnT/ojB6WsjtQ==",
+      "version": "4.32.0",
+      "resolved": "https://registry.npmjs.org/@chat-adapter/github/-/github-4.32.0.tgz",
+      "integrity": "sha512-0HHSI2rd7XXE3rt37uUS+zWbTK6JSl1mAUtQk5hm1SBtyP23BV4B4pDCdR/X5Eo9e0i9sMNYR7CNwfab1+7g3Q==",
       "license": "MIT",
       "dependencies": {
-        "@chat-adapter/shared": "4.31.0",
+        "@chat-adapter/shared": "4.32.0",
         "@octokit/auth-app": "^8.2.0",
         "@octokit/rest": "^22.0.1",
-        "chat": "4.31.0"
+        "chat": "4.32.0"
       },
       "engines": {
         "node": ">=20"
       }
     },
     "node_modules/@chat-adapter/linear": {
-      "version": "4.31.0",
-      "resolved": "https://registry.npmjs.org/@chat-adapter/linear/-/linear-4.31.0.tgz",
-      "integrity": "sha512-myEDw3LoSDaVCjLQ4nDNWK3XFTVa+asO3/78qRxEv76kl1izcYi0g0BhZvozdJgswkKeZC2AaLzvN8GEerKZPw==",
+      "version": "4.32.0",
+      "resolved": "https://registry.npmjs.org/@chat-adapter/linear/-/linear-4.32.0.tgz",
+      "integrity": "sha512-ibOpeURIjpjxF2OyJ3hTYnVbT2oSKRbOUFhb+KJaw+YBUUHTXwcPCeUGhW+dLVBKOFiBZU3hO12eYbpXueQobA==",
       "license": "MIT",
       "dependencies": {
-        "@chat-adapter/shared": "4.31.0",
+        "@chat-adapter/shared": "4.32.0",
         "@linear/sdk": "^76.0.0",
-        "chat": "4.31.0"
+        "chat": "4.32.0"
       },
       "engines": {
         "node": ">=20"
       }
     },
     "node_modules/@chat-adapter/shared": {
-      "version": "4.31.0",
-      "resolved": "https://registry.npmjs.org/@chat-adapter/shared/-/shared-4.31.0.tgz",
-      "integrity": "sha512-vT/0S/LKSU5QTz5xJNWdiGp1jl55x0o8Z9I2VqlHfwjOKxVR87z++bQjXlE99w6BAxZjSYhWErlveyKo4LiDGg==",
+      "version": "4.32.0",
+      "resolved": "https://registry.npmjs.org/@chat-adapter/shared/-/shared-4.32.0.tgz",
+      "integrity": "sha512-ANXYe2dbSmr9A+yUAnV8TfFht4GM6f3zR5LnAYtQdNnRI9CJfXIUXuhRaVBe5RD8IEgGXyGi4BKj5qdjBtUumA==",
       "license": "MIT",
       "dependencies": {
-        "chat": "4.31.0"
+        "chat": "4.32.0"
       },
       "engines": {
         "node": ">=20"
       }
     },
     "node_modules/@chat-adapter/slack": {
-      "version": "4.31.0",
-      "resolved": "https://registry.npmjs.org/@chat-adapter/slack/-/slack-4.31.0.tgz",
-      "integrity": "sha512-b+nUizoTQac0gNEaZ+F4XAYcFtynXufpGUYMkeSwfiD9najoQEKXpvZya8PgqX1Ddn3SPddeJ/ip+RS2oQuBLA==",
+      "version": "4.32.0",
+      "resolved": "https://registry.npmjs.org/@chat-adapter/slack/-/slack-4.32.0.tgz",
+      "integrity": "sha512-QZ7KYV8K1w5O91JzMuz5qTCpUaWfEgcxr/UFrBKSp30ZdaHbLH7BqOXHYLoFVwFnoEwKpInCgCgpEl36IU9ffQ==",
       "license": "MIT",
       "dependencies": {
-        "@chat-adapter/shared": "4.31.0",
+        "@chat-adapter/shared": "4.32.0",
         "@slack/socket-mode": "^2.0.5",
         "@slack/web-api": "^7.14.0",
-        "chat": "4.31.0"
+        "chat": "4.32.0"
       },
       "engines": {
         "node": ">=20"
       }
     },
     "node_modules/@chat-adapter/state-memory": {
-      "version": "4.31.0",
-      "resolved": "https://registry.npmjs.org/@chat-adapter/state-memory/-/state-memory-4.31.0.tgz",
-      "integrity": "sha512-QsxWce5OaY+j980dRCfFZSIoVHtg+gOg6p4IOWVsB4vxwXFin8CNg/hd34kvnmzqizbD/tmLze0Pkq/sKC4NLg==",
+      "version": "4.32.0",
+      "resolved": "https://registry.npmjs.org/@chat-adapter/state-memory/-/state-memory-4.32.0.tgz",
+      "integrity": "sha512-fN91ZzjRUUhgeVReukvrDkaaQXC+x0jETR+77vg67y95g1LnUaqSFBz+WOyYLaTT7i7JGz9aEMlBNt6uYu66dg==",
       "license": "MIT",
       "dependencies": {
-        "chat": "4.31.0"
+        "chat": "4.32.0"
       },
       "engines": {
         "node": ">=20"
       }
     },
     "node_modules/@chat-adapter/teams": {
-      "version": "4.31.0",
-      "resolved": "https://registry.npmjs.org/@chat-adapter/teams/-/teams-4.31.0.tgz",
-      "integrity": "sha512-SGkwO8XqoRHrmWThNEomWc1Tcn7GdoiO6TBod9ixbUKz6MuV4ovYVwWLaxnO8wjPA/W5KoPvPIwSEZiuNpRymw==",
+      "version": "4.32.0",
+      "resolved": "https://registry.npmjs.org/@chat-adapter/teams/-/teams-4.32.0.tgz",
+      "integrity": "sha512-g5NIBsAjpQDnxhNzuKLB+1TusoNdeANCecX/HKpyei369//YJdZE0VmXDHtZEwAAaF2zvJ5ZmVHcVRo5VJUmVg==",
       "license": "MIT",
       "dependencies": {
-        "@chat-adapter/shared": "4.31.0",
+        "@chat-adapter/shared": "4.32.0",
         "@microsoft/teams.api": "^2.0.8",
         "@microsoft/teams.apps": "^2.0.8",
         "@microsoft/teams.cards": "^2.0.8",
         "@microsoft/teams.graph-endpoints": "^2.0.8",
-        "chat": "4.31.0"
+        "chat": "4.32.0"
       },
       "engines": {
         "node": ">=20"
       }
     },
     "node_modules/@chat-adapter/telegram": {
-      "version": "4.31.0",
-      "resolved": "https://registry.npmjs.org/@chat-adapter/telegram/-/telegram-4.31.0.tgz",
-      "integrity": "sha512-kwhPKkhhRzt82XTunCD1cROkJOo+c1cpOEzSXT3RX6BIcVwqikh6k7qTSPG6gmBPiouMbNnvzgnQYFgA7FZJPw==",
+      "version": "4.32.0",
+      "resolved": "https://registry.npmjs.org/@chat-adapter/telegram/-/telegram-4.32.0.tgz",
+      "integrity": "sha512-3QzXYJsT3vJMAP0KDrhSyppJ5bKo243ruytgCPyjqJ2J705J6Wy+KLD41b24hp6swYhpNGH1s5xOHpvPbNg/0g==",
       "license": "MIT",
       "dependencies": {
-        "@chat-adapter/shared": "4.31.0",
-        "chat": "4.31.0"
+        "@chat-adapter/shared": "4.32.0",
+        "chat": "4.32.0"
       },
       "engines": {
         "node": ">=20"
       }
     },
     "node_modules/@chat-adapter/whatsapp": {
-      "version": "4.31.0",
-      "resolved": "https://registry.npmjs.org/@chat-adapter/whatsapp/-/whatsapp-4.31.0.tgz",
-      "integrity": "sha512-aDLs2N1rVtci6CZ4dc2bSglBU1+QytPnMmKIVxy6W9fN/vPvv7tKbiCDNY6g5HIiixqU7QizHQ0Zbd4LOImJ0w==",
+      "version": "4.32.0",
+      "resolved": "https://registry.npmjs.org/@chat-adapter/whatsapp/-/whatsapp-4.32.0.tgz",
+      "integrity": "sha512-n3MbH4aSYpAk4mFKjuAvva4yJH94n1WA+47xNOHu7TLgoIPt1i96DOsERXCpiKqGlC/Nc+1/04DgYGzSTj6WWQ==",
       "license": "MIT",
       "dependencies": {
-        "@chat-adapter/shared": "4.31.0",
-        "chat": "4.31.0"
+        "@chat-adapter/shared": "4.32.0",
+        "chat": "4.32.0"
       },
       "engines": {
         "node": ">=20"
@@ -1201,9 +1369,9 @@
       "license": "Apache-2.0"
     },
     "node_modules/@clack/core": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@clack/core/-/core-1.4.1.tgz",
-      "integrity": "sha512-FILJa1gGKEFTGZAJE9RpVhrjKz3c3h4ar60dSv6cGuDqufQ84YEIS3GAGvZiN+H6yaLbbvTFNejjCC4tXpZEuw==",
+      "version": "1.4.3",
+      "resolved": "https://registry.npmjs.org/@clack/core/-/core-1.4.3.tgz",
+      "integrity": "sha512-/kr3UWNtdJfxZtPgDqUOmG2pvwlmcLGheex5yiZKdwbzZJxhV+HMNR9QNmyY5cGwTNV6LrR7Jtp+KjhUAP1qBQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1215,13 +1383,13 @@
       }
     },
     "node_modules/@clack/prompts": {
-      "version": "1.5.1",
-      "resolved": "https://registry.npmjs.org/@clack/prompts/-/prompts-1.5.1.tgz",
-      "integrity": "sha512-zccHj2z2oCCO4yrDiRSlFOxWerGqRiysP7a5jPK6uoI9URKAquwY42Dd/iUP8JWHxEzdRe4TlbvZCo8z1/mhrw==",
+      "version": "1.7.0",
+      "resolved": "https://registry.npmjs.org/@clack/prompts/-/prompts-1.7.0.tgz",
+      "integrity": "sha512-y7/yvZ2TPAnR9+jnc00klvNNLkJiXFFrQA/hlLCcxA9a2A4zQIOimyFQ9XfwYKiGD1fb5GY8vbKIIgO8d5Tb2A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@clack/core": "1.4.1",
+        "@clack/core": "1.4.3",
         "fast-string-width": "^3.0.2",
         "fast-wrap-ansi": "^0.2.0",
         "sisteransi": "^1.0.5"
@@ -1243,13 +1411,13 @@
       }
     },
     "node_modules/@codemirror/commands": {
-      "version": "6.10.3",
-      "resolved": "https://registry.npmjs.org/@codemirror/commands/-/commands-6.10.3.tgz",
-      "integrity": "sha512-JFRiqhKu+bvSkDLI+rUhJwSxQxYb759W5GBezE8Uc8mHLqC9aV/9aTC7yJSqCtB3F00pylrLCwnyS91Ap5ej4Q==",
+      "version": "6.10.4",
+      "resolved": "https://registry.npmjs.org/@codemirror/commands/-/commands-6.10.4.tgz",
+      "integrity": "sha512-Ryk9y9T0FFVF0cUGhAknveAyUOl/A1qReTFi+qPKtOh2Z9F4AUBz3XOrYD4ZEgZirdugVzHvd/2/Wcwy5OliTg==",
       "license": "MIT",
       "dependencies": {
         "@codemirror/language": "^6.0.0",
-        "@codemirror/state": "^6.6.0",
+        "@codemirror/state": "^6.7.0",
         "@codemirror/view": "^6.27.0",
         "@lezer/common": "^1.1.0"
       }
@@ -1268,9 +1436,9 @@
       }
     },
     "node_modules/@codemirror/language": {
-      "version": "6.12.3",
-      "resolved": "https://registry.npmjs.org/@codemirror/language/-/language-6.12.3.tgz",
-      "integrity": "sha512-QwCZW6Tt1siP37Jet9Tb02Zs81TQt6qQrZR2H+eGMcFsL1zMrk2/b9CLC7/9ieP1fjIUMgviLWMmgiHoJrj+ZA==",
+      "version": "6.12.4",
+      "resolved": "https://registry.npmjs.org/@codemirror/language/-/language-6.12.4.tgz",
+      "integrity": "sha512-1q4PaT+o6PbgpkJt4Q8Fv5XJxTy4FUZ4MWETtyiDw3J0Pyr9E2vqcKL+k9wcvjNTIsauxvE7OfmWj3FRPHQ76A==",
       "license": "MIT",
       "dependencies": {
         "@codemirror/state": "^6.0.0",
@@ -1304,9 +1472,9 @@
       }
     },
     "node_modules/@codemirror/state": {
-      "version": "6.6.0",
-      "resolved": "https://registry.npmjs.org/@codemirror/state/-/state-6.6.0.tgz",
-      "integrity": "sha512-4nbvra5R5EtiCzr9BTHiTLc+MLXK2QGiAVYMyi8PkQd3SR+6ixar/Q/01Fa21TBIDOZXgeWV4WppsQolSreAPQ==",
+      "version": "6.7.0",
+      "resolved": "https://registry.npmjs.org/@codemirror/state/-/state-6.7.0.tgz",
+      "integrity": "sha512-Zbl9NyscLMZkfXPQnNAIIAFftidrA1UbcJEIMp24C0Bukc2I5T8wJS0wsXYsnDOqCFJUeJ1BITGNs5CqPDSmSg==",
       "license": "MIT",
       "dependencies": {
         "@marijn/find-cluster-break": "^1.0.0"
@@ -1325,12 +1493,12 @@
       }
     },
     "node_modules/@codemirror/view": {
-      "version": "6.43.1",
-      "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.43.1.tgz",
-      "integrity": "sha512-+BIjw/AG3tDQ4pJgTLPYdAW25eDE66YsvM4LKyVPgGzVgZ4a9Wj1SRX8kPVKgBDdPt8oHtZ15F0qx7p0oOHdHw==",
+      "version": "6.43.5",
+      "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.43.5.tgz",
+      "integrity": "sha512-7uT/vUgH6dfXWn3WqOe23KneILMvGy5wQjNMEcRXLKzziJ9NOktpW6tGoyQpwVkBgE5Gj6hKkCcsddbnkaWrOQ==",
       "license": "MIT",
       "dependencies": {
-        "@codemirror/state": "^6.6.0",
+        "@codemirror/state": "^6.7.0",
         "crelt": "^1.0.6",
         "style-mod": "^4.1.0",
         "w3c-keyname": "^2.2.4"
@@ -1427,9 +1595,9 @@
       }
     },
     "node_modules/@copilotkit/aimock": {
-      "version": "1.31.0",
-      "resolved": "https://registry.npmjs.org/@copilotkit/aimock/-/aimock-1.31.0.tgz",
-      "integrity": "sha512-h5NjwBphbxS82biVpRzDYnMduJzT61B3gEbUXpdtOJMS9kuj0vnbM+aRqPBEFnFJeIgULaLB1TxROGy0TBL09g==",
+      "version": "1.35.0",
+      "resolved": "https://registry.npmjs.org/@copilotkit/aimock/-/aimock-1.35.0.tgz",
+      "integrity": "sha512-dWtNUeaWD4jaC3Kv9oBiCoIczENM6u8pWBCmybn0/hSFEY57yqCtOGPsVNIG/YlmwbH8p5sgtL6xZzo1FnPi8g==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -1453,9 +1621,9 @@
       }
     },
     "node_modules/@csstools/color-helpers": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-6.0.2.tgz",
-      "integrity": "sha512-LMGQLS9EuADloEFkcTBR3BwV/CGHV7zyDxVRtVDTwdI2Ca4it0CCVTT9wCkxSgokjE5Ho41hEPgb8OEUwoXr6Q==",
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-6.1.0.tgz",
+      "integrity": "sha512-064IFJdjTfUqnjpCVpMOdbr8FLQBhinbZj6yRv2An2E41O/pLEXqfFRWqGq/SxlE5PEUYTlvWsG2r8MswAVvkg==",
       "dev": true,
       "funding": [
         {
@@ -1497,9 +1665,9 @@
       }
     },
     "node_modules/@csstools/css-color-parser": {
-      "version": "4.1.7",
-      "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-4.1.7.tgz",
-      "integrity": "sha512-CmjJFQTFQx/U/xNJhSjCQ0ilpesPmNQ8+eOUeM/+kDOVW33qsIjeOXc27vrQDdWVkf83ZSWwtg7kXSUvKDJ8cQ==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-4.1.9.tgz",
+      "integrity": "sha512-paQcIaOO53Rk5+YrBaBjm/SgrV4INImjo2BT1DtQRYr+XeTRbeAYlS+jxXp9drqvKmtFnWRJKIalDLhZZDu42A==",
       "dev": true,
       "funding": [
         {
@@ -1513,7 +1681,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "@csstools/color-helpers": "^6.0.2",
+        "@csstools/color-helpers": "^6.1.0",
         "@csstools/css-calc": "^3.2.1"
       },
       "engines": {
@@ -1548,9 +1716,9 @@
       }
     },
     "node_modules/@csstools/css-syntax-patches-for-csstree": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@csstools/css-syntax-patches-for-csstree/-/css-syntax-patches-for-csstree-1.1.5.tgz",
-      "integrity": "sha512-oNjBvzLq2GPZtJphCjLqXow/cHySHSgtxvKZb7OqSZ/xHgw6NWNhfad+6AB9cLeVm6eA9d/qMll3JdEHjy6M+A==",
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/@csstools/css-syntax-patches-for-csstree/-/css-syntax-patches-for-csstree-1.1.6.tgz",
+      "integrity": "sha512-TcJCWFbXLPpJYq6z7bfOyjWYJDiDg2/I4gyUC9pqPNqHFRIey0EB0q0L5cSnQDfWJg8Jd6VadakxdIez/3zkqQ==",
       "dev": true,
       "funding": [
         {
@@ -1715,6 +1883,15 @@
         "scripts/actions/documentation"
       ]
     },
+    "node_modules/@discordjs/rest/node_modules/undici": {
+      "version": "6.24.1",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.24.1.tgz",
+      "integrity": "sha512-sC+b0tB1whOCzbtlx20fx3WgCXwkW627p4EA9uM+/tNNPkSS+eSEld6pAs9nDv7WbY1UUljBMYPtu9BCOrCWKA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.17"
+      }
+    },
     "node_modules/@discordjs/util": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/@discordjs/util/-/util-1.2.0.tgz",
@@ -1790,166 +1967,22 @@
       "dev": true,
       "license": "Apache-2.0"
     },
-    "node_modules/@duckdb/node-api": {
-      "version": "1.5.2-r.2",
-      "resolved": "https://registry.npmjs.org/@duckdb/node-api/-/node-api-1.5.2-r.2.tgz",
-      "integrity": "sha512-IqFeTarPL9sImt8R6Y/NbNjTR95c7fksk9uFCpFLV0hxbIzbNCCF//xy2BgBqVJtU7/gk2eIpTJTvtE6FS2eog==",
-      "license": "MIT",
-      "dependencies": {
-        "@duckdb/node-bindings": "1.5.2-r.2"
-      }
-    },
-    "node_modules/@duckdb/node-bindings": {
-      "version": "1.5.2-r.2",
-      "resolved": "https://registry.npmjs.org/@duckdb/node-bindings/-/node-bindings-1.5.2-r.2.tgz",
-      "integrity": "sha512-A17A6pXB7SEBAm93POdmEG+f4vQWMSujUP8/hNUfDWjaqp4C5mUWFnyuBM4XiB4qyXXH3vbjis2TYsnxAN2xEQ==",
-      "license": "MIT",
-      "dependencies": {
-        "detect-libc": "^2.1.2"
-      },
-      "optionalDependencies": {
-        "@duckdb/node-bindings-darwin-arm64": "1.5.2-r.2",
-        "@duckdb/node-bindings-darwin-x64": "1.5.2-r.2",
-        "@duckdb/node-bindings-linux-arm64": "1.5.2-r.2",
-        "@duckdb/node-bindings-linux-arm64-musl": "1.5.2-r.2",
-        "@duckdb/node-bindings-linux-x64": "1.5.2-r.2",
-        "@duckdb/node-bindings-linux-x64-musl": "1.5.2-r.2",
-        "@duckdb/node-bindings-win32-arm64": "1.5.2-r.2",
-        "@duckdb/node-bindings-win32-x64": "1.5.2-r.2"
-      }
-    },
-    "node_modules/@duckdb/node-bindings-darwin-arm64": {
-      "version": "1.5.2-r.2",
-      "resolved": "https://registry.npmjs.org/@duckdb/node-bindings-darwin-arm64/-/node-bindings-darwin-arm64-1.5.2-r.2.tgz",
-      "integrity": "sha512-wA50u8kQxEXlf2ho1m/n8K4qdIWNNBUZ8xQ02x+9Vc12GAgabSlnXJOaZZFrby5Dj28y+mFBIfAEGftBeQKXaw==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@duckdb/node-bindings-darwin-x64": {
-      "version": "1.5.2-r.2",
-      "resolved": "https://registry.npmjs.org/@duckdb/node-bindings-darwin-x64/-/node-bindings-darwin-x64-1.5.2-r.2.tgz",
-      "integrity": "sha512-UJHIhxkHMpdzTnyXVqsGOZotG+TzwAqkX0POM20IkQVtWtFjPS52Kc9Q+qLrS8ZuabmnrFtX9AnlHNyPVqSqMA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@duckdb/node-bindings-linux-arm64": {
-      "version": "1.5.2-r.2",
-      "resolved": "https://registry.npmjs.org/@duckdb/node-bindings-linux-arm64/-/node-bindings-linux-arm64-1.5.2-r.2.tgz",
-      "integrity": "sha512-cAEALsSxYRzSfUgxAJCNbDZcmdlVQWvEKldd7r8lYWYZ7D2mxBjeLrF0WoL34vl+ZNEgqHAuqiv3I+wMU2dOXA==",
-      "cpu": [
-        "arm64"
-      ],
-      "libc": [
-        "glibc"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@duckdb/node-bindings-linux-arm64-musl": {
-      "version": "1.5.2-r.2",
-      "resolved": "https://registry.npmjs.org/@duckdb/node-bindings-linux-arm64-musl/-/node-bindings-linux-arm64-musl-1.5.2-r.2.tgz",
-      "integrity": "sha512-PVC9feqV+bgsnzGfiCv1pe+9mNqoC8k15/3Qmwhp6+AUloTNtk1ln9wlsHMUzhRfNG2wb2fN8P9PJ5zY5t/J/w==",
-      "cpu": [
-        "arm64"
-      ],
-      "libc": [
-        "musl"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@duckdb/node-bindings-linux-x64": {
-      "version": "1.5.2-r.2",
-      "resolved": "https://registry.npmjs.org/@duckdb/node-bindings-linux-x64/-/node-bindings-linux-x64-1.5.2-r.2.tgz",
-      "integrity": "sha512-9SgKECgVtkDK6+HLBbDKxW41ORj+BciQjSgERFfhnuPIDYhgx08wTPZcnaU7KxvNdOmndIn5OmjzKZ6Jrvwv0g==",
-      "cpu": [
-        "x64"
-      ],
-      "libc": [
-        "glibc"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@duckdb/node-bindings-linux-x64-musl": {
-      "version": "1.5.2-r.2",
-      "resolved": "https://registry.npmjs.org/@duckdb/node-bindings-linux-x64-musl/-/node-bindings-linux-x64-musl-1.5.2-r.2.tgz",
-      "integrity": "sha512-v2AUKCIHKq9+zFWmx+UdSWyxFLaT5wsWuTNID30pGBqGvwChxLGmm1szbHNxR7nNa00y2SGp9Gxoky0RS7YCwg==",
-      "cpu": [
-        "x64"
-      ],
-      "libc": [
-        "musl"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@duckdb/node-bindings-win32-arm64": {
-      "version": "1.5.2-r.2",
-      "resolved": "https://registry.npmjs.org/@duckdb/node-bindings-win32-arm64/-/node-bindings-win32-arm64-1.5.2-r.2.tgz",
-      "integrity": "sha512-g5ZWK07c0Qh7UFhJC37iC5y8oW8ZqxEgpNM2vTFD3ShM9Rn1NDXkxA7zjcheHRI+My5T1JpE9kNpCvhzItJrgw==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
-    "node_modules/@duckdb/node-bindings-win32-x64": {
-      "version": "1.5.2-r.2",
-      "resolved": "https://registry.npmjs.org/@duckdb/node-bindings-win32-x64/-/node-bindings-win32-x64-1.5.2-r.2.tgz",
-      "integrity": "sha512-VUMbdeXQHWKHEXVWtfVaOSu7Mb4jR9gT56Yzu9FHyLyP9ogY/D6wpeohY5gAHZS9PHQGGq24qRtCn5g6vUolqA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
     "node_modules/@emnapi/core": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
-      "integrity": "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==",
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.1.tgz",
+      "integrity": "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/wasi-threads": "1.2.1",
+        "@emnapi/wasi-threads": "1.2.2",
         "tslib": "^2.4.0"
       }
     },
     "node_modules/@emnapi/runtime": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.1.tgz",
-      "integrity": "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw==",
+      "version": "1.11.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.2.tgz",
+      "integrity": "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -1957,9 +1990,9 @@
       }
     },
     "node_modules/@emnapi/wasi-threads": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.1.tgz",
-      "integrity": "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==",
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.2.tgz",
+      "integrity": "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -2603,20 +2636,61 @@
       }
     },
     "node_modules/@hugeicons/core-free-icons": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@hugeicons/core-free-icons/-/core-free-icons-4.2.0.tgz",
-      "integrity": "sha512-V1G/Ph9TbmEow+pKnupZRWQjdORR/TGGr3JVRZOWkomdJ/5N6GgLuKPgBDs7G0kZ0//9LL34AGOUzWe3K+umNA==",
+      "version": "4.2.2",
+      "resolved": "https://registry.npmjs.org/@hugeicons/core-free-icons/-/core-free-icons-4.2.2.tgz",
+      "integrity": "sha512-fjQW3p6cwoJmwK3oCnV8Z3PC5sHihDvr2jkAHax8cxqp62GaV/D7B/Rnao+JwicW8fmLZUQ6QrzWfoyMFOEQlQ==",
       "license": "MIT"
     },
     "node_modules/@hugeicons/react": {
-      "version": "1.1.7",
-      "resolved": "https://registry.npmjs.org/@hugeicons/react/-/react-1.1.7.tgz",
-      "integrity": "sha512-0q1gekPJvNtIsfqi6alVdKfqsLz0PGiZWOzxJDxOd55UpFwcgohBFU4CwTcJ7kg4hO3kwXuzxrn/JEj280GX3g==",
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@hugeicons/react/-/react-1.1.9.tgz",
+      "integrity": "sha512-O+lWSWjbijoAvMCxn4K2bQWCGN5+mP1y5j+X99j23mXMj+s0X25fs71T6t9YJLaBodwmZdaewD27dzS/PiboQw==",
       "license": "MIT",
       "peerDependencies": {
         "react": ">=16.0.0"
       }
     },
+    "node_modules/@huggingface/blake3-jit": {
+      "version": "0.0.2",
+      "resolved": "https://registry.npmjs.org/@huggingface/blake3-jit/-/blake3-jit-0.0.2.tgz",
+      "integrity": "sha512-Bq7B5qabyjrJfhBsl85Jd2QBtf+HzRD7h7A9GfN2lzrrsABhOa5evVPgzoCTxR7Ub0QFj7YDK1YkYRWBU25+2w==",
+      "license": "MIT"
+    },
+    "node_modules/@huggingface/hub": {
+      "version": "2.13.2",
+      "resolved": "https://registry.npmjs.org/@huggingface/hub/-/hub-2.13.2.tgz",
+      "integrity": "sha512-I1Pbn9UcBHCt0M/SbZkKzYr3JVnbJp4YIFv74eVRH2Y22yT9Jpm6DtfM74tcjNLbC7SyFZ433znUw0szdFd4Fg==",
+      "license": "MIT",
+      "dependencies": {
+        "@huggingface/tasks": "^0.21.13",
+        "@huggingface/xetchunk-wasm": "^0.1.0"
+      },
+      "bin": {
+        "hfjs": "dist/cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "cli-progress": "^3.12.0"
+      }
+    },
+    "node_modules/@huggingface/tasks": {
+      "version": "0.21.20",
+      "resolved": "https://registry.npmjs.org/@huggingface/tasks/-/tasks-0.21.20.tgz",
+      "integrity": "sha512-pGw7pQI8TYSbrOVfNRdrYeISDEYOvQzOCEBceYjEKOH2wOmooc6eGfbYRhAALDgNKZCSISPYYFszRxHta3FaNw==",
+      "license": "MIT"
+    },
+    "node_modules/@huggingface/xetchunk-wasm": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/@huggingface/xetchunk-wasm/-/xetchunk-wasm-0.1.0.tgz",
+      "integrity": "sha512-wWpp2qwPgf9kv1KLJjcDUk/OrpDOsFoQ3Qpz0U5LGn20csoymBf8eneOv6wm/GzPBzlWac1OYiR0aa1vT6aM2Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@huggingface/blake3-jit": "0.0.2",
+        "gearhash-jit": "1.0.2"
+      }
+    },
     "node_modules/@iconify/types": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/@iconify/types/-/types-2.0.0.tgz",
@@ -3608,6 +3682,18 @@
         "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
       }
     },
+    "node_modules/@isaacs/fs-minipass": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz",
+      "integrity": "sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==",
+      "license": "ISC",
+      "dependencies": {
+        "minipass": "^7.0.4"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@isaacs/ttlcache": {
       "version": "2.1.5",
       "resolved": "https://registry.npmjs.org/@isaacs/ttlcache/-/ttlcache-2.1.5.tgz",
@@ -3736,9 +3822,9 @@
       }
     },
     "node_modules/@marijn/find-cluster-break": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@marijn/find-cluster-break/-/find-cluster-break-1.0.2.tgz",
-      "integrity": "sha512-l0h88YhZFyKdXIFNfSWpyjStDjGHwZ/U7iobcK1cQQD8sejsONdQtTVU+1wVN1PBw40PiiHB1vA5S7VTfQiP9g==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@marijn/find-cluster-break/-/find-cluster-break-1.0.3.tgz",
+      "integrity": "sha512-FY+MKLBoTsLNJF/eLWaOsXGdz6uh3Iu1axjPf6TUq92IYumcTcXWHoS747JARLkcdlJ/Waiaxc5wQfFO8jC6NA==",
       "license": "MIT"
     },
     "node_modules/@mastra/ai-sdk": {
@@ -3796,10 +3882,22 @@
         "zod": "^3.25.0 || ^4.0.0"
       }
     },
+    "node_modules/@mastra/core/node_modules/picomatch": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
+      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "node_modules/@mastra/deployer": {
-      "version": "1.43.0",
-      "resolved": "https://registry.npmjs.org/@mastra/deployer/-/deployer-1.43.0.tgz",
-      "integrity": "sha512-bNb6z/dR34/CtKBGmurH2aRi1hDLAR0tCwSPcyfLquAa7F30//Mm+zcNXwNrH8ip609hYhu0oSIpjlF1iuvLEA==",
+      "version": "1.42.0-alpha.3",
+      "resolved": "https://registry.npmjs.org/@mastra/deployer/-/deployer-1.42.0-alpha.3.tgz",
+      "integrity": "sha512-fqKJ23+/3gsYWtuHFIJEMsJ5jI81tyslFk75O6lnzofDvkl5k8XS3TtdcCLMMpmUgO0MfAvUkzwTonq2j4R2Ww==",
       "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -3807,7 +3905,7 @@
         "@babel/preset-typescript": "^7.29.7",
         "@babel/traverse": "^7.29.7",
         "@hono/node-ws": "^1.3.0",
-        "@mastra/server": "1.43.0",
+        "@mastra/server": "1.42.0-alpha.3",
         "@optimize-lodash/rollup-plugin": "^5.1.0",
         "@rollup/plugin-alias": "6.0.0",
         "@rollup/plugin-commonjs": "29.0.2",
@@ -3818,16 +3916,16 @@
         "@sindresorhus/slugify": "^2.2.1",
         "@types/babel__traverse": "^7.28.0",
         "empathic": "^2.0.0",
-        "esbuild": "^0.28.0",
+        "esbuild": "^0.27.4",
         "find-workspaces": "^0.3.1",
-        "fs-extra": "^11.3.5",
+        "fs-extra": "^11.3.4",
         "hono": "^4.12.8",
         "local-pkg": "^1.1.2",
         "resolve.exports": "^2.0.3",
-        "rollup": "^4.61.1",
+        "rollup": "^4.59.0",
         "rollup-plugin-esbuild": "^6.2.1",
         "strip-json-comments": "^5.0.3",
-        "tinyglobby": "^0.2.17",
+        "tinyglobby": "^0.2.16",
         "typescript-paths": "^1.5.2",
         "ws": "^8.20.0"
       },
@@ -3883,19 +3981,47 @@
         "@mastra/core": ">=1.34.0-0 <2.0.0-0"
       }
     },
-    "node_modules/@mastra/duckdb": {
-      "version": "1.4.1-alpha.0",
-      "resolved": "https://registry.npmjs.org/@mastra/duckdb/-/duckdb-1.4.1-alpha.0.tgz",
-      "integrity": "sha512-/55TAhKJhlMd5sTc3GBGrj7WuA7jEHywDWTloaXIkCPpKjzqHH2RnCpnRHC4dMzvUKtgrAPs8L+R1fUvS2gRyg==",
-      "license": "Apache-2.0",
+    "node_modules/@mastra/deployer-vercel/node_modules/fs-extra": {
+      "version": "11.3.6",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.6.tgz",
+      "integrity": "sha512-w8ZNZr2mKIc7qeNaQ9AVPT1+iFaI+Avd4xudVOvdDJ8VytREi1Ft5Ih7hd9jjehod8vAM5GMsfQ/TpPf4EyoEA==",
+      "license": "MIT",
+      "optional": true,
       "dependencies": {
-        "@duckdb/node-api": "^1.5.2-r.1"
+        "graceful-fs": "^4.2.0",
+        "jsonfile": "^6.0.1",
+        "universalify": "^2.0.0"
       },
       "engines": {
-        "node": ">=22.13.0"
+        "node": ">=14.14"
+      }
+    },
+    "node_modules/@mastra/deployer/node_modules/fs-extra": {
+      "version": "11.3.6",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.6.tgz",
+      "integrity": "sha512-w8ZNZr2mKIc7qeNaQ9AVPT1+iFaI+Avd4xudVOvdDJ8VytREi1Ft5Ih7hd9jjehod8vAM5GMsfQ/TpPf4EyoEA==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "graceful-fs": "^4.2.0",
+        "jsonfile": "^6.0.1",
+        "universalify": "^2.0.0"
       },
-      "peerDependencies": {
-        "@mastra/core": ">=1.0.0-0 <2.0.0-0"
+      "engines": {
+        "node": ">=14.14"
+      }
+    },
+    "node_modules/@mastra/deployer/node_modules/strip-json-comments": {
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-5.0.3.tgz",
+      "integrity": "sha512-1tB5mhVo7U+ETBKNf92xT4hrQa3pm0MZ0PQvuDnWgAAGHDsfp4lPSpiS6psrSiet87wyGPh9ft6wmhOMQ0hDiw==",
+      "devOptional": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
     "node_modules/@mastra/editor": {
@@ -3922,29 +4048,6 @@
         }
       }
     },
-    "node_modules/@mastra/editor/node_modules/@mastra/memory": {
-      "version": "1.20.2",
-      "resolved": "https://registry.npmjs.org/@mastra/memory/-/memory-1.20.2.tgz",
-      "integrity": "sha512-J999LmWrEniRSz5MiLxtjX+lYwwASPrZI6+oSoW1h01rzODpw+0CMFIIzbVFluteD1BQLk8F/TGI4dkXDS0HHA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@mastra/schema-compat": "1.2.11",
-        "async-mutex": "^0.5.0",
-        "diff": "^8.0.3",
-        "image-size": "^2.0.2",
-        "json-schema": "^0.4.0",
-        "lru-cache": "^11.2.7",
-        "probe-image-size": "^7.2.3",
-        "tokenx": "^1.3.0",
-        "xxhash-wasm": "^1.1.0"
-      },
-      "engines": {
-        "node": ">=22.13.0"
-      },
-      "peerDependencies": {
-        "@mastra/core": ">=1.4.1-0 <2.0.0-0"
-      }
-    },
     "node_modules/@mastra/evals": {
       "version": "1.2.4-alpha.0",
       "resolved": "https://registry.npmjs.org/@mastra/evals/-/evals-1.2.4-alpha.0.tgz",
@@ -3963,6 +4066,22 @@
         "@mastra/core": ">=1.0.0-0 <2.0.0-0"
       }
     },
+    "node_modules/@mastra/fastembed": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@mastra/fastembed/-/fastembed-1.1.2.tgz",
+      "integrity": "sha512-nddBp5UQScb+BY+fYx4czo4Ch8OPwFV9oc8sabeMvwzAEHttvY4kcKd1fKYBsaYTEwNrYw17Iy6eEcZJ1cfYOw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@anush008/tokenizers": "^0.6.0",
+        "@huggingface/hub": "^2.12.0",
+        "onnxruntime-node": "1.26.0",
+        "progress": "^2.0.3",
+        "tar": "^7.5.15"
+      },
+      "engines": {
+        "node": ">=22.13.0"
+      }
+    },
     "node_modules/@mastra/loggers": {
       "version": "1.1.2-alpha.0",
       "resolved": "https://registry.npmjs.org/@mastra/loggers/-/loggers-1.1.2-alpha.0.tgz",
@@ -4073,9 +4192,9 @@
       }
     },
     "node_modules/@mastra/server": {
-      "version": "1.43.0",
-      "resolved": "https://registry.npmjs.org/@mastra/server/-/server-1.43.0.tgz",
-      "integrity": "sha512-axV2nGgy0yPfAzyX8OSdnewnng3dczvLmHLFLxekEc3Y8aDaSM5SpBk/a9N+JgVZmESlG6r7Fz0A4zreZvbleA==",
+      "version": "1.42.0-alpha.3",
+      "resolved": "https://registry.npmjs.org/@mastra/server/-/server-1.42.0-alpha.3.tgz",
+      "integrity": "sha512-InmbmY0tdITb6hINTZaoqNDbRshOYObeUrL50pWHobZzh0jXGce4X1p7oyZx9ApsPWWuZbWvjryhsOoHICYgpw==",
       "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -4162,22 +4281,22 @@
         "url": "https://opencollective.com/unified"
       }
     },
-    "node_modules/@mdx-js/mdx/node_modules/estree-walker": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
-      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/estree": "^1.0.0"
+    "node_modules/@mdx-js/mdx/node_modules/source-map": {
+      "version": "0.7.6",
+      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.7.6.tgz",
+      "integrity": "sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ==",
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">= 12"
       }
     },
     "node_modules/@mermaid-js/parser": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@mermaid-js/parser/-/parser-1.1.1.tgz",
-      "integrity": "sha512-VuHdsYMK1bT6X2JbcAaWAhugTRvRBRyuZgd+c22swUeI9g/ntaxF7CY7dYarhZovofCbUNO0G7JesfmNtjYOCw==",
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/@mermaid-js/parser/-/parser-1.2.0.tgz",
+      "integrity": "sha512-oYPyv8A4As1yH5Bx+04iQEQxXuIQDe0GKCNSRgao6z8AM9jixXIfP0vsppRLvGf+nKIOb9/LdpWA4YuJiVvESA==",
       "license": "MIT",
       "dependencies": {
-        "@chevrotain/types": "~11.1.1"
+        "@chevrotain/types": "~11.1.2"
       }
     },
     "node_modules/@microsoft/teams.api": {
@@ -4548,14 +4667,14 @@
       }
     },
     "node_modules/@napi-rs/wasm-runtime": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.5.tgz",
-      "integrity": "sha512-AWPoBRJ9tsnVhor4sjO7rkni+7p+2IAEFj6cx06UgP10jkQHqay/36uRV/bFkgrh18D9vb4cr8Q0Pthskgzy+Q==",
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.6.tgz",
+      "integrity": "sha512-ZLv/JdUfkvOy9eCnnBaGfiO+XimbjebAeO+MRQqD/B+FR1tnRN0tpKSJHRbE8sFfS6aqsXZ67TQjfwfsxULVbg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@tybys/wasm-util": "^0.10.2"
+        "@tybys/wasm-util": "^0.10.3"
       },
       "funding": {
         "type": "github",
@@ -4567,15 +4686,15 @@
       }
     },
     "node_modules/@next/env": {
-      "version": "16.2.4",
-      "resolved": "https://registry.npmjs.org/@next/env/-/env-16.2.4.tgz",
-      "integrity": "sha512-dKkkOzOSwFYe5RX6y26fZgkSpVAlIOJKQHIiydQcrWH6y/97+RceSOAdjZ14Qa3zLduVUy0TXcn+EiM6t4rPgw==",
+      "version": "16.2.10",
+      "resolved": "https://registry.npmjs.org/@next/env/-/env-16.2.10.tgz",
+      "integrity": "sha512-zLPxg9M0MEHmygpj5OuxjQ+vHMiy/K7cSp74G8ecYolmgUWw0RwN02tF56npup/+qaI8JB97hQgS/r2Hb6QwVA==",
       "license": "MIT"
     },
     "node_modules/@next/swc-darwin-arm64": {
-      "version": "16.2.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.2.4.tgz",
-      "integrity": "sha512-OXTFFox5EKN1Ym08vfrz+OXxmCcEjT4SFMbNRsWZE99dMqt2Kcusl5MqPXcW232RYkMLQTy0hqgAMEsfEd/l2A==",
+      "version": "16.2.10",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.2.10.tgz",
+      "integrity": "sha512-v9IdJCa0H0mbo+8z5zwUpOk1Vj7RjkcI5uNYf5Ws1y6szf/p3Mzl9hLaST8SCt6L9h8NGnruZcd2+o0NTNwDhA==",
       "cpu": [
         "arm64"
       ],
@@ -4589,9 +4708,9 @@
       }
     },
     "node_modules/@next/swc-darwin-x64": {
-      "version": "16.2.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.2.4.tgz",
-      "integrity": "sha512-XhpVnUfmYWvD3YrXu55XdcAkQtOnvaI6wtQa8fuF5fGoKoxIUZ0kWPtcOfqJEWngFF/lOS9l3+O9CcownhiQxQ==",
+      "version": "16.2.10",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.2.10.tgz",
+      "integrity": "sha512-17IS0jJRViROGmA9uGdNR8VPJpfbnaVG7E9qhso5jDLkmyd0lSDORWxbcKINzcFqzZqGwGtMSnrFRxBpuUYjLQ==",
       "cpu": [
         "x64"
       ],
@@ -4605,9 +4724,9 @@
       }
     },
     "node_modules/@next/swc-linux-arm64-gnu": {
-      "version": "16.2.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.2.4.tgz",
-      "integrity": "sha512-Mx/tjlNA3G8kg14QvuGAJ4xBwPk1tUHq56JxZ8CXnZwz1Etz714soCEzGQQzVMz4bEnGPowzkV6Xrp6wAkEWOQ==",
+      "version": "16.2.10",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.2.10.tgz",
+      "integrity": "sha512-GRQRsRtuciNJvB54AvvuQTiq0oZtFwa1owQqtZD8wwnGpM2L39MV22kpI72YSXLKIyY40LC66EiLFv4PiicXxg==",
       "cpu": [
         "arm64"
       ],
@@ -4624,9 +4743,9 @@
       }
     },
     "node_modules/@next/swc-linux-arm64-musl": {
-      "version": "16.2.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.2.4.tgz",
-      "integrity": "sha512-iVMMp14514u7Nup2umQS03nT/bN9HurK8ufylC3FZNykrwjtx7V1A7+4kvhbDSCeonTVqV3Txnv0Lu+m2oDXNg==",
+      "version": "16.2.10",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.2.10.tgz",
+      "integrity": "sha512-zkN9MQYS7UQBro+FnISUq1itaQjXI9xqISzuQ+2bc921NcJ1x4yPCqrn77tVN6/dOOXaaWVX3k6/bR07pPwK+A==",
       "cpu": [
         "arm64"
       ],
@@ -4643,9 +4762,9 @@
       }
     },
     "node_modules/@next/swc-linux-x64-gnu": {
-      "version": "16.2.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.2.4.tgz",
-      "integrity": "sha512-EZOvm1aQWgnI/N/xcWOlnS3RQBk0VtVav5Zo7n4p0A7UKyTDx047k8opDbXgBpHl4CulRqRfbw3QrX2w5UOXMQ==",
+      "version": "16.2.10",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.2.10.tgz",
+      "integrity": "sha512-iCVJnwvrPYECvA6WM/7+oo+OiTvedIKLxtCLAZP4xZR3nXa1zmzZyLPbYCmWvpd4CvMYF1EMTafd0ii3DygLvA==",
       "cpu": [
         "x64"
       ],
@@ -4662,9 +4781,9 @@
       }
     },
     "node_modules/@next/swc-linux-x64-musl": {
-      "version": "16.2.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.2.4.tgz",
-      "integrity": "sha512-h9FxsngCm9cTBf71AR4fGznDEDx1hS7+kSEiIRjq5kO1oXWm07DxVGZjCvk0SGx7TSjlUqhI8oOyz7NfwAdPoA==",
+      "version": "16.2.10",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.2.10.tgz",
+      "integrity": "sha512-ov2g4H0dHY9bPoOU83m91hWT7Iq5qy13bUnyyshLU3HGR1Ownn0X9QpmDPc5iIUaahTp7f7LeGAhV4DSFtackw==",
       "cpu": [
         "x64"
       ],
@@ -4681,9 +4800,9 @@
       }
     },
     "node_modules/@next/swc-win32-arm64-msvc": {
-      "version": "16.2.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.2.4.tgz",
-      "integrity": "sha512-3NdJV5OXMSOeJYijX+bjaLge3mJBlh4ybydbT4GFoB/2hAojWHtMhl3CYlYoMrjPuodp0nzFVi4Tj2+WaMg+Ow==",
+      "version": "16.2.10",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.2.10.tgz",
+      "integrity": "sha512-DwAnhLX76HQiFFQNgWlcK+JzlnD1rZ+UK/WY0ZMI/deXpvgnesjNYrqcfo1JzBuz4Kf7o3brIBL0glI1junatA==",
       "cpu": [
         "arm64"
       ],
@@ -4697,9 +4816,9 @@
       }
     },
     "node_modules/@next/swc-win32-x64-msvc": {
-      "version": "16.2.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.2.4.tgz",
-      "integrity": "sha512-kMVGgsqhO5YTYODD9IPGGhA6iprWidQckK3LmPeW08PIFENRmgfb4MjXHO+p//d+ts2rpjvK5gXWzXSMrPl9cw==",
+      "version": "16.2.10",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.2.10.tgz",
+      "integrity": "sha512-0JXq3b85Jk9Jg4ntLUbXSPvoDw3gpZou7twuKdoFG2jOw635v7+IiXfTaa0TxVMyx78pUjnrVYwLgjKfX4e6/A==",
       "cpu": [
         "x64"
       ],
@@ -4955,9 +5074,9 @@
       }
     },
     "node_modules/@octokit/request": {
-      "version": "10.0.10",
-      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.10.tgz",
-      "integrity": "sha512-KxNC2pTqqhszMNrf12ZRd4PonRgyJdsM4F/jySiddQK+DsRcfBtUvqn8t7UsyZhnRJHvX46OohDt5N3VqIWC2w==",
+      "version": "10.0.11",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.11.tgz",
+      "integrity": "sha512-+s7HUxjfFqOMS9VlIwDffq0MikjSAK0gSpG73W+meAvVAvX4MBrHYTK5Bj3Uot55qFT4gzUtfzE4mGWY4Br8/Q==",
       "license": "MIT",
       "dependencies": {
         "@octokit/endpoint": "^11.0.3",
@@ -5060,6 +5179,13 @@
         "node": ">= 12"
       }
     },
+    "node_modules/@optimize-lodash/transform/node_modules/estree-walker": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-2.0.2.tgz",
+      "integrity": "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w==",
+      "devOptional": true,
+      "license": "MIT"
+    },
     "node_modules/@orama/orama": {
       "version": "3.1.18",
       "resolved": "https://registry.npmjs.org/@orama/orama/-/orama-3.1.18.tgz",
@@ -5070,9 +5196,9 @@
       }
     },
     "node_modules/@oxc-project/types": {
-      "version": "0.133.0",
-      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.133.0.tgz",
-      "integrity": "sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA==",
+      "version": "0.138.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.138.0.tgz",
+      "integrity": "sha512-1a7ZKmrRTCoN1XMZ4L0PyyqrMnrNlLyPuOkdSX2MZg7IiIGRUyurNhAm73ptDOraoBcIordsIGKNPKUzy3ZmfA==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -5141,13 +5267,13 @@
       }
     },
     "node_modules/@playwright/test": {
-      "version": "1.61.0",
-      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.61.0.tgz",
-      "integrity": "sha512-cKA5B6lpFEMyMGjxF54QihfYpB4FkEGH+qZhtArDEG+wezQAJY8Pq6C7T1SjWz+FFzt3TbyoXBQYk/0292TdJA==",
+      "version": "1.61.1",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.61.1.tgz",
+      "integrity": "sha512-8nKv6+0RJSL9FE4jYOEGXnPeM/Hg12qZpmqzZjRh3qM0Y7c3z1mrOTfFLids72RDQYVh9WpLEfR5WdpNX4fkig==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "playwright": "1.61.0"
+        "playwright": "1.61.1"
       },
       "bin": {
         "playwright": "cli.js"
@@ -5209,18 +5335,18 @@
       "license": "MIT"
     },
     "node_modules/@posthog/core": {
-      "version": "1.35.1",
-      "resolved": "https://registry.npmjs.org/@posthog/core/-/core-1.35.1.tgz",
-      "integrity": "sha512-2a9JgJgR+Ow8lrUQHVZYXH9EgXskYDlpbgNW6UvtsVxp8pEEFD8PxjZMnzq73Dx3NhAwNUrnVpb8KeZzHAtoSA==",
+      "version": "1.39.6",
+      "resolved": "https://registry.npmjs.org/@posthog/core/-/core-1.39.6.tgz",
+      "integrity": "sha512-o6ajIwN5zXoNP0D4H/QPmOyibNTUkSyOR6ya7AG5U2ywXx4awo72L2KnCoiZPQM5x/bXv6jPBdimH8M18Ax0aw==",
       "license": "MIT",
       "dependencies": {
-        "@posthog/types": "^1.389.0"
+        "@posthog/types": "^1.392.0"
       }
     },
     "node_modules/@posthog/types": {
-      "version": "1.390.0",
-      "resolved": "https://registry.npmjs.org/@posthog/types/-/types-1.390.0.tgz",
-      "integrity": "sha512-zMjK6nrUWhAlL8ECrM4WldvgawqdoAE5B0ys7eA0lCoWuyzfFoSyh6zYtEuBSDRyN7fQLSfNCK+mQH4ngOl7Zw==",
+      "version": "1.392.1",
+      "resolved": "https://registry.npmjs.org/@posthog/types/-/types-1.392.1.tgz",
+      "integrity": "sha512-Qg6Gl7/1vlr8+gPtBi5gwnLgAgiyFoKOVmTvTtDcvya9cpTwZfna7rQmkGQ4B63CunUYNNbOlqcwiUwUDyTK6w==",
       "license": "MIT"
     },
     "node_modules/@radix-ui/number": {
@@ -5236,12 +5362,12 @@
       "license": "MIT"
     },
     "node_modules/@radix-ui/react-accessible-icon": {
-      "version": "1.1.10",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-accessible-icon/-/react-accessible-icon-1.1.10.tgz",
-      "integrity": "sha512-TraSwZUqTcVbiDV2/RXzAXC7aeVVXchq0daPFZE7zAxYFaMzjOUggLOfQH9KFLgRizuwVKZO/crveV1eeO3/ZQ==",
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-accessible-icon/-/react-accessible-icon-1.1.11.tgz",
+      "integrity": "sha512-HQDOFTKwSnmUij6l54wYJJtxTAnxI71+YJLOrjm2ladFB8HAV5Jt7hwaZPhWTGBkYoW4+ZAOfNZrLDh/qvxSYA==",
       "license": "MIT",
       "dependencies": {
-        "@radix-ui/react-visually-hidden": "1.2.6"
+        "@radix-ui/react-visually-hidden": "1.2.7"
       },
       "peerDependencies": {
         "@types/react": "*",
@@ -5259,19 +5385,19 @@
       }
     },
     "node_modules/@radix-ui/react-accordion": {
-      "version": "1.2.14",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-accordion/-/react-accordion-1.2.14.tgz",
-      "integrity": "sha512-iE8YB9nmTBH8zd73ofBISZ8JCzgMoMkATJr7qDwa6u5F1+7mTM81V6fa71jgZ65rpjVpecDf1vSnwIFP9Ly1zw==",
+      "version": "1.2.15",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-accordion/-/react-accordion-1.2.15.tgz",
+      "integrity": "sha512-24Zz/0SYx8F2bSVThBnQrdJs2VbKelyuJordcFRRdA0fRAhrq/wSegGCqaQz34VQoiWqSMGYCYXEhynLSlyQlg==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
-        "@radix-ui/react-collapsible": "1.1.14",
-        "@radix-ui/react-collection": "1.1.10",
+        "@radix-ui/react-collapsible": "1.1.15",
+        "@radix-ui/react-collection": "1.1.11",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
         "@radix-ui/react-direction": "1.1.2",
         "@radix-ui/react-id": "1.1.2",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-controllable-state": "1.2.3"
       },
       "peerDependencies": {
@@ -5290,16 +5416,16 @@
       }
     },
     "node_modules/@radix-ui/react-alert-dialog": {
-      "version": "1.1.17",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-alert-dialog/-/react-alert-dialog-1.1.17.tgz",
-      "integrity": "sha512-563ygGeyWPrxyVCNp7OV4rE2aIXhFPknpFyo4wbDlcyMMPZ6ySh+zC5WTvY0ZFLgPTg/QB6tA8PyDQyJ2b4cPg==",
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-alert-dialog/-/react-alert-dialog-1.1.18.tgz",
+      "integrity": "sha512-6c2cXpNlAgHDhKguK24XcWHHayMpK+lk7/WwBXBco+ZJ4Dv7xP++GBM280KgTD/HCRu3jSdfe8WQiZssonYaIA==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
-        "@radix-ui/react-dialog": "1.1.17",
-        "@radix-ui/react-primitive": "2.1.6"
+        "@radix-ui/react-dialog": "1.1.18",
+        "@radix-ui/react-primitive": "2.1.7"
       },
       "peerDependencies": {
         "@types/react": "*",
@@ -5317,12 +5443,12 @@
       }
     },
     "node_modules/@radix-ui/react-arrow": {
-      "version": "1.1.10",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-arrow/-/react-arrow-1.1.10.tgz",
-      "integrity": "sha512-j2VTDz1vgCsmuG0k5lBfOcM8n5JPFqZBcMryasFjHYMhwxYL5SRUV5lMSUpRdNtw3D/Sv8pzJtrlAgkssYSsQQ==",
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-arrow/-/react-arrow-1.1.11.tgz",
+      "integrity": "sha512-Kdil9BB1rIFC/khmf4hC35bn8701AJcizTU7G7cUbEbk5XqqbjDuHW60uUfKqO5WojjZcbAW51Q7P0hRmMLw8A==",
       "license": "MIT",
       "dependencies": {
-        "@radix-ui/react-primitive": "2.1.6"
+        "@radix-ui/react-primitive": "2.1.7"
       },
       "peerDependencies": {
         "@types/react": "*",
@@ -5340,12 +5466,12 @@
       }
     },
     "node_modules/@radix-ui/react-aspect-ratio": {
-      "version": "1.1.10",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-aspect-ratio/-/react-aspect-ratio-1.1.10.tgz",
-      "integrity": "sha512-kbI7NrqhDeuytYrq7JjAsoXczvL8wgj2tc1MyaYWm+50bMKHCHQtVWCryslx4cCpmCTTkBcwQckE4CmmGV2haQ==",
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-aspect-ratio/-/react-aspect-ratio-1.1.11.tgz",
+      "integrity": "sha512-IUAhIVpBUvP5NNICjlaB1OFmtRLGqQqTF3ZOSGPoq3XeLXRFtHiWTRxSVEULgOd9GQR2c7tsYqDnhUennapZnw==",
       "license": "MIT",
       "dependencies": {
-        "@radix-ui/react-primitive": "2.1.6"
+        "@radix-ui/react-primitive": "2.1.7"
       },
       "peerDependencies": {
         "@types/react": "*",
@@ -5363,13 +5489,13 @@
       }
     },
     "node_modules/@radix-ui/react-avatar": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-avatar/-/react-avatar-1.2.0.tgz",
-      "integrity": "sha512-am/CwltXtmtdtP+5FbYblYDnMa/zuKcMJP1i3/SJMDXXfj2mG+BTqLH2wucqeyyiQMursUtg/5cK+Nh2pCaSOA==",
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-avatar/-/react-avatar-1.2.1.tgz",
+      "integrity": "sha512-+8PWoLLZv3AVb5m0pvoiOca/bQGzc9vPVb+982HB2x3Un0DpYEPM3zLMl4oqRpBsocJuNqLkiv/HXTnTrlwr4g==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/react-context": "1.1.4",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-callback-ref": "1.1.2",
         "@radix-ui/react-use-is-hydrated": "0.1.1",
         "@radix-ui/react-use-layout-effect": "1.1.2"
@@ -5390,16 +5516,16 @@
       }
     },
     "node_modules/@radix-ui/react-checkbox": {
-      "version": "1.3.5",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-checkbox/-/react-checkbox-1.3.5.tgz",
-      "integrity": "sha512-pREzrmNnVwGvYaBoM64huTRK7B3lrTRuwj8A9nwhPiEtMb+yudiWh6zWAqEtP0Dzd5+iBa1Ki7V1pCxV8ExMdA==",
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-checkbox/-/react-checkbox-1.3.6.tgz",
+      "integrity": "sha512-eUEUoGMDpfkgHWSE97ZZaUJtzR1M7EKnNIpD1Q16+8JR9NWghcaqMulx9PuCQ720w0UclfYn6FEbCdd5Hx087g==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
         "@radix-ui/react-presence": "1.1.6",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-controllable-state": "1.2.3",
         "@radix-ui/react-use-previous": "1.1.2",
         "@radix-ui/react-use-size": "1.1.2"
@@ -5420,9 +5546,9 @@
       }
     },
     "node_modules/@radix-ui/react-collapsible": {
-      "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-collapsible/-/react-collapsible-1.1.14.tgz",
-      "integrity": "sha512-9bT+FvifX1FK2Mj6UEsTdyu0cN3JaA3KdfhaBao+ONrYFy/pyOy3TU1TNw7iOk1o+0hOEq67RojlUUmoFGwxyA==",
+      "version": "1.1.15",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-collapsible/-/react-collapsible-1.1.15.tgz",
+      "integrity": "sha512-8A1zibu5skAQ+UVbaeNH5hVMibiFCRJzgMuM14LTWGttnTZKQL9jwYnhAbHRuxrtCqPXa4JvvnVUq1pTNgyZYw==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
@@ -5430,7 +5556,7 @@
         "@radix-ui/react-context": "1.1.4",
         "@radix-ui/react-id": "1.1.2",
         "@radix-ui/react-presence": "1.1.6",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-controllable-state": "1.2.3",
         "@radix-ui/react-use-layout-effect": "1.1.2"
       },
@@ -5450,14 +5576,14 @@
       }
     },
     "node_modules/@radix-ui/react-collection": {
-      "version": "1.1.10",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-collection/-/react-collection-1.1.10.tgz",
-      "integrity": "sha512-IVVz4EvBcKjrzKgof714qDnz/SzQAkLA2Emh5edlHbgcE6fNd3Un6CJLlaYcnm8N4JmAtzQgse4dOKxcD2yc9g==",
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-collection/-/react-collection-1.1.11.tgz",
+      "integrity": "sha512-djW9+zeg137KQdlPtmE8xnaD+K2rcXXMWFrSg0hsmYZ6HRbdTA7tDHFgpaW9+huWVEu0RCabL+985T4TA0BE7g==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-slot": "1.3.0"
       },
       "peerDependencies": {
@@ -5506,15 +5632,15 @@
       }
     },
     "node_modules/@radix-ui/react-context-menu": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-context-menu/-/react-context-menu-2.3.1.tgz",
-      "integrity": "sha512-XbrxS68W5dyiE4fAb96yvJwSVU5x66B20A99sD5Mk3xSWK/LqeOnx6TZnim1KieMjXS/CTFq8reOAjWxas2G8Q==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-context-menu/-/react-context-menu-2.3.2.tgz",
+      "integrity": "sha512-qzsA/ZPhF6yMxBOTIk1nlCkoy2mswSbwYL+ErBa2iP0s4WWrlxmczArYqMcpVfEjmM7KJj/ADPXky0yZfbSxtQ==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
         "@radix-ui/react-context": "1.1.4",
-        "@radix-ui/react-menu": "2.1.18",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-menu": "2.1.19",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-controllable-state": "1.2.3"
       },
       "peerDependencies": {
@@ -5533,21 +5659,21 @@
       }
     },
     "node_modules/@radix-ui/react-dialog": {
-      "version": "1.1.17",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-dialog/-/react-dialog-1.1.17.tgz",
-      "integrity": "sha512-TDTYmpdq8dI2+Xgvgj9AJ8Ghqq+Eph/TRVEdaFQPDItIY+6QSkU7MJMeevw1568Yw/2Ijz8BTphPSP2XejKphw==",
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-dialog/-/react-dialog-1.1.18.tgz",
+      "integrity": "sha512-apa28mldjMgORmE6g/w3sCcA0Y9UAVeeDVoozN4i7kOw12mLl9RBchfzK3Nn6qxOWjrZhK1Lfy7f07kyzxtnBw==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
-        "@radix-ui/react-dismissable-layer": "1.1.13",
+        "@radix-ui/react-dismissable-layer": "1.1.14",
         "@radix-ui/react-focus-guards": "1.1.4",
-        "@radix-ui/react-focus-scope": "1.1.10",
+        "@radix-ui/react-focus-scope": "1.1.11",
         "@radix-ui/react-id": "1.1.2",
-        "@radix-ui/react-portal": "1.1.12",
+        "@radix-ui/react-portal": "1.1.13",
         "@radix-ui/react-presence": "1.1.6",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-slot": "1.3.0",
         "@radix-ui/react-use-controllable-state": "1.2.3",
         "aria-hidden": "^1.2.4",
@@ -5584,16 +5710,16 @@
       }
     },
     "node_modules/@radix-ui/react-dismissable-layer": {
-      "version": "1.1.13",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-dismissable-layer/-/react-dismissable-layer-1.1.13.tgz",
-      "integrity": "sha512-2v+zNAWWe0ySxgC0D0yeXMPQ23xZVgXZTerTz+JKlmdRj6gfTqmCcR29jb6d290DezXPGgruHWDX/vYUebtErg==",
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-dismissable-layer/-/react-dismissable-layer-1.1.14.tgz",
+      "integrity": "sha512-4lUhWTWAjbDIqFrAPWJ3WqBOpO5YchVZ88X3nh6H9Lu5AFi5nCUeTPj3D8FSDmabmFeRe9ME0BDA4MwKTha5GQ==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
         "@radix-ui/react-compose-refs": "1.1.3",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-callback-ref": "1.1.2",
-        "@radix-ui/react-use-escape-keydown": "1.1.2"
+        "@radix-ui/react-use-effect-event": "0.0.3"
       },
       "peerDependencies": {
         "@types/react": "*",
@@ -5611,17 +5737,17 @@
       }
     },
     "node_modules/@radix-ui/react-dropdown-menu": {
-      "version": "2.1.18",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-dropdown-menu/-/react-dropdown-menu-2.1.18.tgz",
-      "integrity": "sha512-PZGV82gFk0WltDRI//SsG28ZIjlo9ANTmoNYg0jLNzXXiDsAy5PkOOYQaVD1pPxY6t7gxffb1QMD6qaUvsBZdw==",
+      "version": "2.1.19",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-dropdown-menu/-/react-dropdown-menu-2.1.19.tgz",
+      "integrity": "sha512-HZccBkbK0LOi8nYKIp5jll/zIRW0cCOmG6WWyqsSpmXCU+ZlcBbTqIwlBvPCu886C5RVu6c/kHV7xSP8IgYNHw==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
         "@radix-ui/react-id": "1.1.2",
-        "@radix-ui/react-menu": "2.1.18",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-menu": "2.1.19",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-controllable-state": "1.2.3"
       },
       "peerDependencies": {
@@ -5655,13 +5781,13 @@
       }
     },
     "node_modules/@radix-ui/react-focus-scope": {
-      "version": "1.1.10",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-focus-scope/-/react-focus-scope-1.1.10.tgz",
-      "integrity": "sha512-Fas/lXQqhVvqwAb64s5RFeHiHYElZ6SUQbZaNd6EkfhP/Al7wTIQ9WIR4QVX475tlu5yFCEdDcJH6/UwsZjMWw==",
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-focus-scope/-/react-focus-scope-1.1.11.tgz",
+      "integrity": "sha512-Mn88Vg2whaRocGJNOH+DKFqYm6ySFPQaiwHNxZPyjn99B52KAEJWWY9NP83+nWdk2HM3rdov+STu9AG471Rt9w==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/react-compose-refs": "1.1.3",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-callback-ref": "1.1.2"
       },
       "peerDependencies": {
@@ -5680,17 +5806,17 @@
       }
     },
     "node_modules/@radix-ui/react-form": {
-      "version": "0.1.10",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-form/-/react-form-0.1.10.tgz",
-      "integrity": "sha512-1NfuvctVtX4sU3Mmq/IdrR8UunxiCMiVg3A5UENKhFzxUBeOyaQQ+lmaQaV7Tc8cqvBKsJL3/KGBsixK0D8WFg==",
+      "version": "0.1.11",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-form/-/react-form-0.1.11.tgz",
+      "integrity": "sha512-0mTMJHv1gQAuEQoq5VDpTD3MRgmfUFdXAVFhpqR7wBeUr+tyRsof0wv/4XdPHLwQrefhoH2FiGHCggrCJhalIw==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
         "@radix-ui/react-id": "1.1.2",
-        "@radix-ui/react-label": "2.1.10",
-        "@radix-ui/react-primitive": "2.1.6"
+        "@radix-ui/react-label": "2.1.11",
+        "@radix-ui/react-primitive": "2.1.7"
       },
       "peerDependencies": {
         "@types/react": "*",
@@ -5708,19 +5834,19 @@
       }
     },
     "node_modules/@radix-ui/react-hover-card": {
-      "version": "1.1.17",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-hover-card/-/react-hover-card-1.1.17.tgz",
-      "integrity": "sha512-GjZQIEANVkuuWeztlKz6QEHe31ZX2iDfHzcTMCQVZXC0JyQrgfKWSC+LOOEw6aVV64zyjzobIzSA4AU4eKWrHA==",
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-hover-card/-/react-hover-card-1.1.18.tgz",
+      "integrity": "sha512-rt+Fx4HoCeEwFL2IdoV2QaPltqDLlzxN77i9nwB3Y70scFlfAHh1QCdE2TXKuFJtA1TNygb0oivnFBZifgtZOw==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
-        "@radix-ui/react-dismissable-layer": "1.1.13",
-        "@radix-ui/react-popper": "1.3.1",
-        "@radix-ui/react-portal": "1.1.12",
+        "@radix-ui/react-dismissable-layer": "1.1.14",
+        "@radix-ui/react-popper": "1.3.2",
+        "@radix-ui/react-portal": "1.1.13",
         "@radix-ui/react-presence": "1.1.6",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-controllable-state": "1.2.3"
       },
       "peerDependencies": {
@@ -5757,12 +5883,12 @@
       }
     },
     "node_modules/@radix-ui/react-label": {
-      "version": "2.1.10",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-label/-/react-label-2.1.10.tgz",
-      "integrity": "sha512-ib0zvq2ZsAqKm5tRnqGJn3vOxSgIts5ToxsXT0q1S/GfLD1Zj7UOEnkw8u2w6sRmn47djpQWuSU1DCL1R29/yw==",
+      "version": "2.1.11",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-label/-/react-label-2.1.11.tgz",
+      "integrity": "sha512-3PKvDDxOn62k0oV1n4QtNtD2vpu+zYjXR7ojLBPaO6SPvhy53yg0vAmgNeBQeJW5rV3dffoRG+HYfLBZuzw0CQ==",
       "license": "MIT",
       "dependencies": {
-        "@radix-ui/react-primitive": "2.1.6"
+        "@radix-ui/react-primitive": "2.1.7"
       },
       "peerDependencies": {
         "@types/react": "*",
@@ -5780,25 +5906,25 @@
       }
     },
     "node_modules/@radix-ui/react-menu": {
-      "version": "2.1.18",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-menu/-/react-menu-2.1.18.tgz",
-      "integrity": "sha512-lj8Rxjtn6zJq1oSbE/uDtAwCbB9BnxgHD+8MwJMuTh6u1dPamYhW9iuELr/Z8d0D/UysFblYYHeBPwi7T4k0YQ==",
+      "version": "2.1.19",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-menu/-/react-menu-2.1.19.tgz",
+      "integrity": "sha512-Mht9BVd1AIsNFVQr4KG3bIK7XQn5IXF0TL/2ObsrzOdc1loaly/+kBDL5roSCYn8j8XZkvpOD0WYLz2FQtH1Eg==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
-        "@radix-ui/react-collection": "1.1.10",
+        "@radix-ui/react-collection": "1.1.11",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
         "@radix-ui/react-direction": "1.1.2",
-        "@radix-ui/react-dismissable-layer": "1.1.13",
+        "@radix-ui/react-dismissable-layer": "1.1.14",
         "@radix-ui/react-focus-guards": "1.1.4",
-        "@radix-ui/react-focus-scope": "1.1.10",
+        "@radix-ui/react-focus-scope": "1.1.11",
         "@radix-ui/react-id": "1.1.2",
-        "@radix-ui/react-popper": "1.3.1",
-        "@radix-ui/react-portal": "1.1.12",
+        "@radix-ui/react-popper": "1.3.2",
+        "@radix-ui/react-portal": "1.1.13",
         "@radix-ui/react-presence": "1.1.6",
-        "@radix-ui/react-primitive": "2.1.6",
-        "@radix-ui/react-roving-focus": "1.1.13",
+        "@radix-ui/react-primitive": "2.1.7",
+        "@radix-ui/react-roving-focus": "1.1.14",
         "@radix-ui/react-slot": "1.3.0",
         "@radix-ui/react-use-callback-ref": "1.1.2",
         "aria-hidden": "^1.2.4",
@@ -5820,20 +5946,20 @@
       }
     },
     "node_modules/@radix-ui/react-menubar": {
-      "version": "1.1.18",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-menubar/-/react-menubar-1.1.18.tgz",
-      "integrity": "sha512-hX7EGx/oFq6DPY27GQuP/2wP48GHf5LG6r06VgNJlG+znmDS8OfopZcRcGly3L4lsB9FqpmLx6JQSE9P3BUpyw==",
+      "version": "1.1.19",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-menubar/-/react-menubar-1.1.19.tgz",
+      "integrity": "sha512-Glt6mebxcgQvLeVkH3HiqV5bgQubE+31ELxLs7q0GlYI5k0XYkOkeuPrhXoylxK8eufvIt9CJjzY1TfFMXK3qw==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
-        "@radix-ui/react-collection": "1.1.10",
+        "@radix-ui/react-collection": "1.1.11",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
         "@radix-ui/react-direction": "1.1.2",
         "@radix-ui/react-id": "1.1.2",
-        "@radix-ui/react-menu": "2.1.18",
-        "@radix-ui/react-primitive": "2.1.6",
-        "@radix-ui/react-roving-focus": "1.1.13",
+        "@radix-ui/react-menu": "2.1.19",
+        "@radix-ui/react-primitive": "2.1.7",
+        "@radix-ui/react-roving-focus": "1.1.14",
         "@radix-ui/react-use-controllable-state": "1.2.3"
       },
       "peerDependencies": {
@@ -5852,25 +5978,25 @@
       }
     },
     "node_modules/@radix-ui/react-navigation-menu": {
-      "version": "1.2.16",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-navigation-menu/-/react-navigation-menu-1.2.16.tgz",
-      "integrity": "sha512-nJ0SkrSQgudyYhMiYeHA1ayLVuduEJCFLan1RZZN7c9kqzzCFLaU9kuy81uNtqzweM9YaQPgWzxi9MwQ9jZ04g==",
+      "version": "1.2.17",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-navigation-menu/-/react-navigation-menu-1.2.17.tgz",
+      "integrity": "sha512-fYeYQvbeNn5AQk2RBbpO7koLm2YbS00UYxC/IL2sgLlninEH5UNIv+X3E0KJ1Vy4WIo+dhN9w8GNqSHhbHWCIg==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
-        "@radix-ui/react-collection": "1.1.10",
+        "@radix-ui/react-collection": "1.1.11",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
         "@radix-ui/react-direction": "1.1.2",
-        "@radix-ui/react-dismissable-layer": "1.1.13",
+        "@radix-ui/react-dismissable-layer": "1.1.14",
         "@radix-ui/react-id": "1.1.2",
         "@radix-ui/react-presence": "1.1.6",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-callback-ref": "1.1.2",
         "@radix-ui/react-use-controllable-state": "1.2.3",
         "@radix-ui/react-use-layout-effect": "1.1.2",
         "@radix-ui/react-use-previous": "1.1.2",
-        "@radix-ui/react-visually-hidden": "1.2.6"
+        "@radix-ui/react-visually-hidden": "1.2.7"
       },
       "peerDependencies": {
         "@types/react": "*",
@@ -5888,19 +6014,19 @@
       }
     },
     "node_modules/@radix-ui/react-one-time-password-field": {
-      "version": "0.1.10",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-one-time-password-field/-/react-one-time-password-field-0.1.10.tgz",
-      "integrity": "sha512-GHkcJ+WVj91At+OvUVTD4R3W0/wxw9t/sG5xFUBYXaCbtWiooZX5Md376QjJqgH4VsVyXrbVNHO2O4NYcmjfVg==",
+      "version": "0.1.11",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-one-time-password-field/-/react-one-time-password-field-0.1.11.tgz",
+      "integrity": "sha512-Rsgab65u73E5kPVh8OS6PgPwJgPyf08GFfJDGAbMdF4DL7CgDhFOaDnXuk/DiMEVF6kgQwl0oJmFklvipmiOLg==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/number": "1.1.2",
         "@radix-ui/primitive": "1.1.4",
-        "@radix-ui/react-collection": "1.1.10",
+        "@radix-ui/react-collection": "1.1.11",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
         "@radix-ui/react-direction": "1.1.2",
-        "@radix-ui/react-primitive": "2.1.6",
-        "@radix-ui/react-roving-focus": "1.1.13",
+        "@radix-ui/react-primitive": "2.1.7",
+        "@radix-ui/react-roving-focus": "1.1.14",
         "@radix-ui/react-use-controllable-state": "1.2.3",
         "@radix-ui/react-use-effect-event": "0.0.3",
         "@radix-ui/react-use-is-hydrated": "0.1.1",
@@ -5922,16 +6048,16 @@
       }
     },
     "node_modules/@radix-ui/react-password-toggle-field": {
-      "version": "0.1.5",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-password-toggle-field/-/react-password-toggle-field-0.1.5.tgz",
-      "integrity": "sha512-fVuA82u0b/fClpbEJv8yp1nU9eSvoSEOERsU/hhf3FXGPIvkmE7oEaHEu8poowoXO39/Va7zq2E0TUcYr1dBRg==",
+      "version": "0.1.6",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-password-toggle-field/-/react-password-toggle-field-0.1.6.tgz",
+      "integrity": "sha512-pQ3xGp/uemomASPH97Eb3shfXX8QlG11bBJyEvRBV+vwtO4HvQlS06Yj9f31Ao7XepvF98SFrRgVDQ7jv+2xjQ==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
         "@radix-ui/react-id": "1.1.2",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-controllable-state": "1.2.3",
         "@radix-ui/react-use-effect-event": "0.0.3",
         "@radix-ui/react-use-is-hydrated": "0.1.1"
@@ -5952,22 +6078,22 @@
       }
     },
     "node_modules/@radix-ui/react-popover": {
-      "version": "1.1.17",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-popover/-/react-popover-1.1.17.tgz",
-      "integrity": "sha512-/YSAOdJ7YJvdn7bn5sdSx2egW+SKY+u7O5RyAVs94Ymrg2fg5QTSFPMRkzvhGyFuE4/qsmPBdrwYoZMZh/4f+g==",
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-popover/-/react-popover-1.1.18.tgz",
+      "integrity": "sha512-qdXDes+eHlnMUGlBAAAe5EG7oOQvqsXuq4mq585diMudg80iB+jHbsSeG3+Q4eWNsogNyhqU2p/3i+Y0iEepqg==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
-        "@radix-ui/react-dismissable-layer": "1.1.13",
+        "@radix-ui/react-dismissable-layer": "1.1.14",
         "@radix-ui/react-focus-guards": "1.1.4",
-        "@radix-ui/react-focus-scope": "1.1.10",
+        "@radix-ui/react-focus-scope": "1.1.11",
         "@radix-ui/react-id": "1.1.2",
-        "@radix-ui/react-popper": "1.3.1",
-        "@radix-ui/react-portal": "1.1.12",
+        "@radix-ui/react-popper": "1.3.2",
+        "@radix-ui/react-portal": "1.1.13",
         "@radix-ui/react-presence": "1.1.6",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-slot": "1.3.0",
         "@radix-ui/react-use-controllable-state": "1.2.3",
         "aria-hidden": "^1.2.4",
@@ -5989,16 +6115,16 @@
       }
     },
     "node_modules/@radix-ui/react-popper": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-popper/-/react-popper-1.3.1.tgz",
-      "integrity": "sha512-bhnq/0DEPTi2lsOD3J5rTL65qUKHbKbhqHsmN9TMiclSXpipi651ooUKPPp6G5lF/WiHBdn1s0Wuqsn+myVAvw==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-popper/-/react-popper-1.3.2.tgz",
+      "integrity": "sha512-3QXNeMkdshed1MR3LNoiCirBywRFPkD8ETJa/HlPuLwSajaQixf2ro+isoDNJlGABg9ug41XuZpINZJIle4XWg==",
       "license": "MIT",
       "dependencies": {
         "@floating-ui/react-dom": "^2.0.0",
-        "@radix-ui/react-arrow": "1.1.10",
+        "@radix-ui/react-arrow": "1.1.11",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-callback-ref": "1.1.2",
         "@radix-ui/react-use-layout-effect": "1.1.2",
         "@radix-ui/react-use-rect": "1.1.2",
@@ -6021,12 +6147,12 @@
       }
     },
     "node_modules/@radix-ui/react-portal": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-portal/-/react-portal-1.1.12.tgz",
-      "integrity": "sha512-m309havGzsjLHHaIX50G5PlvRs3xkgPCsGk/5PTvYm8D5q33yG0J7w/712PTOhid7NTaFETtnSXjngHQavvhVw==",
+      "version": "1.1.13",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-portal/-/react-portal-1.1.13.tgz",
+      "integrity": "sha512-z3oXfmaHLJTF1wktbjgD6cn9jiEbq3WSondB10LIuIt2m2Ym4iJlrW04/euMwENDdWDdE7z+OuY7Qyp1YpRSwA==",
       "license": "MIT",
       "dependencies": {
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-layout-effect": "1.1.2"
       },
       "peerDependencies": {
@@ -6068,9 +6194,9 @@
       }
     },
     "node_modules/@radix-ui/react-primitive": {
-      "version": "2.1.6",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-primitive/-/react-primitive-2.1.6.tgz",
-      "integrity": "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g==",
+      "version": "2.1.7",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-primitive/-/react-primitive-2.1.7.tgz",
+      "integrity": "sha512-bC3NiwsprbxKjuon9l7X6BUTw7FPVzEYaL92MPEY5SCd/9hUTPXVFtVwRix7778wtRsVao+zE062gL79FZleeQ==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/react-slot": "1.3.0"
@@ -6091,13 +6217,13 @@
       }
     },
     "node_modules/@radix-ui/react-progress": {
-      "version": "1.1.10",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-progress/-/react-progress-1.1.10.tgz",
-      "integrity": "sha512-JYzEg60lk79PwKM27WZyKd7PW8O4OM5jOaFfRPfOyeXmMw7tLJh5kSj+CEjVTehszuwml/AdCzPGMXBTGf4BBw==",
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-progress/-/react-progress-1.1.11.tgz",
+      "integrity": "sha512-KqiGJcFaZDc+BvveAgU3ZhACg2MvSUDrCBx4lRR/ZVRNal0bvt8lBpvnSkep9heeOuF8Qfw3fszLDX4OpQ2NVw==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/react-context": "1.1.4",
-        "@radix-ui/react-primitive": "2.1.6"
+        "@radix-ui/react-primitive": "2.1.7"
       },
       "peerDependencies": {
         "@types/react": "*",
@@ -6115,9 +6241,9 @@
       }
     },
     "node_modules/@radix-ui/react-radio-group": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-radio-group/-/react-radio-group-1.4.1.tgz",
-      "integrity": "sha512-/SSxZdKEo2Eo29FFRKd06EfFDYp8HryKg0WYg7QLXaydPzl52YfSvCH2a3QDBRdtcuwACroJT8UVjQVgOJ7P9A==",
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-radio-group/-/react-radio-group-1.4.2.tgz",
+      "integrity": "sha512-W8Uo9riHnlzLLWy+r2mVHUyuEWqD/+be4PZzbEvaGoFSBDHkm+GYWjtcE6u3AmPKNyfanWpnVfpZ2GqPCdzzsw==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
@@ -6125,8 +6251,8 @@
         "@radix-ui/react-context": "1.1.4",
         "@radix-ui/react-direction": "1.1.2",
         "@radix-ui/react-presence": "1.1.6",
-        "@radix-ui/react-primitive": "2.1.6",
-        "@radix-ui/react-roving-focus": "1.1.13",
+        "@radix-ui/react-primitive": "2.1.7",
+        "@radix-ui/react-roving-focus": "1.1.14",
         "@radix-ui/react-use-controllable-state": "1.2.3",
         "@radix-ui/react-use-previous": "1.1.2",
         "@radix-ui/react-use-size": "1.1.2"
@@ -6147,18 +6273,18 @@
       }
     },
     "node_modules/@radix-ui/react-roving-focus": {
-      "version": "1.1.13",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-roving-focus/-/react-roving-focus-1.1.13.tgz",
-      "integrity": "sha512-9gkwneI0guf8JDmrFxPjJF6Ozzgioyw+/lonYNCwefS9ZHA05er0BVHiXr+LbWGHxUfczvMY6G1oiZZi1VzjRw==",
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-roving-focus/-/react-roving-focus-1.1.14.tgz",
+      "integrity": "sha512-8Qcnx9447tx/aCBgw6Jenfqg4Skq+vqab9mCBmuGNipIS5YXvL275wbKEu7+ICYHIlAPgCduUMJH1XOYewKF6Q==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
-        "@radix-ui/react-collection": "1.1.10",
+        "@radix-ui/react-collection": "1.1.11",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
         "@radix-ui/react-direction": "1.1.2",
         "@radix-ui/react-id": "1.1.2",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-callback-ref": "1.1.2",
         "@radix-ui/react-use-controllable-state": "1.2.3"
       },
@@ -6178,9 +6304,9 @@
       }
     },
     "node_modules/@radix-ui/react-scroll-area": {
-      "version": "1.2.12",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-scroll-area/-/react-scroll-area-1.2.12.tgz",
-      "integrity": "sha512-xuafVzQiTCLsyEjakowTdG3OgTXsmO7IdCiO77otIa+z44xoLNs9Do5eg7POFumIOCjtG6djfm6RKUKpUa/csA==",
+      "version": "1.2.13",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-scroll-area/-/react-scroll-area-1.2.13.tgz",
+      "integrity": "sha512-7tncSubo2G0UY1e8rk+72qe3XRzrGnOLtZQ1PL1KoBfRUNX0NrJT5akb+0kfwSCc3gVR4wdHqyhAQBDpDNOwDw==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/number": "1.1.2",
@@ -6189,7 +6315,7 @@
         "@radix-ui/react-context": "1.1.4",
         "@radix-ui/react-direction": "1.1.2",
         "@radix-ui/react-presence": "1.1.6",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-callback-ref": "1.1.2",
         "@radix-ui/react-use-layout-effect": "1.1.2"
       },
@@ -6209,31 +6335,31 @@
       }
     },
     "node_modules/@radix-ui/react-select": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-select/-/react-select-2.3.1.tgz",
-      "integrity": "sha512-w6eDvY78LE9ZUiNnXCA1QVK8RYN7k9galFv09kjVydJqBAgHd7Y9A6h0UJ/6DCZNGZMZrB2ohcSW1Bo9d8+wWA==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-select/-/react-select-2.3.2.tgz",
+      "integrity": "sha512-brXD6C/V0fVK0DDbscLVw6LsXrjQ+ay8jdOBaN+tLb4vsHsAMm6Gt6eT77wHX1Eq8GPtD5rJ+RxFtfDozsb4+Q==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/number": "1.1.2",
         "@radix-ui/primitive": "1.1.4",
-        "@radix-ui/react-collection": "1.1.10",
+        "@radix-ui/react-collection": "1.1.11",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
         "@radix-ui/react-direction": "1.1.2",
-        "@radix-ui/react-dismissable-layer": "1.1.13",
+        "@radix-ui/react-dismissable-layer": "1.1.14",
         "@radix-ui/react-focus-guards": "1.1.4",
-        "@radix-ui/react-focus-scope": "1.1.10",
+        "@radix-ui/react-focus-scope": "1.1.11",
         "@radix-ui/react-id": "1.1.2",
-        "@radix-ui/react-popper": "1.3.1",
-        "@radix-ui/react-portal": "1.1.12",
+        "@radix-ui/react-popper": "1.3.2",
+        "@radix-ui/react-portal": "1.1.13",
         "@radix-ui/react-presence": "1.1.6",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-slot": "1.3.0",
         "@radix-ui/react-use-callback-ref": "1.1.2",
         "@radix-ui/react-use-controllable-state": "1.2.3",
         "@radix-ui/react-use-layout-effect": "1.1.2",
         "@radix-ui/react-use-previous": "1.1.2",
-        "@radix-ui/react-visually-hidden": "1.2.6",
+        "@radix-ui/react-visually-hidden": "1.2.7",
         "aria-hidden": "^1.2.4",
         "react-remove-scroll": "^2.7.2"
       },
@@ -6253,12 +6379,12 @@
       }
     },
     "node_modules/@radix-ui/react-separator": {
-      "version": "1.1.10",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-separator/-/react-separator-1.1.10.tgz",
-      "integrity": "sha512-Y6K6jLQCVfCnTL2MEtGxDLffkhNfEfHsEg3Wa8JU+IWdn3EWbLXd3OuOfQRN7p/W/cUce1WyTk3QeuAoDBzN9g==",
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-separator/-/react-separator-1.1.11.tgz",
+      "integrity": "sha512-jRhe86+8PF7VZ1u14eOWVOuh2BuAhALg/FT1VcMC4OHedMTRUazDnDlKTt+yxo5cRNKHMfmvZ4sSQtWDeMV4CQ==",
       "license": "MIT",
       "dependencies": {
-        "@radix-ui/react-primitive": "2.1.6"
+        "@radix-ui/react-primitive": "2.1.7"
       },
       "peerDependencies": {
         "@types/react": "*",
@@ -6276,18 +6402,18 @@
       }
     },
     "node_modules/@radix-ui/react-slider": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-slider/-/react-slider-1.4.1.tgz",
-      "integrity": "sha512-r91WSpQucNGFKAIxT8FT0H0zyjd5tJlqObLp7LOMV4z49KoDCwjy01w3vDOU4e1wxhF9IgjYco7SB6byOW7Buw==",
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-slider/-/react-slider-1.4.2.tgz",
+      "integrity": "sha512-qt5C1ppJz66aUDrH1VccjPrq7aFchK0wBrn6xsxlCHNUyE57dRRQ7lp1QFpF7OscMexZF8MCGBTVBlENHPkNiA==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/number": "1.1.2",
         "@radix-ui/primitive": "1.1.4",
-        "@radix-ui/react-collection": "1.1.10",
+        "@radix-ui/react-collection": "1.1.11",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
         "@radix-ui/react-direction": "1.1.2",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-controllable-state": "1.2.3",
         "@radix-ui/react-use-layout-effect": "1.1.2",
         "@radix-ui/react-use-previous": "1.1.2",
@@ -6327,15 +6453,15 @@
       }
     },
     "node_modules/@radix-ui/react-switch": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-switch/-/react-switch-1.3.1.tgz",
-      "integrity": "sha512-55bQtCnOB0BohomSHi6qvQXpJEEqUGDm6hRrM0Bph5OXwhSegqkd8IqgBAQkM1IlgUlWZIxpxRcpOEfRIgimyw==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-switch/-/react-switch-1.3.2.tgz",
+      "integrity": "sha512-tgRBI3DdNwAJYE4BBZyZcz/HRRCvAsPkRvG1wvKc+41tBGMxPn/a87T/wikXAvyDypNQ9kaZwHbeZe+veHCGpA==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-controllable-state": "1.2.3",
         "@radix-ui/react-use-previous": "1.1.2",
         "@radix-ui/react-use-size": "1.1.2"
@@ -6356,9 +6482,9 @@
       }
     },
     "node_modules/@radix-ui/react-tabs": {
-      "version": "1.1.15",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-tabs/-/react-tabs-1.1.15.tgz",
-      "integrity": "sha512-kxc9gI6/HfcU4nfMMVS3AmQK414kbU1IE6UCJmMmxjhO3cRPXOyYnmvyKD+ODt7q56nRq9l7Wovi6uaGwKgMlg==",
+      "version": "1.1.16",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-tabs/-/react-tabs-1.1.16.tgz",
+      "integrity": "sha512-v3Ab2l7z6U7tRB4xA0IyKdq0OsqaO1o9ZjsIEoKKnSZ/l96mZz8aCTX0NCXw+YVHJXr8Km4d+Mn6/Q8YjXa+gw==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
@@ -6366,8 +6492,8 @@
         "@radix-ui/react-direction": "1.1.2",
         "@radix-ui/react-id": "1.1.2",
         "@radix-ui/react-presence": "1.1.6",
-        "@radix-ui/react-primitive": "2.1.6",
-        "@radix-ui/react-roving-focus": "1.1.13",
+        "@radix-ui/react-primitive": "2.1.7",
+        "@radix-ui/react-roving-focus": "1.1.14",
         "@radix-ui/react-use-controllable-state": "1.2.3"
       },
       "peerDependencies": {
@@ -6386,23 +6512,23 @@
       }
     },
     "node_modules/@radix-ui/react-toast": {
-      "version": "1.2.17",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-toast/-/react-toast-1.2.17.tgz",
-      "integrity": "sha512-uL4kyyWy000pPL43fGGCV5qT6ZchCWEQZOSlkYiPwPt8Hy1iW38RjeptIvz1/SZesrW6Vn58Ct3sV7tfEfiAbw==",
+      "version": "1.2.18",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-toast/-/react-toast-1.2.18.tgz",
+      "integrity": "sha512-YNEnTHV47hPep+U0QvVM02OJNka9uygREc+k4Nh5VSZBg4MmE+myI442x3hCGfRpX7N2WSSYSJKws4gE+Z8lgg==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
-        "@radix-ui/react-collection": "1.1.10",
+        "@radix-ui/react-collection": "1.1.11",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
-        "@radix-ui/react-dismissable-layer": "1.1.13",
-        "@radix-ui/react-portal": "1.1.12",
+        "@radix-ui/react-dismissable-layer": "1.1.14",
+        "@radix-ui/react-portal": "1.1.13",
         "@radix-ui/react-presence": "1.1.6",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-callback-ref": "1.1.2",
         "@radix-ui/react-use-controllable-state": "1.2.3",
         "@radix-ui/react-use-layout-effect": "1.1.2",
-        "@radix-ui/react-visually-hidden": "1.2.6"
+        "@radix-ui/react-visually-hidden": "1.2.7"
       },
       "peerDependencies": {
         "@types/react": "*",
@@ -6420,13 +6546,13 @@
       }
     },
     "node_modules/@radix-ui/react-toggle": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-toggle/-/react-toggle-1.1.12.tgz",
-      "integrity": "sha512-AsAVsYNZIlRBsci7BhE+QyQeKd1h6TffJYt+lF0QQkd5OpQ3klfIByPsCb4G0h/Fq6PJwh1FYNluzBFYzhk4+w==",
+      "version": "1.1.13",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-toggle/-/react-toggle-1.1.13.tgz",
+      "integrity": "sha512-bI2ILJrzwgmAsH05TsJ9pVrzqQwAip7OM2/krqAdYn0R16bl86UPWbe5VPHsALat0EnqpV01cGtkleaUKPNdNg==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-controllable-state": "1.2.3"
       },
       "peerDependencies": {
@@ -6445,17 +6571,17 @@
       }
     },
     "node_modules/@radix-ui/react-toggle-group": {
-      "version": "1.1.13",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-toggle-group/-/react-toggle-group-1.1.13.tgz",
-      "integrity": "sha512-Xb9PLtlvU66F36LiKba6dFswu6V2mDkgidO4fNSbQHQwmZ9ObxMIO17MN/LJ4aWJecVuSVLAHPZjyeMzJrgeiA==",
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-toggle-group/-/react-toggle-group-1.1.14.tgz",
+      "integrity": "sha512-TK1vusNKb8IRhF23FTbRgUNZ9zfs5rGIyI7LfR3h26p9LrQ060i0uW9QWeD8baZMddaaP0DBGlIa6pbZG+mitg==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
         "@radix-ui/react-context": "1.1.4",
         "@radix-ui/react-direction": "1.1.2",
-        "@radix-ui/react-primitive": "2.1.6",
-        "@radix-ui/react-roving-focus": "1.1.13",
-        "@radix-ui/react-toggle": "1.1.12",
+        "@radix-ui/react-primitive": "2.1.7",
+        "@radix-ui/react-roving-focus": "1.1.14",
+        "@radix-ui/react-toggle": "1.1.13",
         "@radix-ui/react-use-controllable-state": "1.2.3"
       },
       "peerDependencies": {
@@ -6474,18 +6600,18 @@
       }
     },
     "node_modules/@radix-ui/react-toolbar": {
-      "version": "1.1.13",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-toolbar/-/react-toolbar-1.1.13.tgz",
-      "integrity": "sha512-Za1l4f6fzTkGgz/iynAMN8iaqiKff2wm2/QwiLmHPtDQreWEBrvSimgQFIekxMUdRPhILM7xdIXxuS/o/DGZag==",
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-toolbar/-/react-toolbar-1.1.14.tgz",
+      "integrity": "sha512-L/EkWVqlnj3lL2toHh4C7PwH2jxfa7OCq6lGfXSCii99ve2S4Ux5rc9HnOa7LN9exHa/Nl9kmCAmP9BuDPy5UA==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
         "@radix-ui/react-context": "1.1.4",
         "@radix-ui/react-direction": "1.1.2",
-        "@radix-ui/react-primitive": "2.1.6",
-        "@radix-ui/react-roving-focus": "1.1.13",
-        "@radix-ui/react-separator": "1.1.10",
-        "@radix-ui/react-toggle-group": "1.1.13"
+        "@radix-ui/react-primitive": "2.1.7",
+        "@radix-ui/react-roving-focus": "1.1.14",
+        "@radix-ui/react-separator": "1.1.11",
+        "@radix-ui/react-toggle-group": "1.1.14"
       },
       "peerDependencies": {
         "@types/react": "*",
@@ -6503,23 +6629,23 @@
       }
     },
     "node_modules/@radix-ui/react-tooltip": {
-      "version": "1.2.10",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-tooltip/-/react-tooltip-1.2.10.tgz",
-      "integrity": "sha512-NlNe8D0dWEpVfXFli90IO6X07Josx/b1iu98tDnx9Xv0HT4wLIL+m2VOheMHhK7qbp2HoTBqALEFzGyZs/levw==",
+      "version": "1.2.11",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-tooltip/-/react-tooltip-1.2.11.tgz",
+      "integrity": "sha512-8XZ6Py3y3W2nEzAUGCN5cfVKaUi+CVApcz1d6lrNVVf2hvYEixMRkq8k9ggPKnQUpRRuOV5avt8uvxViH2jLwA==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
-        "@radix-ui/react-dismissable-layer": "1.1.13",
+        "@radix-ui/react-dismissable-layer": "1.1.14",
         "@radix-ui/react-id": "1.1.2",
-        "@radix-ui/react-popper": "1.3.1",
-        "@radix-ui/react-portal": "1.1.12",
+        "@radix-ui/react-popper": "1.3.2",
+        "@radix-ui/react-portal": "1.1.13",
         "@radix-ui/react-presence": "1.1.6",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-slot": "1.3.0",
         "@radix-ui/react-use-controllable-state": "1.2.3",
-        "@radix-ui/react-visually-hidden": "1.2.6"
+        "@radix-ui/react-visually-hidden": "1.2.7"
       },
       "peerDependencies": {
         "@types/react": "*",
@@ -6589,9 +6715,9 @@
       }
     },
     "node_modules/@radix-ui/react-use-escape-keydown": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-escape-keydown/-/react-use-escape-keydown-1.1.2.tgz",
-      "integrity": "sha512-2uVLvLjgO7NZCWw01/FdqRwmA42J0BcjPMUCA+koFEOAb+zjqIP7SiFz/7zWPrKnVmSqr76Omq2ALyCuX4dhLw==",
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-escape-keydown/-/react-use-escape-keydown-1.1.3.tgz",
+      "integrity": "sha512-3wEkMiPHXha/2VadZ68rYBcmYnPINVGl4Y3gtcM7fKRjANk0OscK+cdqBgUWdozb7YJxsh0vefM7vgAMHXOjqg==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/react-use-callback-ref": "1.1.2"
@@ -6688,12 +6814,12 @@
       }
     },
     "node_modules/@radix-ui/react-visually-hidden": {
-      "version": "1.2.6",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-visually-hidden/-/react-visually-hidden-1.2.6.tgz",
-      "integrity": "sha512-jCE0WljWifTI4niIMCll06kGpsJTAPiZVU9H4WR1N6qW7At9ystHbN7dDB+we2xH535roFHj7qKS+RGj0FMDWQ==",
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-visually-hidden/-/react-visually-hidden-1.2.7.tgz",
+      "integrity": "sha512-1wNZBggTDK3GRuuQ6nP4k2yi7a6l7I5qbMPbZcRsrGsGVead/f/d5FhEzUvqFs0bcrDLx7n1zKQ3JvLR6whaaw==",
       "license": "MIT",
       "dependencies": {
-        "@radix-ui/react-primitive": "2.1.6"
+        "@radix-ui/react-primitive": "2.1.7"
       },
       "peerDependencies": {
         "@types/react": "*",
@@ -6742,20 +6868,10 @@
         }
       }
     },
-    "node_modules/@reduxjs/toolkit/node_modules/immer": {
-      "version": "11.1.8",
-      "resolved": "https://registry.npmjs.org/immer/-/immer-11.1.8.tgz",
-      "integrity": "sha512-/tbkHMW7y10Lx6i1crLjD4/OhNkRG+Fo7byZHtah0547nIeXYcpIXaUh0IAQY6gO5459qpGGYapcEOHtFXkIuA==",
-      "license": "MIT",
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/immer"
-      }
-    },
     "node_modules/@rolldown/binding-android-arm64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.3.tgz",
-      "integrity": "sha512-454rs7jHngixp/NMxd5srYD57OnzSlZ/eFTETjORQHLwJG1lRtmNOJcBerZlfu4GjKqeq8aCCIQrMdHyhI51Hw==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.4.tgz",
+      "integrity": "sha512-EZLpf/8y7GXkkra90ML47kzik/GMP3EMcE9bPyHmRfxLC6z9+aW5A8poCsoxjrT5GfEcNAAvWwUHjvP1pUQkfw==",
       "cpu": [
         "arm64"
       ],
@@ -6770,9 +6886,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-arm64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.3.tgz",
-      "integrity": "sha512-PcAhP+ynjURNyy8SKGl5DQP94aGuB/7JrXJb/t7P+hanXvQVMWzUvRRhBAcg/lNRadBhoUPqSoP4xw5tR/KBEA==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.4.tgz",
+      "integrity": "sha512-aUi+HBvmYb7j8krl1+qJgkG8C17fO79gk3c+jPw4S8glRFc1DTija9S3EyaTSQUm5GJXYKDAsugBEhFHH2vYiQ==",
       "cpu": [
         "arm64"
       ],
@@ -6787,9 +6903,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-x64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.3.tgz",
-      "integrity": "sha512-9YpfeUvSE2RS7wysJ81uOZkXJz7f7Q55H2Gvp3VEw/EsahqDtrphrZ0EwDLK5vvKOzaCrBsjF8JmnMLcUt78Gg==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.4.tgz",
+      "integrity": "sha512-F7hHC3gwY11+vByKPRWqwGbeXWVgKmL+pTGCinaEhdihzBV2aQ0fvZOch9cXYUOKuKKq429HeYXOqQLc7wFCEg==",
       "cpu": [
         "x64"
       ],
@@ -6804,9 +6920,9 @@
       }
     },
     "node_modules/@rolldown/binding-freebsd-x64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.3.tgz",
-      "integrity": "sha512-yB1IlAsSNHncV6SCTL27/MVGR5htvQsoGxIv5KMGXALp+Ll1wYsn+x98M9MW7qa+NdSbvrrY7ANI4wLJ0n1e6g==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.4.tgz",
+      "integrity": "sha512-sI5yw+7s92SK6odiEhD5lKCBlWcpjHS5qyqpVQbZAJ0fIzEUXrmbl3DH2ybR3PZogulNJF+COLtmA8hUfvkCCQ==",
       "cpu": [
         "x64"
       ],
@@ -6821,9 +6937,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.3.tgz",
-      "integrity": "sha512-Yi30IVAAfLUCy2MseFjbB1jAMDl1VMCAas5StnYp8da9+CKvMd2H2cbEjWcw5NPaPqzvYkVIaF1nNUG+b7u/sw==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.4.tgz",
+      "integrity": "sha512-mCi0OKgEieFircrtVYmQAFGszRtMnZ6fpZAXrxanXAu7lqZcsK1E1RAaZNG0uKAnxox3B1f4EyQNnoyMfN1vAA==",
       "cpu": [
         "arm"
       ],
@@ -6838,9 +6954,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-gnu": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.3.tgz",
-      "integrity": "sha512-jsO7R8To+AdlYgUmN5sHSCZbfhtMBkO0WUx8iORQnPcMMdgr7qM2DQmMwgabs3GhNztdmoKkMKQFHD6DTMCIQw==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.4.tgz",
+      "integrity": "sha512-B9Ial3Kv5sh0SHnB1g/QWcUQCEvCF6QKGAl4zXypYj65mVI+B4AhFBwPtSN7pDrJeIx8Z7zdy4ntx+wQABom7w==",
       "cpu": [
         "arm64"
       ],
@@ -6858,9 +6974,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-musl": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.3.tgz",
-      "integrity": "sha512-VWkUHwWriDciit80wleYwKILoR/KMvxh/IdwS/paX+ZgpuRpCrKLUdadJbc0NpBEiyhpYawsJ73j9aCvOH+f7Q==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.4.tgz",
+      "integrity": "sha512-lZVym0PuHE1KZ22gmFTC15lAkrg9iTszR617oYRB/iPY1A56ywoJzVKOJBKaot5RiikCObmur6pogpse3gRcng==",
       "cpu": [
         "arm64"
       ],
@@ -6878,9 +6994,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.3.tgz",
-      "integrity": "sha512-5f1laC0SlIR0yDbFCd8acUhvJIag6N3zC5P7oUPN6wX0aOma+uKJ0wBDH5aq7I1PVI2ttTlhJwzwRIBnLiSGEg==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.4.tgz",
+      "integrity": "sha512-t2DNiLJWNTbnEHyUzTumldML6ET4/g16467LZoDDJ3tSxGvguL5/NyC2lCsNKuyRycg9XeDQF5SSv+TNOhQEXg==",
       "cpu": [
         "ppc64"
       ],
@@ -6898,9 +7014,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-s390x-gnu": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.3.tgz",
-      "integrity": "sha512-Iq4ko0r4XsgbrF/LunNgHtAGLRRVE2kXonAXQ/MV0mC6jQpMOhW1SvtZja2EhC/kd05++bP78dsqBeIQyYJ6Yg==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.4.tgz",
+      "integrity": "sha512-0WIRnL1Uw4BvTZRLQt+PVgo6ZKTJadlC2btP+/EOXv2f/DWbY0rEgl+y834mIVwP1FkTlWVTrGGJXf12lru7EQ==",
       "cpu": [
         "s390x"
       ],
@@ -6918,9 +7034,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-gnu": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.3.tgz",
-      "integrity": "sha512-B8m6tD5+/N5FeNQFbKlLA/2yVq9ycQP1SeedyEYYKWBNR3ZQbkvIUcNnDNM03lO1l5F2roiiFJGgvoLLyZXtSg==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.4.tgz",
+      "integrity": "sha512-JWtGshGfX+oENAKonoNkqEJX+7hC8yfhi9GUyPX1VX4mdh1y5r+ZiJLR5XzAB0aoP6s/PcILsGjKq8O0mm24bw==",
       "cpu": [
         "x64"
       ],
@@ -6938,9 +7054,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-musl": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.3.tgz",
-      "integrity": "sha512-pSdpdUJHkuCxun9LE7jvgUB9qsRgaiyNNCX7m/AvHTcq67AiT/Yhoxvw5zPfhrM8k/BfP8ce/hMOpthKDpEUow==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.4.tgz",
+      "integrity": "sha512-rT6yQcxUuXs4CnbofqwHRRV0iem349rLMYpTjkgQGLjrY4ado/eDzwPZPTCgTOlF6Nkp8NEv70yLMTn6qkWxsQ==",
       "cpu": [
         "x64"
       ],
@@ -6958,9 +7074,9 @@
       }
     },
     "node_modules/@rolldown/binding-openharmony-arm64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.3.tgz",
-      "integrity": "sha512-OXXS3RKJgX2uLwM+gYyuH5omcH8fL1LJs96pZGgtetVCahON57+d4SJHzTgZiOjxgGkSnpXpOsWuPDGAKAigEg==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.4.tgz",
+      "integrity": "sha512-KXMGoboq5cyaCQjDA4GLuRiOwBQ0EyFnJoVViLeZ45/3rFItRODEr+NdsBcVpll40hhNArlm/speWGRvj08LzA==",
       "cpu": [
         "arm64"
       ],
@@ -6975,9 +7091,9 @@
       }
     },
     "node_modules/@rolldown/binding-wasm32-wasi": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.3.tgz",
-      "integrity": "sha512-JTtb8BWFynicNSoPrehsCzBtOKjZ6jhMiPFEmOiuXg1Fl8dn2KHQob+GuPSGR0dryQa1PQJbzjF3dqO/whhjLg==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.4.tgz",
+      "integrity": "sha512-5K83rb36oJiY7BCyE9zLZtGcPV4g5wvq+xwdO0XPIwDVZI8cyB/AUjkNXGb92/rnmezEkjMOpgY61rtwjQtFwg==",
       "cpu": [
         "wasm32"
       ],
@@ -6985,18 +7101,18 @@
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/core": "1.10.0",
-        "@emnapi/runtime": "1.10.0",
-        "@napi-rs/wasm-runtime": "^1.1.4"
+        "@emnapi/core": "1.11.1",
+        "@emnapi/runtime": "1.11.1",
+        "@napi-rs/wasm-runtime": "^1.1.6"
       },
       "engines": {
         "node": "^20.19.0 || >=22.12.0"
       }
     },
     "node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/runtime": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
-      "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.1.tgz",
+      "integrity": "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -7005,9 +7121,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-arm64-msvc": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.3.tgz",
-      "integrity": "sha512-gEdFFEN70A/jxb2svrWsN3aDL7OUtmvlOy+6fa2jxG8K0wQ1ZbdeLGnidov6Yu5/733dI5ySfzFlQ/cb0bSz1g==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.4.tgz",
+      "integrity": "sha512-PnWBtw3TV5KOg69HQQDR0mnQuyCmSGR2pAB4DC1rPF808fgKeTUMj2EOEyKATpgiuxuR5APQmiDO7PDgEjTFSA==",
       "cpu": [
         "arm64"
       ],
@@ -7022,9 +7138,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-x64-msvc": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.3.tgz",
-      "integrity": "sha512-eXB7CHuaQdqmJcc3koCNtNPmT/bj2gc999kUFgBxG8Ac0NdgXc4rkCHhqrgrhN3zddvvvrgzj1e90SuSfmyIXA==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.4.tgz",
+      "integrity": "sha512-M1lpniBePobTfsa7Ks9a199e1akxsXn+GYBUKsEzv3YFzOm1HJAMNwKI3qr0Zq+mxwx9gOZoTdP1yXRYsZUocQ==",
       "cpu": [
         "x64"
       ],
@@ -7090,6 +7206,26 @@
         }
       }
     },
+    "node_modules/@rollup/plugin-commonjs/node_modules/estree-walker": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-2.0.2.tgz",
+      "integrity": "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w==",
+      "devOptional": true,
+      "license": "MIT"
+    },
+    "node_modules/@rollup/plugin-commonjs/node_modules/picomatch": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
+      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
+      "devOptional": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "node_modules/@rollup/plugin-esm-shim": {
       "version": "0.1.8",
       "resolved": "https://registry.npmjs.org/@rollup/plugin-esm-shim/-/plugin-esm-shim-0.1.8.tgz",
@@ -7199,10 +7335,30 @@
         }
       }
     },
+    "node_modules/@rollup/pluginutils/node_modules/estree-walker": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-2.0.2.tgz",
+      "integrity": "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w==",
+      "devOptional": true,
+      "license": "MIT"
+    },
+    "node_modules/@rollup/pluginutils/node_modules/picomatch": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
+      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
+      "devOptional": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "node_modules/@rollup/rollup-android-arm-eabi": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.62.0.tgz",
-      "integrity": "sha512-IPIQ55ythEHkfEd9jMEi32OQ7SxURsGA43JI22lj01OLZNt2NUbJX8YUHxkVWyQ6daHPNn0truF5nSj3DQp6YQ==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.62.2.tgz",
+      "integrity": "sha512-6o7ZLZK+BeenkZCFNDXqpbjw9bD6nuWonvS/lwQJp7NoVVxm6p3qE7qQ5jGuBjiFsgvqjD8mZAU5oWxTmbOeOg==",
       "cpu": [
         "arm"
       ],
@@ -7213,9 +7369,9 @@
       ]
     },
     "node_modules/@rollup/rollup-android-arm64": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.62.0.tgz",
-      "integrity": "sha512-M6s9cr10MibETyo8JsOkq+Lo1+lU6hcvb1MApnUql5qte/5hMEgzlN8/ReIKNfRV8rrqX50W1BX9zoUhC192RA==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.62.2.tgz",
+      "integrity": "sha512-BaH7BllCACHoH1LguOU56UItGfUWjujlO65kS9LAodViaN4bwIKd7oeW/ZHJ/4ljr/7MIiENnNy3HJ0zXv8Zkw==",
       "cpu": [
         "arm64"
       ],
@@ -7226,9 +7382,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-arm64": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.62.0.tgz",
-      "integrity": "sha512-BqCoMoIbn0keKys+dEAdBa70EtOwV1bEsQCUgU9FdiZmmMge/Zk7LlkYGqbrdHR+Frnt0E1FOanly+rlwvvQzw==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.62.2.tgz",
+      "integrity": "sha512-v39RCCvj4He82I9sFmk+M1VZ0PLM9sfsLVikjfx2hYBNALhrrOR2D3JjQA6AhlaSOgcR+RzrKY7e1+bT6SUO/A==",
       "cpu": [
         "arm64"
       ],
@@ -7239,9 +7395,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-x64": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.62.0.tgz",
-      "integrity": "sha512-SIMzST3VFNXDAbeIWDWiFCNM5qncUBDWaEV7NfE7oZbDt2mgfW4MvbKdbYiGOLoM32gbTv608UMd0XktEYSD7w==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.62.2.tgz",
+      "integrity": "sha512-yl0y2vq3S3lHeuXhEdss6TWfKW8vkujImO12tn4ZkG/4oghr09LvdYm2RElVjokTQiUvDUGXLGsYeLqUMCKpGA==",
       "cpu": [
         "x64"
       ],
@@ -7252,9 +7408,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-arm64": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.62.0.tgz",
-      "integrity": "sha512-ezjfSQMP7ArdUsbBwbQIfwAlhE84I2iVnzQNCFSveqV42q+BmKlzVpf7mxv5EchLcoWU4y6/heFzVg1F+hodUQ==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.62.2.tgz",
+      "integrity": "sha512-tT4pvt4qXD+vEoezupCWi+a1F0vvDiksiHc+PxRlYTOH1I6/X4id9jPxTP+Fg+545euaFT1jJVs4CEdHZAU1vw==",
       "cpu": [
         "arm64"
       ],
@@ -7265,9 +7421,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-x64": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.62.0.tgz",
-      "integrity": "sha512-9+qTWGW9AZRhnUgwtTwzNwcPlL87ngkeN0LA+q1bADvmY9aNvWaF2TFW8BZgnQPYxpDI7+rMVLivcd4V737TAQ==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.62.2.tgz",
+      "integrity": "sha512-6nU5F2wCW+qvCBhTn1pdIU3bzsIoF7EUwsCDRxilWGprQR6yd508YnH9+OKFCwpfS8pjZqDUmnCAr7exax0XCg==",
       "cpu": [
         "x64"
       ],
@@ -7278,9 +7434,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.62.0.tgz",
-      "integrity": "sha512-T1dMEQhXA/jkJ/jyMIw9IovK8bSUq7A8kLIlvZTb/6YIVsp2zLavr4F3oyllHWo7eIVJRyE5n3tUjQJEbE1IuQ==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.62.2.tgz",
+      "integrity": "sha512-n1GJHPOvpIfhi3TmrCeh6S6URt9BFCt0KQE3qvexyGCTAKpR4Lg+eWvNZEqu7epxwus/8ElT3hacYEucm49SZg==",
       "cpu": [
         "arm"
       ],
@@ -7294,9 +7450,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-musleabihf": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.62.0.tgz",
-      "integrity": "sha512-2as0LgT7qQpyceQq6VUJYnumUMUrgGQCWIiDIN9DE0/tglsk6o66uCB4f3djRawAltvfCNLyZZrsqbPA6inCsA==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.62.2.tgz",
+      "integrity": "sha512-JqgflS8wEB+UXV/vS1RpRbifGBeN4D5lz8D8oOFbFZw4vedvdOgCFAjfBmIMdW3yL10XpQQ0Ambepw6MXrhOnA==",
       "cpu": [
         "arm"
       ],
@@ -7310,9 +7466,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-gnu": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.62.0.tgz",
-      "integrity": "sha512-bVURMg+6eNN9C/yc0aVjooZcwTTtYF4YW3xta5pP0//r3o1V8gXEHXWCndj47w/HhwsFroZrFhR+6uQP5T0n0g==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.62.2.tgz",
+      "integrity": "sha512-wnFJkogWvN4jm/hQRF2UBaeUmk20j5+DmHvoyWii2b8HJDyvz1MF2OU/6ynXt2KR63rbZLWkFpoytpdc/yBuSA==",
       "cpu": [
         "arm64"
       ],
@@ -7326,9 +7482,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-musl": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.62.0.tgz",
-      "integrity": "sha512-Ful8pM/2yYI83PViWdFdpZhdI8HJ5qsXANe5atypbHDf+KIBBDsZsbyy8hbXnULVvW9NsTh5DHwbcBftyLTfiw==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.62.2.tgz",
+      "integrity": "sha512-HVu2bp0zhvJ8xHEV9+UUs7S90VadmBSY3LcIMvozbPo4AuMGDWlz3ymHLHZPX4hR67TKTt8Qp5PJ5RBg/i+RMQ==",
       "cpu": [
         "arm64"
       ],
@@ -7342,9 +7498,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-loong64-gnu": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.62.0.tgz",
-      "integrity": "sha512-9Gp/DgrkzfUBmNPVTyPTvay+4xEP7M/clXpj3efXBcm6uTIVIgDg4rqUpqKXvLEuFRVuEpSAOkhgNeecvaZ4Cg==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.62.2.tgz",
+      "integrity": "sha512-mQqqAV8QaoSgr9I2fKDLY2BAVvmKjWoGiu/cSYQonsLvtqwEn1E4QYfnCOcp5zoEqNhsDYin1s6jx/VJmrxlZg==",
       "cpu": [
         "loong64"
       ],
@@ -7358,9 +7514,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-loong64-musl": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.62.0.tgz",
-      "integrity": "sha512-m9tsJz54LUXkSYM8+8PG81B9IKK5r+2T0clMq4QrS16xFosufU7firBDAZEsDheDs7wTlP7h3++S7lMsU955HA==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.62.2.tgz",
+      "integrity": "sha512-IxKLoxCQ2IWi6bT2akyDUBGsOImDKB+sPp4EsTmwFQ/fMwpCKm8uLSSgP/Kx/QYUgKis6SEZ5/Nlhup0DIA0PQ==",
       "cpu": [
         "loong64"
       ],
@@ -7374,9 +7530,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-ppc64-gnu": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.62.0.tgz",
-      "integrity": "sha512-3UvJ5PNVU16aJf6M3tFI24pWzAl2/ynfbyRN3ICyQajK1lSkrnVYNnLz3v04J32qKa0FczJc22zeToc0lr2A3w==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.62.2.tgz",
+      "integrity": "sha512-Mk5ha2RQSgyFfmYYLkBpPnUk8D8FriBxesO1u9O75X0mHgXL1UQcH5Itl2lurWL2tj0RxV9b9tJgipac0hRY9A==",
       "cpu": [
         "ppc64"
       ],
@@ -7390,9 +7546,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-ppc64-musl": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.62.0.tgz",
-      "integrity": "sha512-vRWUAbYLGHBZS6Q8Msb2sfnf1fvJf+47t8l/TwOerM2qArzy+IeNMTHrYLHXh95h8MoatPHI5hhSZNs+mGXKPg==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.62.2.tgz",
+      "integrity": "sha512-CjvEnqJL/0/TQ3TXX3OPIJ/kmBellrWd4heXUmHeJlTnmwjKpSJzoehLaL6Xk0ZnMHBu9dZuFADNOrtjF4v+2w==",
       "cpu": [
         "ppc64"
       ],
@@ -7406,9 +7562,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-gnu": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.62.0.tgz",
-      "integrity": "sha512-c00T5SYENHAt86cfW47URaP3Us5vLC/4QO7GYud1G5VNRffCwwCuBspwqYrriuJB+5m0WFzClCn9wed0FBjKvg==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.62.2.tgz",
+      "integrity": "sha512-1SiZbzwdkaDURsew/tSOrooKiYy7EQGT6m8ufavAi9NEyQb/6VuIxFXAL1fqa4iZe3g4NbNk4P7J32z2tw5Mgg==",
       "cpu": [
         "riscv64"
       ],
@@ -7422,9 +7578,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-musl": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.62.0.tgz",
-      "integrity": "sha512-krrCDilhXOwFkSkO3Wm9I/f9H0L92XHHwy2fwxjukxIbh0dem8gZqOW5Y8BsHrpJv5qwlRBV+Wl4ZFyRWhUpwg==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.62.2.tgz",
+      "integrity": "sha512-nQts12zJ3NQRoE6uYljOH89v7szzLDvG2JD/vsX+vGXU8w/At1GowTZ5/7qeFQ8m7L55rpR8Okugnuo5bgjy2Q==",
       "cpu": [
         "riscv64"
       ],
@@ -7438,9 +7594,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-s390x-gnu": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.62.0.tgz",
-      "integrity": "sha512-7pfYFSTc4/rUC/FtAI0Qp6QthDBCIi6/AuP1xYqFk5vanI6KnL5dWKP60OM/05LOsbwTmIcvr6eXC4CJuJ75IA==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.62.2.tgz",
+      "integrity": "sha512-E9/ll019jhPIJgpzfZoIkBGhcz+kKNgVWYRY0zr9srBdPPFVpvOKW8VaJKUbeK+eZXyQF9ltME+Kk6affeaPgg==",
       "cpu": [
         "s390x"
       ],
@@ -7454,9 +7610,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-gnu": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.62.0.tgz",
-      "integrity": "sha512-7SDIalKeIpG0Ifogbbdn58HmSotYMlf23K3dCJEmiVd9Fg36Vmni82iPQec27N3wY4Bvbxftkxz6vSx9OcouTg==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.62.2.tgz",
+      "integrity": "sha512-5BqxR/pshjey51iliyzTD5Xi3EN0aLmQ2lZ3lvefVV9c82BvrLo2/6OT55iifpWBufs6kdwWbuOKS841DrmK9A==",
       "cpu": [
         "x64"
       ],
@@ -7470,9 +7626,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-musl": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.62.0.tgz",
-      "integrity": "sha512-eRZevouTH2i1HeAVLqJuLnt256krQkGY0TN6WsTmsIhuzbh457HuWDMakKwmi0Cjadux983CoSr8Lim2QhUIFw==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.62.2.tgz",
+      "integrity": "sha512-uNN83XxQrRAh/w0/pmAfibcwyb6YWt4gP+dpnQKPVJshAloQ785ii8CT8ZCIxkGg9opVsvAlGhFitSm6D1Jjpg==",
       "cpu": [
         "x64"
       ],
@@ -7486,9 +7642,9 @@
       ]
     },
     "node_modules/@rollup/rollup-openbsd-x64": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.62.0.tgz",
-      "integrity": "sha512-3oVS7FLGa4U1qcvao9ylGxrjXZyUQqR8UwxEcnUEyPX53O/C/mKDZegNXTdHCP+h3e6ta/f1EN38Yif1mmZHYg==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.62.2.tgz",
+      "integrity": "sha512-srjEIxSH3LRnJN6THczDHWQplqEMFiAJrTab0msUryh9kwNpkICf3Ea6q6MN/2cZwRFUNx5w+h6Hpi4QuHS6Zg==",
       "cpu": [
         "x64"
       ],
@@ -7499,9 +7655,9 @@
       ]
     },
     "node_modules/@rollup/rollup-openharmony-arm64": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.62.0.tgz",
-      "integrity": "sha512-yTB9TgfWj5wHe5QgktAgXTLLot1gvEjl1NiPPAUiCs4oPrIWFl5V4nC3GrkNdj9LaAU4s94nVrGbGOCqUpyWsg==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.62.2.tgz",
+      "integrity": "sha512-8hOJnxgbyObnCm5AlRA3A931xX19xq80RjVTKgJOvEKWqJruP/Uf12IbAOaDjjEXYRewwHLfmF0YRIdK3OwKWA==",
       "cpu": [
         "arm64"
       ],
@@ -7512,9 +7668,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-arm64-msvc": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.62.0.tgz",
-      "integrity": "sha512-5LOhoaesY3doG1c+ac/2JtgREpKoJr5bUHH8tKY0V8di7+uSV6BwLs2PlR0/yzefGOkR+wE7ZolZphHCsyG5Rw==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.62.2.tgz",
+      "integrity": "sha512-mmF4AY1i0hG/bLWUctUq59gtmgaSIRa3cu/A3JFRp/sCNEme2bgDEiDS22P9FbnJB8NJNF4jPJiSP5RHQpUTDg==",
       "cpu": [
         "arm64"
       ],
@@ -7525,9 +7681,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-ia32-msvc": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.62.0.tgz",
-      "integrity": "sha512-yYkWHhmbhRTWTnWos5HC4GcPQfjlzzCNbM9e/+GXrLuaBXYA3qSDR9f0Vgufd5S8yX81U8jPKp7ZnAjZFMtRnw==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.62.2.tgz",
+      "integrity": "sha512-DZgkknc6jhHrk46V25vbAM0zZkyP0nSDkJB8/dRkLTxv470dOmWDqGoEJl/9A0dFfS7yE3REOwNDxpHwSLSt0Q==",
       "cpu": [
         "ia32"
       ],
@@ -7538,9 +7694,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-x64-gnu": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.62.0.tgz",
-      "integrity": "sha512-SoTb6lPg25xZlA2ibwQ++ahCCnH+FP0qmEuafMJ4gznZKOlXioKEAeJLgCrqjM98ACziXM9V1amFjICVL4IFoA==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.62.2.tgz",
+      "integrity": "sha512-T6xr6ucWSFto+VGajA8YH26LdpHRuP4YLHEKAtCWvJDOlnmWcDZVCI2Jmjr+IFHDlt2zRaTAKE4tfjTaWLgJBg==",
       "cpu": [
         "x64"
       ],
@@ -7551,9 +7707,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-x64-msvc": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.62.0.tgz",
-      "integrity": "sha512-5L+T1fMX4RIEBoZzT0+sQ0PhTS36NULFmMXtl1TZo44TMAROIMHbZufSOjVWt/Y622BtxgxtaNOokbTDvfsrZA==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.62.2.tgz",
+      "integrity": "sha512-BfzEnDJOt9T8M989/lA37EcJgat01wLRnoi5dQf3QzOH7jzpqTAzdDbVfRljVr5r+jzKqpbHeyOfAaXxAd0PAA==",
       "cpu": [
         "x64"
       ],
@@ -7645,12 +7801,12 @@
       }
     },
     "node_modules/@shikijs/primitive": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/primitive/-/primitive-4.2.0.tgz",
-      "integrity": "sha512-NOq+DtUkVBJtZMVXL5A0vI0Xk8nvDYaXetFHSJFlOqjDZIVhIPRYFdGkSoElDqNuegikcc3A76SNUa8dTqtAYA==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/primitive/-/primitive-4.3.1.tgz",
+      "integrity": "sha512-CXQRQOYy1leqQ8ceTeJdmXv/bsUY++6QyLpXJ94LZAAYj5X2SKRdc5ipguv4NPyGVKItB2PPwUpRNe0Sjh5S1A==",
       "license": "MIT",
       "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.3.1",
         "@shikijs/vscode-textmate": "^10.0.2",
         "@types/hast": "^3.0.4"
       },
@@ -7659,9 +7815,9 @@
       }
     },
     "node_modules/@shikijs/primitive/node_modules/@shikijs/types": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/types/-/types-4.2.0.tgz",
-      "integrity": "sha512-VT/MKtlpOhEPZloSH3Pb9WCZEBDoQVMa9jedp5UAwmJOar1DVc9DRODAxmYPW9M93IK4ryuqRejFfmlvlVDemw==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/types/-/types-4.3.1.tgz",
+      "integrity": "sha512-CHFxE0jztBIZRHH6gxXE7DXUCFXjReEGxZ/j0rfSLGKZuwp2xBYycEP14875DSa9KLL/6700oxIq6oO6ef9K2g==",
       "license": "MIT",
       "dependencies": {
         "@shikijs/vscode-textmate": "^10.0.2",
@@ -7771,9 +7927,9 @@
       }
     },
     "node_modules/@slack/types": {
-      "version": "2.21.1",
-      "resolved": "https://registry.npmjs.org/@slack/types/-/types-2.21.1.tgz",
-      "integrity": "sha512-I8vmSjNYWsaxuWPx6dz4yeh0h7vRBWbgAMK14LEmblbZ404BtrPbXs6jDPx4cYgGf8msDGF4A9opLZBu21FViQ==",
+      "version": "2.22.0",
+      "resolved": "https://registry.npmjs.org/@slack/types/-/types-2.22.0.tgz",
+      "integrity": "sha512-sZ9lIgJhPX2qft/tKWiklFlc0o1FWeI7QtciZJfW1+ErH1eGGHvOZ8e73sleTCFEFJp1q/R0WeS8Oa7AsiDprg==",
       "license": "MIT",
       "engines": {
         "node": ">= 12.13.0",
@@ -7781,9 +7937,9 @@
       }
     },
     "node_modules/@slack/web-api": {
-      "version": "7.17.0",
-      "resolved": "https://registry.npmjs.org/@slack/web-api/-/web-api-7.17.0.tgz",
-      "integrity": "sha512-jejr34a8B4L5AS713wOAx1LAqNkW16HVMDEa6sYBvFDc/llUBl8hXaiI4BwF+Al+Sug19Vn2O7iokTVIhVvZ1Q==",
+      "version": "7.18.0",
+      "resolved": "https://registry.npmjs.org/@slack/web-api/-/web-api-7.18.0.tgz",
+      "integrity": "sha512-EWBsKUhOFFp87beQg/ToSC+asWB7BrGHuh7uPC1ZI9vr41GjS+3WmmyWIMqs+mF6U+mh4d6HhtFlv67TrJFsvw==",
       "license": "MIT",
       "dependencies": {
         "@slack/logger": "^4.0.1",
@@ -7817,6 +7973,15 @@
         "node": ">=8"
       }
     },
+    "node_modules/@slack/web-api/node_modules/retry": {
+      "version": "0.13.1",
+      "resolved": "https://registry.npmjs.org/retry/-/retry-0.13.1.tgz",
+      "integrity": "sha512-XQBQ3I8W1Cge0Seh+6gjj03LbmRFWuoszgK9ooCpwYIrhhoO80pfq4cUkU5DkknwfOfFteRwlZ56PYOGYyFWdg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4"
+      }
+    },
     "node_modules/@socket.io/component-emitter": {
       "version": "3.1.2",
       "resolved": "https://registry.npmjs.org/@socket.io/component-emitter/-/component-emitter-3.1.2.tgz",
@@ -7888,27 +8053,27 @@
       }
     },
     "node_modules/@supabase/auth-js": {
-      "version": "2.108.2",
-      "resolved": "https://registry.npmjs.org/@supabase/auth-js/-/auth-js-2.108.2.tgz",
-      "integrity": "sha512-tNaQmBgodDZwgB40mRwVbxFy8IDYwjdpcZ0BYrWiwlULCSQoJj4QoG4zgJT7QRPXcqipefNOzvO/qAu4dF98ag==",
+      "version": "2.110.0",
+      "resolved": "https://registry.npmjs.org/@supabase/auth-js/-/auth-js-2.110.0.tgz",
+      "integrity": "sha512-Mi288WCTp6wxMFCOu/UgzgHEXODjdl2uVTLqK11eanzGZaldU3RyP8Am+ZbNuVzFP+5+iOvppxzv7N5Ym84xTg==",
       "license": "MIT",
       "dependencies": {
         "tslib": "2.8.1"
       },
       "engines": {
-        "node": ">=20.0.0"
+        "node": ">=22.0.0"
       }
     },
     "node_modules/@supabase/functions-js": {
-      "version": "2.108.2",
-      "resolved": "https://registry.npmjs.org/@supabase/functions-js/-/functions-js-2.108.2.tgz",
-      "integrity": "sha512-RNUX8EiBy3iLwAX19jtRzLyePnl11/fHcgwDHLnpKcDSXt/5qBnh3LUwAtIjT21Q66QsmNUR2esrHziLCpNubw==",
+      "version": "2.110.0",
+      "resolved": "https://registry.npmjs.org/@supabase/functions-js/-/functions-js-2.110.0.tgz",
+      "integrity": "sha512-Fde5wlY8ZZy+9yqrWlQHo8MacSyUBArBEtN2boB4thJQigPnQD/cc61qZN0n3I1L0gwhWtHYwIMnOBKxSvF6Hw==",
       "license": "MIT",
       "dependencies": {
         "tslib": "2.8.1"
       },
       "engines": {
-        "node": ">=20.0.0"
+        "node": ">=22.0.0"
       }
     },
     "node_modules/@supabase/phoenix": {
@@ -7918,28 +8083,28 @@
       "license": "MIT"
     },
     "node_modules/@supabase/postgrest-js": {
-      "version": "2.108.2",
-      "resolved": "https://registry.npmjs.org/@supabase/postgrest-js/-/postgrest-js-2.108.2.tgz",
-      "integrity": "sha512-GQ28/Y8hk3CFmkb3kXH1h/AQx6JIYSQfO0CJMRVBcEKZoNy6C45cXAZ4fcJvRC5Id0cs6xnkUV0+c0rIocigsw==",
+      "version": "2.110.0",
+      "resolved": "https://registry.npmjs.org/@supabase/postgrest-js/-/postgrest-js-2.110.0.tgz",
+      "integrity": "sha512-ZbC1QZL3jcvBUfVKjJbgRM27G4Mg3Zzqdm44m5pJafe1e52Cli793EOnwQucomBAGEUDd03Nzaf7XV3ji/XexQ==",
       "license": "MIT",
       "dependencies": {
         "tslib": "2.8.1"
       },
       "engines": {
-        "node": ">=20.0.0"
+        "node": ">=22.0.0"
       }
     },
     "node_modules/@supabase/realtime-js": {
-      "version": "2.108.2",
-      "resolved": "https://registry.npmjs.org/@supabase/realtime-js/-/realtime-js-2.108.2.tgz",
-      "integrity": "sha512-aAGxCSUemZvQIibnCdvNvgaKib28I4rfrNjKbQ9cG1uBLwUsI7hVpGXgEbypCCDhLjQlDTAiJlu7rgljYUT73g==",
+      "version": "2.110.0",
+      "resolved": "https://registry.npmjs.org/@supabase/realtime-js/-/realtime-js-2.110.0.tgz",
+      "integrity": "sha512-Wn2AWpneZuDFTkp/65tqctvoh+3JvyTjMam8sTMqVWy5BgkU8zAvFwilPYPPPhkINeKF8NAJKP7FclJ2iGCUMw==",
       "license": "MIT",
       "dependencies": {
-        "@supabase/phoenix": "^0.4.2",
+        "@supabase/phoenix": "0.4.4",
         "tslib": "2.8.1"
       },
       "engines": {
-        "node": ">=20.0.0"
+        "node": ">=22.0.0"
       }
     },
     "node_modules/@supabase/ssr": {
@@ -7954,33 +8119,46 @@
         "@supabase/supabase-js": "^2.105.3"
       }
     },
+    "node_modules/@supabase/ssr/node_modules/cookie": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-1.1.1.tgz",
+      "integrity": "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
     "node_modules/@supabase/storage-js": {
-      "version": "2.108.2",
-      "resolved": "https://registry.npmjs.org/@supabase/storage-js/-/storage-js-2.108.2.tgz",
-      "integrity": "sha512-TVZPQxXGxY2+A6yTtm77zUHsh70lBhYUEaJL8RQC+BghcX/ygiMG/rmXrNVBce30/WAeNPa8FiG8HbqlGeV05g==",
+      "version": "2.110.0",
+      "resolved": "https://registry.npmjs.org/@supabase/storage-js/-/storage-js-2.110.0.tgz",
+      "integrity": "sha512-71+gU3HrhiylAhftY6FmO5PPdcsScnVcS766CVD+vTYK9qTDLbrx8FhgBYbqGm3iV/wkTfzrNJfjGsMeFRkJRQ==",
       "license": "MIT",
       "dependencies": {
         "iceberg-js": "^0.8.1",
         "tslib": "2.8.1"
       },
       "engines": {
-        "node": ">=20.0.0"
+        "node": ">=22.0.0"
       }
     },
     "node_modules/@supabase/supabase-js": {
-      "version": "2.108.2",
-      "resolved": "https://registry.npmjs.org/@supabase/supabase-js/-/supabase-js-2.108.2.tgz",
-      "integrity": "sha512-hFhnPveb5JQg4a0QYicM0swT253YHMdfeRAl2BKHOlI5VAzuHxUGSr8RbwNLYNPauWOgQMS1H8sz8bvYlgwUfQ==",
+      "version": "2.110.0",
+      "resolved": "https://registry.npmjs.org/@supabase/supabase-js/-/supabase-js-2.110.0.tgz",
+      "integrity": "sha512-8yI84VJiEVW4zxZpLUmxXmjzQ7O2St9X/ymzlBETDHTURPWG3LmvbSiibq+7dqAJmyoUfxZnSfXeM4HCM8s4XQ==",
       "license": "MIT",
       "dependencies": {
-        "@supabase/auth-js": "2.108.2",
-        "@supabase/functions-js": "2.108.2",
-        "@supabase/postgrest-js": "2.108.2",
-        "@supabase/realtime-js": "2.108.2",
-        "@supabase/storage-js": "2.108.2"
+        "@supabase/auth-js": "2.110.0",
+        "@supabase/functions-js": "2.110.0",
+        "@supabase/postgrest-js": "2.110.0",
+        "@supabase/realtime-js": "2.110.0",
+        "@supabase/storage-js": "2.110.0"
       },
       "engines": {
-        "node": ">=20.0.0"
+        "node": ">=22.0.0"
       }
     },
     "node_modules/@swc/helpers": {
@@ -7993,9 +8171,9 @@
       }
     },
     "node_modules/@tailwindcss/node": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.1.tgz",
-      "integrity": "sha512-6NDaqRoAMSXD1mr/RXu0HBvNE9a2n5tHPsxu9XHLws8o4Twes5rBM2205SUUiJ9goAtadrN6xTGX0UDEwp/N4A==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.2.tgz",
+      "integrity": "sha512-yWP/sqEcBLaD8JuA6zNwxoYKr75qxTioYwlRwekj5Jr/I5GXnoJfjetH/psLUIv74cYTH2lBUEzBkinthoYcBg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8005,37 +8183,37 @@
         "lightningcss": "1.32.0",
         "magic-string": "^0.30.21",
         "source-map-js": "^1.2.1",
-        "tailwindcss": "4.3.1"
+        "tailwindcss": "4.3.2"
       }
     },
     "node_modules/@tailwindcss/oxide": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.3.1.tgz",
-      "integrity": "sha512-yVPyo8RNkabVr3O2EhHEE0Rewu7YKzc1DhIqfL46LKveFrmu9XbDazNOJY7/GRuvw1h6u3utWnR29H/p5JPlgA==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.3.2.tgz",
+      "integrity": "sha512-z8ZgnzX8gdNoWLBLqBPoh/sjnxkwvf9ZuWjnO0l0yIzbLa5/9S+eC5QxGZKRobVHIC3/1BoMWjHblqWjcgFgag==",
       "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">= 20"
       },
       "optionalDependencies": {
-        "@tailwindcss/oxide-android-arm64": "4.3.1",
-        "@tailwindcss/oxide-darwin-arm64": "4.3.1",
-        "@tailwindcss/oxide-darwin-x64": "4.3.1",
-        "@tailwindcss/oxide-freebsd-x64": "4.3.1",
-        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.1",
-        "@tailwindcss/oxide-linux-arm64-gnu": "4.3.1",
-        "@tailwindcss/oxide-linux-arm64-musl": "4.3.1",
-        "@tailwindcss/oxide-linux-x64-gnu": "4.3.1",
-        "@tailwindcss/oxide-linux-x64-musl": "4.3.1",
-        "@tailwindcss/oxide-wasm32-wasi": "4.3.1",
-        "@tailwindcss/oxide-win32-arm64-msvc": "4.3.1",
-        "@tailwindcss/oxide-win32-x64-msvc": "4.3.1"
+        "@tailwindcss/oxide-android-arm64": "4.3.2",
+        "@tailwindcss/oxide-darwin-arm64": "4.3.2",
+        "@tailwindcss/oxide-darwin-x64": "4.3.2",
+        "@tailwindcss/oxide-freebsd-x64": "4.3.2",
+        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.2",
+        "@tailwindcss/oxide-linux-arm64-gnu": "4.3.2",
+        "@tailwindcss/oxide-linux-arm64-musl": "4.3.2",
+        "@tailwindcss/oxide-linux-x64-gnu": "4.3.2",
+        "@tailwindcss/oxide-linux-x64-musl": "4.3.2",
+        "@tailwindcss/oxide-wasm32-wasi": "4.3.2",
+        "@tailwindcss/oxide-win32-arm64-msvc": "4.3.2",
+        "@tailwindcss/oxide-win32-x64-msvc": "4.3.2"
       }
     },
     "node_modules/@tailwindcss/oxide-android-arm64": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.3.1.tgz",
-      "integrity": "sha512-SVlyf61g374l5cHyg8x9kf5xmLcOaxvOTsbsqDnSsDJaKOEFZ7GCvi84VAVGpxojYOs1+3K6M0UjXfqPU8vmOQ==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.3.2.tgz",
+      "integrity": "sha512-WHxqIuHpvZ5VtdX6GTl1Ik/Vp2YuN42Et+0CdeaVd/frQ9jAvGmvR8vLT+jk3e8/Q3x8kECB9+R17pgpp2BulA==",
       "cpu": [
         "arm64"
       ],
@@ -8050,9 +8228,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-darwin-arm64": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.3.1.tgz",
-      "integrity": "sha512-hVnWLwv+e/l7c4WKyVtHVrIPvYdqWHjRB3MDIqARynzFtnQg85kmQEFCbV9Ja0VVx4xXTIiDWY60Y7iz/iNoDA==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.3.2.tgz",
+      "integrity": "sha512-GZypeUY/IDJW3877KeM+O67vbXr3MBnbtEL4aYhNErv/JWZhye2vGSWWG9tB6iiqR2MqRNkY8IOUy4NdSZV26w==",
       "cpu": [
         "arm64"
       ],
@@ -8067,9 +8245,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-darwin-x64": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.3.1.tgz",
-      "integrity": "sha512-Cf7abu0WVgbhU7ANgPUnSAvm7nCvMweusHb8FnaHlLfv/Caq4GYaEZg7ZImzzmjx4lIAfuS8q+eLIS7A7IzxIg==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.3.2.tgz",
+      "integrity": "sha512-UIIzmefR6KO1sDU7MzRqAxC8iBpft/VhkGjTjnhoS6k7Z3rQ9wEgA1ODSiyH/tcSYssulNm4Ci3hOeK1jH7ccQ==",
       "cpu": [
         "x64"
       ],
@@ -8084,9 +8262,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-freebsd-x64": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.3.1.tgz",
-      "integrity": "sha512-ZZqzX2Y+GXtXXfqSfpJhDm60OoZfvLHLCgm+J7NVqgHHJjG/m9ugZI77RwTsVd4fnBJuCFP6Ae6kTJb71UdS8g==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.3.2.tgz",
+      "integrity": "sha512-GN+uAmcI6DNspnCDwtOAZrTz6oukJnp337qZvxqCGLd3BHBzJpO0ZbTLRvJNdztOeAmTzewewGIMPb0tk2R4WA==",
       "cpu": [
         "x64"
       ],
@@ -8101,9 +8279,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-arm-gnueabihf": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.3.1.tgz",
-      "integrity": "sha512-/Ah/xik0LaMYfv9DZ0S/t4pBlBNYOcqtRwusjgovHkvT8ixueWCLyJjsaF5kQIckjb4IT8Q6K6p/iPmZMixYgg==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.3.2.tgz",
+      "integrity": "sha512-4ABn7qSbdHRwTiDiuWNegCyb5+2FJ4vKIKc3DmKrvAFw7MU1Lm11dIkTPwUaFdTzc7IsOpDbqBrlh0x6y36U/w==",
       "cpu": [
         "arm"
       ],
@@ -8118,9 +8296,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-arm64-gnu": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.3.1.tgz",
-      "integrity": "sha512-gqdFoVJlw444GvpnheZLHmvTzSxI/cOUUh2KSNejQjTcYkW062SVD+En0rUgD+QV91bz1XGIGtt1HJd48xUGbQ==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.3.2.tgz",
+      "integrity": "sha512-wDgEIGwoM8w8pufh9LVt1PahDgNdKXrLC2qfAnV3vAmococ9RWbxeAw4pxPttd/TsJfwjyLf90Dg1y9y8I6Emw==",
       "cpu": [
         "arm64"
       ],
@@ -8138,9 +8316,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-arm64-musl": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.3.1.tgz",
-      "integrity": "sha512-Bwv9KwOvE0VKa86xPFif9b9c3Y1NxOV1P0gLti/IYaWEsQYZXDlxfGEtA8mdDZ7SG3wyNXAWYT5SIn3giL57oA==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.3.2.tgz",
+      "integrity": "sha512-J5Nuk0uZQIiMTJj3LEx4sAA9tMFUoXQZFv1J6An+QGYe53HKRJuFDi0rpq/tuouCZeAbOBY3kQ6g8qeD4TUjtA==",
       "cpu": [
         "arm64"
       ],
@@ -8158,9 +8336,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-x64-gnu": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.3.1.tgz",
-      "integrity": "sha512-Ymi8O8T15HYQdOUWUtTI6ldN0neHP85FC+Qz32xTcZ7iJXtem/x8ITev0o1e9e5rkqj4lONZfTRLvkmin1+tKg==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.3.2.tgz",
+      "integrity": "sha512-kqCZpSKOBEJO4mz7OqWoofBZeXTAwaVGPj0ErAj7CojmhKpWVWVOnrt9dE8odoIraZq4oj3ausM37kXi+Tow8w==",
       "cpu": [
         "x64"
       ],
@@ -8178,9 +8356,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-x64-musl": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.3.1.tgz",
-      "integrity": "sha512-M+P/91qJ6uILLw4k2G93GMDRAXj61SMvFQYt39AqvUqYgExXpLL5aepfns7sj4HiAQeolirQF9E0lzRvdf4zPQ==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.3.2.tgz",
+      "integrity": "sha512-cixpqbh2toJDmkuCRI68nXA8ZxNmdK9Y+9v5h3MC3ZQKy/0BO8AWzlkWyRM7JAFSGBlfig4YVTPsK6MVgqz1uw==",
       "cpu": [
         "x64"
       ],
@@ -8198,9 +8376,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-wasm32-wasi": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.1.tgz",
-      "integrity": "sha512-zsM8uOeqvVGHsAXsJxsT28ttosFahLJKCLOTUBqRAtKnVgGSRitds9T432QiT8b77Yga7JIBkulIRRlJPtYhRA==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.2.tgz",
+      "integrity": "sha512-4ec2Z/LOmRsAgU23CS4xeJfcJlmRg94A/XrbGRCF1gyU/zdDfRLYDVsS+ynSZCmGNxQ1jQriQOKMQeQxBA3Isw==",
       "bundleDependencies": [
         "@napi-rs/wasm-runtime",
         "@emnapi/core",
@@ -8216,9 +8394,9 @@
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/core": "^1.10.0",
-        "@emnapi/runtime": "^1.10.0",
-        "@emnapi/wasi-threads": "^1.2.1",
+        "@emnapi/core": "^1.11.1",
+        "@emnapi/runtime": "^1.11.1",
+        "@emnapi/wasi-threads": "^1.2.2",
         "@napi-rs/wasm-runtime": "^1.1.4",
         "@tybys/wasm-util": "^0.10.2",
         "tslib": "^2.8.1"
@@ -8228,9 +8406,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.1.tgz",
-      "integrity": "sha512-aiNvSq9BsVk8V513lDKlrCFAgf8qBMPZTpgEhInL+NwQqs97mYmupVMrPrgBBSL8Pv/0zXu9MrMF9rMun1ZeNg==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.2.tgz",
+      "integrity": "sha512-Zyr/M0+XcYZu3bZrUytc7TXvrk0ftWfl8gN2MwekNDzhqhKRUucMPSeOzM0o0wH5AWOU49BsKRrfKxI2atCPMQ==",
       "cpu": [
         "arm64"
       ],
@@ -8245,9 +8423,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-win32-x64-msvc": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.3.1.tgz",
-      "integrity": "sha512-xDEyu1rg290472FEGaKHnzyDyh5QH+AlWvsU5hMoMtPpzmKlRI0jaYKCgSHDYtaQWZOYbMaduSyCwFwY4n1HmA==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.3.2.tgz",
+      "integrity": "sha512-QI9BO7KlNZsp2GuO0jwAAj5jCDABOKXRkCk2XuKTSaNEFSdfzqswYVTtCHBNKHLsqyjFyFkqlDiwkNbTYSssMQ==",
       "cpu": [
         "x64"
       ],
@@ -8262,17 +8440,17 @@
       }
     },
     "node_modules/@tailwindcss/postcss": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/postcss/-/postcss-4.3.1.tgz",
-      "integrity": "sha512-dNJuNbdEJT/SWRuXTYP1WSamelsz3ztkUsdtWQPjrexysrTpaEPM40P/71knXiXLYEojqPOEGitVLLpPMS5T6A==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/postcss/-/postcss-4.3.2.tgz",
+      "integrity": "sha512-rjVWYCa7Ngbi5AarT6k8TkxUG3Wl1QKzHdIZVsjZSzf36Jmo2IKZt/NHRAwly8oDkbBOH0YTu+CHuf9jPxMc+g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@alloc/quick-lru": "^5.2.0",
-        "@tailwindcss/node": "4.3.1",
-        "@tailwindcss/oxide": "4.3.1",
-        "postcss": "8.5.15",
-        "tailwindcss": "4.3.1"
+        "@tailwindcss/node": "4.3.2",
+        "@tailwindcss/oxide": "4.3.2",
+        "postcss": "^8.5.15",
+        "tailwindcss": "4.3.2"
       }
     },
     "node_modules/@testing-library/jest-dom": {
@@ -8324,9 +8502,9 @@
       }
     },
     "node_modules/@tybys/wasm-util": {
-      "version": "0.10.2",
-      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.2.tgz",
-      "integrity": "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==",
+      "version": "0.10.3",
+      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz",
+      "integrity": "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -8543,9 +8721,9 @@
       "license": "MIT"
     },
     "node_modules/@types/d3-random": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@types/d3-random/-/d3-random-3.0.3.tgz",
-      "integrity": "sha512-Imagg1vJ3y76Y2ea0871wpabqp613+8/r0mCLEBfdtqC7xMSfj9idOnmBYyMoULfHePJyxMAw3nWhJxzc+LFwQ==",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@types/d3-random/-/d3-random-3.0.4.tgz",
+      "integrity": "sha512-UHYId5WTCx4L4YNel7NU00XUXXgvgpgZOvp10PuvsQENjMDXhh2RyFc0KBjO7B45ne4Ha1yVH7ii0vnzKkuzWA==",
       "license": "MIT"
     },
     "node_modules/@types/d3-scale": {
@@ -8848,9 +9026,9 @@
       }
     },
     "node_modules/@ungap/structured-clone": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.1.tgz",
-      "integrity": "sha512-mUFwbeTqrVgDQxFveS+df2yfap6iuP20NAKAsBt5jDEoOTDew+zwLAOilHCeQJOVSvmgCX4ogqIrA0mnyr08yQ==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.2.tgz",
+      "integrity": "sha512-5jsZFwgR5rTdKwidH9Qmat75RKwqfpKlWWB1frDkljN127mwqBu8K0PYo7/hFpF03IEJpfVPpCQDY/eDx3iHvA==",
       "license": "ISC"
     },
     "node_modules/@upsetjs/venn.js": {
@@ -8917,16 +9095,6 @@
         }
       }
     },
-    "node_modules/@vitest/mocker/node_modules/estree-walker": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
-      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@types/estree": "^1.0.0"
-      }
-    },
     "node_modules/@vitest/pretty-format": {
       "version": "4.1.9",
       "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.9.tgz",
@@ -9041,54 +9209,47 @@
       "license": "BSD-2-Clause"
     },
     "node_modules/@zapier/policy-context": {
-      "version": "0.7.0",
-      "resolved": "https://registry.npmjs.org/@zapier/policy-context/-/policy-context-0.7.0.tgz",
-      "integrity": "sha512-i17gpbfsUKBctQ+Lzdm0BlvI8mGnvMXAX2YSoaNTXe86nuXpCPDle3AmGF1JYMQEyF9N1TIOoiOec2WNVIuXUw==",
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@zapier/policy-context/-/policy-context-1.2.2.tgz",
+      "integrity": "sha512-xAkKjzUbtX6eKnl9eHP02970XB7mC5stfLdy27LbvpTPwsHfx6r8tEO9dPYhpO/MTAH6afGwnoekSqiQxqP//w==",
       "dependencies": {
-        "@zapier/policy-schema": "0.8.0",
+        "@zapier/policy-schema": "0.15.0"
+      },
+      "peerDependencies": {
         "zod": "^4.0.0"
       }
     },
-    "node_modules/@zapier/policy-context/node_modules/@zapier/policy-schema": {
-      "version": "0.8.0",
-      "resolved": "https://registry.npmjs.org/@zapier/policy-schema/-/policy-schema-0.8.0.tgz",
-      "integrity": "sha512-41qB7QtkpZVWW+EMvRBDuONNzQxua87MbIzAx/h9Cy2SK0CazdGFCTeGIA7Av5f+VkDcWC6iQ8iKPH0mwBvcGw==",
-      "dependencies": {
-        "zod": "4.3.6"
-      }
-    },
     "node_modules/@zapier/policy-schema": {
-      "version": "0.11.0",
-      "resolved": "https://registry.npmjs.org/@zapier/policy-schema/-/policy-schema-0.11.0.tgz",
-      "integrity": "sha512-bSOMmO3zGc2V3jg5IwqQPF7I5kZMboeBPMJ72OvvwyqmeN4CmhYT+7uTQtVxPuifnOQYjTiKL0koqPur4dx9Yg==",
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/@zapier/policy-schema/-/policy-schema-0.15.0.tgz",
+      "integrity": "sha512-qwvsxy+ThVTGJJjzH0Hy/D7IdPleHHqYGKdTTMJovAGHO8rnaanbSKuBRp8o+l7rBImwNPR0sPzPx7vzJ5lu8w==",
       "peerDependencies": {
         "zod": "^4.0.0"
       }
     },
     "node_modules/@zapier/zapier-sdk": {
-      "version": "0.69.3",
-      "resolved": "https://registry.npmjs.org/@zapier/zapier-sdk/-/zapier-sdk-0.69.3.tgz",
-      "integrity": "sha512-Vc818xC/UVibMk31f3NQsAHo/j2HjLKQX2smz0ZJyCWHh7p/MFJFeUuWqKAlq1kmNSaJqObMttZLWk07PVVcPg==",
-      "dev": true,
+      "version": "0.81.0",
+      "resolved": "https://registry.npmjs.org/@zapier/zapier-sdk/-/zapier-sdk-0.81.0.tgz",
+      "integrity": "sha512-ngdN3zevitIQJq/BzvJ5PZPzHX3ogtvtikuz9gDYRAwURe3bAagTyYUIbajAMvglb7pNO0pl9QtUGbkv1RDjAw==",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
-        "@zapier/policy-context": "0.7.0",
-        "@zapier/policy-schema": "0.11.0",
+        "@zapier/policy-context": "1.2.2",
+        "@zapier/policy-schema": "0.15.0",
         "@zapier/zapier-sdk-core": "0.12.0",
         "zod": "4.3.6"
       }
     },
     "node_modules/@zapier/zapier-sdk-cli": {
-      "version": "0.54.3",
-      "resolved": "https://registry.npmjs.org/@zapier/zapier-sdk-cli/-/zapier-sdk-cli-0.54.3.tgz",
-      "integrity": "sha512-l094mIRFlSaWOUooOWVwTi9KngD2Bi2nnBj4q7JjTolBJKHIURnhzjsfbMWeXCL29wQsMGbJF4Z9kRpMQ6OaUQ==",
+      "version": "0.62.0",
+      "resolved": "https://registry.npmjs.org/@zapier/zapier-sdk-cli/-/zapier-sdk-cli-0.62.0.tgz",
+      "integrity": "sha512-uN1wVWv47wiwG2wI1UdGVzMCUlD35A28lQRRUH1D/LdixVrr2gL9lMAL/aNNnGmWRGacHgWpR/fXCXw7InVWng==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@inquirer/search": "^3.2.2",
-        "@zapier/policy-schema": "0.11.0",
-        "@zapier/zapier-sdk": "0.69.3",
-        "@zapier/zapier-sdk-mcp": "0.13.27",
+        "@zapier/policy-schema": "0.15.0",
+        "@zapier/zapier-sdk": "0.81.0",
+        "@zapier/zapier-sdk-mcp": "0.17.0",
         "chalk": "^5.3.0",
         "cli-table3": "^0.6.5",
         "commander": "^12.0.0",
@@ -9097,6 +9258,7 @@
         "esbuild": "^0.25.5",
         "express": "^5.1.0",
         "handlebars": "^4.7.8",
+        "ink": "7.0.5",
         "inquirer": "^12.6.3",
         "is-installed-globally": "^1.0.0",
         "jsonwebtoken": "^9.0.2",
@@ -9105,6 +9267,7 @@
         "package-json": "^10.0.1",
         "pkce-challenge": "^5.0.0",
         "proper-lockfile": "^4.1.2",
+        "react": "19.2.6",
         "semver": "^7.7.3",
         "typescript": "^5.8.3",
         "wrap-ansi": "^10.0.0",
@@ -9126,14 +9289,14 @@
       }
     },
     "node_modules/@zapier/zapier-sdk-mcp": {
-      "version": "0.13.27",
-      "resolved": "https://registry.npmjs.org/@zapier/zapier-sdk-mcp/-/zapier-sdk-mcp-0.13.27.tgz",
-      "integrity": "sha512-zao7JkBLoMxLTePHz9A+HDETVhfHXxVMOHrtlxmq06aRG6Y/MvoEUjluVlHpfF3BNyjBN6KkQQ43EfxNDxFZWg==",
+      "version": "0.17.0",
+      "resolved": "https://registry.npmjs.org/@zapier/zapier-sdk-mcp/-/zapier-sdk-mcp-0.17.0.tgz",
+      "integrity": "sha512-fQIo61FYO/Wp0XEjXmdyzZWt4irVPTBd3NH3rTo//ouiq+31vWRiMWGoKiaczjzqQreaE3qBgheOfMYQYDvmtA==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.17.3",
-        "@zapier/zapier-sdk": "0.69.3",
+        "@zapier/zapier-sdk": "0.81.0",
         "zod": "4.3.6"
       }
     },
@@ -9190,6 +9353,15 @@
         "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0"
       }
     },
+    "node_modules/adm-zip": {
+      "version": "0.5.18",
+      "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.5.18.tgz",
+      "integrity": "sha512-ufJnssQGbxzLNS1Ho9bCtX4rQKCCvoVuDLHoJyc3F9dOGDB4BkWs2Ci0kv53lqocAEQ/Cbi+I2XCsNYGqVYqng==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.0"
+      }
+    },
     "node_modules/agent-base": {
       "version": "6.0.2",
       "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
@@ -9215,14 +9387,14 @@
       }
     },
     "node_modules/ai": {
-      "version": "6.0.208",
-      "resolved": "https://registry.npmjs.org/ai/-/ai-6.0.208.tgz",
-      "integrity": "sha512-STz+AaZqJ4ZjH7UkpXkbHx+bjgIDOsE8fIUoZjkZ2whoZcfVmG9K/TqEKouJZ03SuZuD7lagntlU3zBhAEkRpQ==",
+      "version": "6.0.219",
+      "resolved": "https://registry.npmjs.org/ai/-/ai-6.0.219.tgz",
+      "integrity": "sha512-rtTDz99Rc9HsstSJ7YdO8DX7DQwS442N2vQ5jOopXDdo4qfkLrtIRpORdztFMOZxX/XjBzHRlvqF6eMg3cpyLA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@ai-sdk/gateway": "3.0.133",
-        "@ai-sdk/provider": "3.0.10",
-        "@ai-sdk/provider-utils": "4.0.30",
+        "@ai-sdk/gateway": "3.0.143",
+        "@ai-sdk/provider": "3.0.13",
+        "@ai-sdk/provider-utils": "4.0.35",
         "@opentelemetry/api": "^1.9.0"
       },
       "engines": {
@@ -9265,6 +9437,12 @@
         }
       }
     },
+    "node_modules/anser": {
+      "version": "2.3.5",
+      "resolved": "https://registry.npmjs.org/anser/-/anser-2.3.5.tgz",
+      "integrity": "sha512-vcZjxvvVoxTeR5XBNJB38oTu/7eDCZlwdz32N1eNgpyPF7j/Z7Idf+CUwQOkKKpJ7RJyjxgLHCM7vdIK0iCNMQ==",
+      "license": "MIT"
+    },
     "node_modules/ansi-align": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/ansi-align/-/ansi-align-3.0.1.tgz",
@@ -9275,6 +9453,22 @@
         "string-width": "^4.1.0"
       }
     },
+    "node_modules/ansi-escapes": {
+      "version": "7.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-7.3.0.tgz",
+      "integrity": "sha512-BvU8nYgGQBxcmMuEeUEmNTvrMVjJNSH7RgW24vXexN4Ven6qCvy4TntnvlnwnMLTVlcRQQdbRY8NKnaIoeWDNg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "environment": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/ansi-regex": {
       "version": "6.2.2",
       "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
@@ -9299,6 +9493,21 @@
         "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
+    "node_modules/ansi-to-react": {
+      "version": "6.2.6",
+      "resolved": "https://registry.npmjs.org/ansi-to-react/-/ansi-to-react-6.2.6.tgz",
+      "integrity": "sha512-Eqi0iaMK5OZ3jsVFxWvU2B74UZBnGuHlkflKMX6wTOeH+luy9KE2O0gUkc2PxhIP1R4IO0xohv62UMFInQOSeg==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "anser": "^2.3.2",
+        "escape-carriage": "^1.3.1",
+        "linkify-it": "^3.0.3"
+      },
+      "peerDependencies": {
+        "react": "^16.3.2 || ^17.0.0 || ^18.0.0 || ^19.0.0",
+        "react-dom": "^16.3.2 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+      }
+    },
     "node_modules/arch": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/arch/-/arch-2.2.0.tgz",
@@ -9461,10 +9670,23 @@
         "when-exit": "^2.1.4"
       }
     },
+    "node_modules/auto-bind": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/auto-bind/-/auto-bind-5.0.1.tgz",
+      "integrity": "sha512-ooviqdwwgfIfNmDwo94wlshcdzfO64XV0Cg6oDsDYBJfITDz1EngD2z7DkbvCWn+XIMsIqW27sEVF6qcpJrRcg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/autoprefixer": {
-      "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.5.0.tgz",
-      "integrity": "sha512-FMhOoZV4+qR6aTUALKX2rEqGG+oyATvwBt9IIzVR5rMa2HRWPkxf+P+PAJLD1I/H5/II+HuZcBJYEFBpq39ong==",
+      "version": "10.5.2",
+      "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.5.2.tgz",
+      "integrity": "sha512-rD5t5DwOjJdmSORcTq64j8MawTC+tbQ+HHqjR4NDumamy/ambn1UJrlKL+KdwujWxMkFjPM3pPHOEA9tl4767Q==",
       "dev": true,
       "funding": [
         {
@@ -9482,8 +9704,8 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "browserslist": "^4.28.2",
-        "caniuse-lite": "^1.0.30001787",
+        "browserslist": "^4.28.4",
+        "caniuse-lite": "^1.0.30001799",
         "fraction.js": "^5.3.4",
         "picocolors": "^1.1.1",
         "postcss-value-parser": "^4.2.0"
@@ -9499,9 +9721,9 @@
       }
     },
     "node_modules/axios": {
-      "version": "1.18.0",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.18.0.tgz",
-      "integrity": "sha512-E32NzpYKp++W7XRe52rHiXV2ehxmh3wbdgO7MHeFM+vqxLBYHzt0ElkiImtOBxtOmyp0yoC8C6uESVV84Y2/hw==",
+      "version": "1.18.1",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.18.1.tgz",
+      "integrity": "sha512-3nTvFlvpn9Zu/RkHUqtc7/+al4UpRW5az71ap5zccp6e8RAYEzhMTecX8Dz1wWDYrPpUoB1HAQEGEAEvUr7S9g==",
       "license": "MIT",
       "dependencies": {
         "follow-redirects": "^1.16.0",
@@ -9557,9 +9779,9 @@
       }
     },
     "node_modules/bare-fs": {
-      "version": "4.7.2",
-      "resolved": "https://registry.npmjs.org/bare-fs/-/bare-fs-4.7.2.tgz",
-      "integrity": "sha512-aTvMFUWkBmjzKtEQMDGGDNF8bkfpD5N1b/FCwt7A3wrU4t1o/e/85Wzkluh6JlODCjqVESYCkQCdTXqZ9G7VFg==",
+      "version": "4.7.3",
+      "resolved": "https://registry.npmjs.org/bare-fs/-/bare-fs-4.7.3.tgz",
+      "integrity": "sha512-xRgplks8SvcKkdlv2M6Z2LZmRsmqd+x0nXXGXeMEjwdibj1HSDrlnqBRLeYdMvsgCox7Bq0e+DHwfczOfsn6IA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -9582,9 +9804,9 @@
       }
     },
     "node_modules/bare-os": {
-      "version": "3.9.1",
-      "resolved": "https://registry.npmjs.org/bare-os/-/bare-os-3.9.1.tgz",
-      "integrity": "sha512-6M5XjcnsygQNPMCMPXSK379xrJFiZ/AEMNBmFEmQW8d/789VQATvriyi5r0HYTL9TkQ26rn3kgdTG3aisbrXkQ==",
+      "version": "3.9.3",
+      "resolved": "https://registry.npmjs.org/bare-os/-/bare-os-3.9.3.tgz",
+      "integrity": "sha512-fF4Q7QsyKVF5Rj0qvI8BgUNjqzC2JvQlpTaPLjVJVxYVUX5Zr9un+y3w1HmA4nNKdFmRBT8z/WmrjvXzXVerKQ==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -9660,9 +9882,9 @@
       "license": "MIT"
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.10.38",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.38.tgz",
-      "integrity": "sha512-31/02mVB4yuQU6adKk5SlY6m+mxDwUq5KZkyYgnLrrKl7TEm1+3PyDtDBz2kOv/wxZz41GHsvV1A/u6RmiyBvw==",
+      "version": "2.10.42",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.42.tgz",
+      "integrity": "sha512-c/jurFrDLyui7o1J86yLkRu4LMsTYcBohveus7/I2Hzdn9KIP2bdJPTue/lR1KH46enoPbD77GKeSYNdyPoD3Q==",
       "license": "Apache-2.0",
       "bin": {
         "baseline-browser-mapping": "dist/cli.cjs"
@@ -9855,6 +10077,19 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/boxen/node_modules/cli-boxes": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/cli-boxes/-/cli-boxes-3.0.0.tgz",
+      "integrity": "sha512-/lzGpEWL/8PfI0BmBOPRwp0c/wFNX1RdUML3jK/RcSBA9T8mZDdQpqYBKtCFTOfQbwPqWEOpjqW+Fnayc0969g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/boxen/node_modules/emoji-regex": {
       "version": "9.2.2",
       "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
@@ -9893,6 +10128,22 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/boxen/node_modules/widest-line": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/widest-line/-/widest-line-4.0.1.tgz",
+      "integrity": "sha512-o0cyEG0e8GPzT4iGHphIOh0cJOV8fivsXxddQasHPHfoZf1ZexrfeA21w2NaEN1RHE+fXlfISmOE8R9N3u3Qig==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "string-width": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/boxen/node_modules/wrap-ansi": {
       "version": "8.1.0",
       "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-8.1.0.tgz",
@@ -9946,9 +10197,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.28.2",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.2.tgz",
-      "integrity": "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==",
+      "version": "4.28.4",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.4.tgz",
+      "integrity": "sha512-MTc8i/x9jBQd1iMw2CFGS+rwMa07eYjLR0CCTLDACl9xhxy+nIs3KeML/biicXtk9JrZ6dnnTatmc7ErPXIxqw==",
       "devOptional": true,
       "funding": [
         {
@@ -9966,10 +10217,10 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "baseline-browser-mapping": "^2.10.12",
-        "caniuse-lite": "^1.0.30001782",
-        "electron-to-chromium": "^1.5.328",
-        "node-releases": "^2.0.36",
+        "baseline-browser-mapping": "^2.10.38",
+        "caniuse-lite": "^1.0.30001799",
+        "electron-to-chromium": "^1.5.376",
+        "node-releases": "^2.0.48",
         "update-browserslist-db": "^1.2.3"
       },
       "bin": {
@@ -10114,9 +10365,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001799",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001799.tgz",
-      "integrity": "sha512-hG1bReV+OUU+MOqK4t/ZWI0tZOyz3rqS9XuhOUz1cIcbwBKjOyJEJuw9ER5JuNyqxNk8u/JUVbGibBOL1yrjFw==",
+      "version": "1.0.30001800",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001800.tgz",
+      "integrity": "sha512-MMHtuAz9Ys840zAY5F4k6fV5GaivZ9sPk+nz0mY+GYVzRBnYkN0mpqkSR92oWRQ19yQWo4HvBV/FnC16AJX8MA==",
       "funding": [
         {
           "type": "opencollective",
@@ -10256,16 +10507,16 @@
       }
     },
     "node_modules/chardet": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/chardet/-/chardet-2.1.1.tgz",
-      "integrity": "sha512-PsezH1rqdV9VvyNhxxOW32/d75r01NY7TQCmOqomRo15ZSOKbpTFVsfjghxo6JloQUCGnH4k1LGu0R4yCLlWQQ==",
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/chardet/-/chardet-2.2.0.tgz",
+      "integrity": "sha512-rddelWYNPRrXq6PtNEN2S3f6t9ILzvqaN5pVgi4kqt9jHQaXIial9PznB5iSPVlQSLNaaH22ItWz3EJtQ10+OA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/chat": {
-      "version": "4.31.0",
-      "resolved": "https://registry.npmjs.org/chat/-/chat-4.31.0.tgz",
-      "integrity": "sha512-F6oJq9JUraLFkITS96/NKgwZwBfZX8aOwOj5qMs5NNwnOGHrSXZ5+osK+EA4HjzfyUEDfFTNiOSmyzgtFLpuWg==",
+      "version": "4.32.0",
+      "resolved": "https://registry.npmjs.org/chat/-/chat-4.32.0.tgz",
+      "integrity": "sha512-0NlJcCLycTy8kytRsZEnW4Gzomm+SNh1Yg7y9GVYB5fTjyhOxCcnzqrythgXNn2dvv7VeihDIISpNU0WZdOKKg==",
       "license": "MIT",
       "dependencies": {
         "@workflow/serde": "4.1.0-beta.2",
@@ -10322,11 +10573,13 @@
       }
     },
     "node_modules/chownr": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
-      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
-      "license": "ISC",
-      "optional": true
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
+      "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=18"
+      }
     },
     "node_modules/ci-info": {
       "version": "3.9.0",
@@ -10363,34 +10616,47 @@
       "license": "MIT"
     },
     "node_modules/cli-boxes": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/cli-boxes/-/cli-boxes-3.0.0.tgz",
-      "integrity": "sha512-/lzGpEWL/8PfI0BmBOPRwp0c/wFNX1RdUML3jK/RcSBA9T8mZDdQpqYBKtCFTOfQbwPqWEOpjqW+Fnayc0969g==",
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/cli-boxes/-/cli-boxes-4.0.1.tgz",
+      "integrity": "sha512-5IOn+jcCEHEraYolBPs/sT4BxYCe2nHg374OPiItB1O96KZFseS2gthU4twyYzeDcFew4DaUM/xwc5BQf08JJw==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=10"
+        "node": ">=18.20 <19 || >=20.10"
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
     "node_modules/cli-cursor": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/cli-cursor/-/cli-cursor-5.0.0.tgz",
-      "integrity": "sha512-aCj4O5wKyszjMmDT4tZj93kxyydN/K5zPWSCe6/0AV/AA1pqe5ZBIw0a2ZfPQV7lL5/yb5HsUreJ6UFAF1tEQw==",
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/cli-cursor/-/cli-cursor-4.0.0.tgz",
+      "integrity": "sha512-VGtlMu3x/4DOtIUwEkRezxUZ2lBacNJCHash0N0WeZDBS+7Ux1dm3XWAgWYxLJFMMdOeXMHXorshEFhbMSGelg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "restore-cursor": "^5.0.0"
+        "restore-cursor": "^4.0.0"
       },
       "engines": {
-        "node": ">=18"
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/cli-progress": {
+      "version": "3.12.0",
+      "resolved": "https://registry.npmjs.org/cli-progress/-/cli-progress-3.12.0.tgz",
+      "integrity": "sha512-tRkV3HJ1ASwm19THiiLIXLO7Im7wlTuKnvkYaTkyoAPefqjNg7W7DHKUlGRxy9vxDvbyCYQkQozvptuMkGCg8A==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "string-width": "^4.2.3"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
     "node_modules/cli-spinners": {
       "version": "2.9.2",
       "resolved": "https://registry.npmjs.org/cli-spinners/-/cli-spinners-2.9.2.tgz",
@@ -10398,26 +10664,60 @@
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=6"
+        "node": ">=6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/cli-table3": {
+      "version": "0.6.5",
+      "resolved": "https://registry.npmjs.org/cli-table3/-/cli-table3-0.6.5.tgz",
+      "integrity": "sha512-+W/5efTR7y5HRD7gACw9yQjqMVvEMLBHmboM/kPWam+H+Hmyrgjh6YncVKK122YZkXrLudzTuAukUw9FnMf7IQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "string-width": "^4.2.0"
+      },
+      "engines": {
+        "node": "10.* || >= 12.*"
+      },
+      "optionalDependencies": {
+        "@colors/colors": "1.5.0"
+      }
+    },
+    "node_modules/cli-truncate": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/cli-truncate/-/cli-truncate-6.1.0.tgz",
+      "integrity": "sha512-ofWtXdvPO1WepoE9Gn4dPdZw+ADud1Yz9K+xm9FjK5vvrs/D60vrlKIQeSw1wJX4cphW2bnWi8GZSKvf9T6shw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "slice-ansi": "^9.0.0",
+        "string-width": "^8.2.0"
+      },
+      "engines": {
+        "node": ">=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/cli-table3": {
-      "version": "0.6.5",
-      "resolved": "https://registry.npmjs.org/cli-table3/-/cli-table3-0.6.5.tgz",
-      "integrity": "sha512-+W/5efTR7y5HRD7gACw9yQjqMVvEMLBHmboM/kPWam+H+Hmyrgjh6YncVKK122YZkXrLudzTuAukUw9FnMf7IQ==",
+    "node_modules/cli-truncate/node_modules/string-width": {
+      "version": "8.2.1",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-8.2.1.tgz",
+      "integrity": "sha512-IIaP0g3iy9Cyy18w3M9YcaDudujEAVHKt3a3QJg1+sr/oX96TbaGUubG0hJyCjCBThFH+tFpcIyoUHUn1ogaLA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "string-width": "^4.2.0"
+        "get-east-asian-width": "^1.5.0",
+        "strip-ansi": "^7.1.2"
       },
       "engines": {
-        "node": "10.* || >= 12.*"
+        "node": ">=20"
       },
-      "optionalDependencies": {
-        "@colors/colors": "1.5.0"
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
     "node_modules/cli-width": {
@@ -10501,33 +10801,46 @@
         "node": ">=10.17.0"
       }
     },
-    "node_modules/clipboardy/node_modules/npm-run-path": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz",
-      "integrity": "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==",
+    "node_modules/clipboardy/node_modules/is-docker": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-2.2.1.tgz",
+      "integrity": "sha512-F+i2BKsFrH66iaUFc0woD8sLy8getkwTwtOBjvs56Cx4CgJDeKQeqfz8wAYiSb8JOprWhHH5p77PbmYCvvUuXQ==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "path-key": "^3.0.0"
+      "bin": {
+        "is-docker": "cli.js"
       },
       "engines": {
         "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/clipboardy/node_modules/onetime": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz",
-      "integrity": "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==",
+    "node_modules/clipboardy/node_modules/is-wsl": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-2.2.0.tgz",
+      "integrity": "sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "mimic-fn": "^2.1.0"
+        "is-docker": "^2.0.0"
       },
       "engines": {
-        "node": ">=6"
+        "node": ">=8"
+      }
+    },
+    "node_modules/clipboardy/node_modules/npm-run-path": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz",
+      "integrity": "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "path-key": "^3.0.0"
       },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+      "engines": {
+        "node": ">=8"
       }
     },
     "node_modules/clipboardy/node_modules/signal-exit": {
@@ -10605,6 +10918,28 @@
         "react-dom": "^18 || ^19 || ^19.0.0-rc"
       }
     },
+    "node_modules/cnfast": {
+      "version": "0.0.8",
+      "resolved": "https://registry.npmjs.org/cnfast/-/cnfast-0.0.8.tgz",
+      "integrity": "sha512-EjXKMfGfdwtV4AcNSQ6AwQaVzpC1B7IxeiwA3FlhTXz+YFlMKVi4c1JX9tgD2QOlahQXjB8KUXrBaYG+3v871Q==",
+      "license": "MIT",
+      "bin": {
+        "cnfast": "bin/cli.js"
+      }
+    },
+    "node_modules/code-excerpt": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/code-excerpt/-/code-excerpt-4.0.0.tgz",
+      "integrity": "sha512-xxodCmBen3iy2i0WtAK8FlFNrRzjUqjRsMfho58xT/wvZU1YTM3fCnRjcy1gJPMepaRlgm/0e6w8SpWHpn3/cA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "convert-to-spaces": "^2.0.1"
+      },
+      "engines": {
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+      }
+    },
     "node_modules/codemirror": {
       "version": "6.0.2",
       "resolved": "https://registry.npmjs.org/codemirror/-/codemirror-6.0.2.tgz",
@@ -10893,17 +11228,23 @@
       "devOptional": true,
       "license": "MIT"
     },
+    "node_modules/convert-to-spaces": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/convert-to-spaces/-/convert-to-spaces-2.0.1.tgz",
+      "integrity": "sha512-rcQ1bsQO9799wq24uE5AM2tAILy4gXGIK/njFWcVQkGNZ96edlpY+A7bjwvzjYvLDyzmG1MmMLZhpcsb+klNMQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+      }
+    },
     "node_modules/cookie": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-1.1.1.tgz",
-      "integrity": "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==",
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
+      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
       "license": "MIT",
       "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
+        "node": ">= 0.6"
       }
     },
     "node_modules/cookie-signature": {
@@ -10983,9 +11324,9 @@
       }
     },
     "node_modules/crelt": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/crelt/-/crelt-1.0.6.tgz",
-      "integrity": "sha512-VQ2MBenTq1fWZUH9DJNGti7kKv6EeAuYr3cLwxUWhIu1baTaXh4Ib5W2CqHVqib4/MqbYGJqiL3Zb8GJZr3l4g==",
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/crelt/-/crelt-1.0.7.tgz",
+      "integrity": "sha512-aK6BbWfhf4U/wCcLHKPJl/xa6VkVstRaPywWtMKGwuOLc/wZTyQYuoxgvZnNsBvv7Kg3YTBQYYBCggcviQczuA==",
       "license": "MIT"
     },
     "node_modules/croner": {
@@ -11784,7 +12125,6 @@
       "version": "1.1.4",
       "resolved": "https://registry.npmjs.org/define-data-property/-/define-data-property-1.1.4.tgz",
       "integrity": "sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "es-define-property": "^1.0.0",
@@ -11811,6 +12151,23 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/define-properties": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/define-properties/-/define-properties-1.2.1.tgz",
+      "integrity": "sha512-8QmQKqEASLd5nx0U1B1okLElbUuuttJ/AnYmRXbbbGDWh6uS208EjD4Xqq/I9wK7u0v6O08XhTWnt5XtEbR6Dg==",
+      "license": "MIT",
+      "dependencies": {
+        "define-data-property": "^1.0.1",
+        "has-property-descriptors": "^1.0.0",
+        "object-keys": "^1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/delaunator": {
       "version": "5.1.0",
       "resolved": "https://registry.npmjs.org/delaunator/-/delaunator-5.1.0.tgz",
@@ -11952,6 +12309,15 @@
         "scripts/actions/documentation"
       ]
     },
+    "node_modules/discord.js/node_modules/undici": {
+      "version": "6.24.1",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.24.1.tgz",
+      "integrity": "sha512-sC+b0tB1whOCzbtlx20fx3WgCXwkW627p4EA9uM+/tNNPkSS+eSEld6pAs9nDv7WbY1UUljBMYPtu9BCOrCWKA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.17"
+      }
+    },
     "node_modules/dom-accessibility-api": {
       "version": "0.6.3",
       "resolved": "https://registry.npmjs.org/dom-accessibility-api/-/dom-accessibility-api-0.6.3.tgz",
@@ -12057,9 +12423,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.375",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.375.tgz",
-      "integrity": "sha512-ZWP5eB4BVPW/ZYo9252hQZHZ5XavtsTgpbhcmMmRwymavC5AsLWQWBPaKMeNd2LW0KGby5HPXvj7+sr4ta5j/Q==",
+      "version": "1.5.387",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.387.tgz",
+      "integrity": "sha512-TaxwufTFDufvPEoXdhwVrA3UdFWBeWGkYoJ1K8ldF1xe6gKfth6iRNS5lTQ5JPNOHdGQm8PT1QYKUqFLCiUefQ==",
       "devOptional": true,
       "license": "ISC"
     },
@@ -12187,6 +12553,19 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/environment": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/environment/-/environment-1.1.0.tgz",
+      "integrity": "sha512-xUtoPkMggbz0MPyPiIWr1Kp4aeWJjDZ6SMvURhimjdZgsRuDplF5/s9hcgGhyXMhs+6vpnuoiZ2kFiu3FMnS8Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/es-define-property": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
@@ -12206,10 +12585,10 @@
       }
     },
     "node_modules/es-module-lexer": {
-      "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.7.0.tgz",
-      "integrity": "sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==",
-      "devOptional": true,
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.0.tgz",
+      "integrity": "sha512-KLdwQm2NvGLDkQDCGvmiQrhkd0JbMzXthwQAUgWjQuQdBLFa3eiBP5arXZyA+f8x+x7OXgud6bq2rxjGtHV2tw==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/es-object-atoms": {
@@ -12240,9 +12619,9 @@
       }
     },
     "node_modules/es-toolkit": {
-      "version": "1.47.1",
-      "resolved": "https://registry.npmjs.org/es-toolkit/-/es-toolkit-1.47.1.tgz",
-      "integrity": "sha512-5RAqEwf4P4E17p+W75KLOWw/nOvKZzSQpxM32IpI2KZLaVonjTrZ0Ai5ghMaVI9eKC2p8eoQgcBdkEDgzFk6+Q==",
+      "version": "1.49.0",
+      "resolved": "https://registry.npmjs.org/es-toolkit/-/es-toolkit-1.49.0.tgz",
+      "integrity": "sha512-G5iZ6Pc/FNRY/soKZHC+TxGDD83rHUDXxzaWhGCX44vAv/tMs56WMusnm/KMNK+luUPsgA9U28cGr4RDlSzL2g==",
       "license": "MIT",
       "workspaces": [
         "docs",
@@ -12332,6 +12711,12 @@
         "node": ">=6"
       }
     },
+    "node_modules/escape-carriage": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/escape-carriage/-/escape-carriage-1.3.1.tgz",
+      "integrity": "sha512-GwBr6yViW3ttx1kb7/Oh+gKQ1/TrhYwxKqVmg5gS+BK+Qe2KrOa/Vh7w3HPBvgGf0LfcDGoY9I6NHKoA5Hozhw==",
+      "license": "MIT"
+    },
     "node_modules/escape-html": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
@@ -12392,15 +12777,6 @@
         "url": "https://opencollective.com/unified"
       }
     },
-    "node_modules/estree-util-build-jsx/node_modules/estree-walker": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
-      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/estree": "^1.0.0"
-      }
-    },
     "node_modules/estree-util-is-identifier-name": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/estree-util-is-identifier-name/-/estree-util-is-identifier-name-3.0.0.tgz",
@@ -12440,6 +12816,15 @@
         "url": "https://opencollective.com/unified"
       }
     },
+    "node_modules/estree-util-to-js/node_modules/source-map": {
+      "version": "0.7.6",
+      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.7.6.tgz",
+      "integrity": "sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ==",
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">= 12"
+      }
+    },
     "node_modules/estree-util-value-to-estree": {
       "version": "3.5.0",
       "resolved": "https://registry.npmjs.org/estree-util-value-to-estree/-/estree-util-value-to-estree-3.5.0.tgz",
@@ -12467,11 +12852,13 @@
       }
     },
     "node_modules/estree-walker": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-2.0.2.tgz",
-      "integrity": "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w==",
-      "devOptional": true,
-      "license": "MIT"
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
+      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.0"
+      }
     },
     "node_modules/etag": {
       "version": "1.8.1",
@@ -12587,9 +12974,9 @@
       }
     },
     "node_modules/expect-type": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.3.0.tgz",
-      "integrity": "sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA==",
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.4.0.tgz",
+      "integrity": "sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -12657,19 +13044,10 @@
         "express": ">= 4.11"
       }
     },
-    "node_modules/express/node_modules/cookie": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
-      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
     "node_modules/exsolve": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/exsolve/-/exsolve-1.0.8.tgz",
-      "integrity": "sha512-LmDxfWXwcTArk8fUEnOfSZpHOJ6zOMUJKOtFLFqJLoKJetuQG874Uc7/Kki7zFLzYybmZhp1M7+98pfMqeX8yA==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/exsolve/-/exsolve-1.1.0.tgz",
+      "integrity": "sha512-D+42+T12DdIlJM3uepa55qGiL3sYdLBOxIl2ifQCzCHz4c7eiolaHsi3BIqEr7JxBzxv2pYZQX9kw16ziMcEmw==",
       "devOptional": true,
       "license": "MIT"
     },
@@ -12751,9 +13129,9 @@
       }
     },
     "node_modules/fast-uri": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
-      "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.3.tgz",
+      "integrity": "sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==",
       "funding": [
         {
           "type": "github",
@@ -13072,12 +13450,12 @@
       }
     },
     "node_modules/framer-motion": {
-      "version": "12.40.0",
-      "resolved": "https://registry.npmjs.org/framer-motion/-/framer-motion-12.40.0.tgz",
-      "integrity": "sha512-uaBd3qC1v3KQqBEjwTUd183K6PbS+j0yR9w9VmEOLWA/tnUcSn8Xa3uck7t4dgpDoUss8xQTcj8W2L07lrnLFg==",
+      "version": "12.42.2",
+      "resolved": "https://registry.npmjs.org/framer-motion/-/framer-motion-12.42.2.tgz",
+      "integrity": "sha512-5XY9luDiu0oHfHBjpDthFMh0ES+122w6p/papSJBweMkO8Sn+PW2QaEgRblQBpWFnuvZS5qvarpt/hO2pjGmnw==",
       "license": "MIT",
       "dependencies": {
-        "motion-dom": "^12.40.0",
+        "motion-dom": "^12.42.2",
         "motion-utils": "^12.39.0",
         "tslib": "^2.4.0"
       },
@@ -13115,10 +13493,10 @@
       "optional": true
     },
     "node_modules/fs-extra": {
-      "version": "11.3.5",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.5.tgz",
-      "integrity": "sha512-eKpRKAovdpZtR1WopLHxlBWvAgPny3c4gX1G5Jhwmmw4XJj0ifSD5qB5TOo8hmA0wlRKDAOAhEE1yVPgs6Fgcg==",
-      "devOptional": true,
+      "version": "10.1.0",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-10.1.0.tgz",
+      "integrity": "sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "graceful-fs": "^4.2.0",
@@ -13126,7 +13504,7 @@
         "universalify": "^2.0.0"
       },
       "engines": {
-        "node": ">=14.14"
+        "node": ">=12"
       }
     },
     "node_modules/fsevents": {
@@ -13144,9 +13522,9 @@
       }
     },
     "node_modules/fumadocs-core": {
-      "version": "16.10.4",
-      "resolved": "https://registry.npmjs.org/fumadocs-core/-/fumadocs-core-16.10.4.tgz",
-      "integrity": "sha512-YpS6i8QFGgnXfE90MjlNPNE0tW3v/kg0n34CTP1SREHrFaXiPlQXnaBRTpBVT1g5TCK43yK6bkpKkkT8Ji+P4w==",
+      "version": "16.10.7",
+      "resolved": "https://registry.npmjs.org/fumadocs-core/-/fumadocs-core-16.10.7.tgz",
+      "integrity": "sha512-lR1hDOtJ8ubsLKYH2VMkp+iVZTDdOiMh4StFaWtuTvy8Wfnngz0YSHeFijmm2K+4lg2DLXLMuCEHQ6my54g2Eg==",
       "license": "MIT",
       "dependencies": {
         "@orama/orama": "^3.1.18",
@@ -13154,7 +13532,7 @@
         "github-slugger": "^2.0.0",
         "hast-util-to-estree": "^3.1.3",
         "hast-util-to-jsx-runtime": "^2.3.6",
-        "js-yaml": "^4.2.0",
+        "js-yaml": "^5.1.0",
         "mdast-util-mdx": "^3.0.0",
         "mdast-util-to-markdown": "^2.1.2",
         "remark": "^15.0.1",
@@ -13245,13 +13623,13 @@
       }
     },
     "node_modules/fumadocs-core/node_modules/@shikijs/core": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/core/-/core-4.2.0.tgz",
-      "integrity": "sha512-Hc87Ab1Ld/vEbZRCbwx344I5v+4RU8CVToUTRkqXL1+TjbuOp9U5Xa0M23V4GEWHxVn+yO5otb+HkQVm3ptWQQ==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/core/-/core-4.3.1.tgz",
+      "integrity": "sha512-ANMDxuaPsNMdDC1m4vfvhlDmJweMwkE5XitTwrq2rWHx5jM+dlm4MmHt2PP6t0uejfR77SuhrhJ0zEijIF/uhA==",
       "license": "MIT",
       "dependencies": {
-        "@shikijs/primitive": "4.2.0",
-        "@shikijs/types": "4.2.0",
+        "@shikijs/primitive": "4.3.1",
+        "@shikijs/types": "4.3.1",
         "@shikijs/vscode-textmate": "^10.0.2",
         "@types/hast": "^3.0.4",
         "hast-util-to-html": "^9.0.5"
@@ -13261,12 +13639,12 @@
       }
     },
     "node_modules/fumadocs-core/node_modules/@shikijs/engine-javascript": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/engine-javascript/-/engine-javascript-4.2.0.tgz",
-      "integrity": "sha512-fjETeq1k5ffyXqRgS6+3hpvqseLalp1kjNfRbXpUgWR8FpZ1CmQfiNHovc5lncYjt/Vg5JK/WJEmLahjwMa0og==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/engine-javascript/-/engine-javascript-4.3.1.tgz",
+      "integrity": "sha512-JBItcnPuYq7jVJdZo/vMj94r+szT7XEjHFX+mvFDGSEIbVAXAGyHAHzhbWzpGOwYidCZrErJLLgn2PVeiokHnQ==",
       "license": "MIT",
       "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.3.1",
         "@shikijs/vscode-textmate": "^10.0.2",
         "oniguruma-to-es": "^4.3.6"
       },
@@ -13275,12 +13653,12 @@
       }
     },
     "node_modules/fumadocs-core/node_modules/@shikijs/engine-oniguruma": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/engine-oniguruma/-/engine-oniguruma-4.2.0.tgz",
-      "integrity": "sha512-hTorK1dffPkpbMUk6Z+828PgRo7d07HbnizoP0hNPFjhxMHctj0Px/qoHeGMYafc6ju+u9iMldN4JbVzNQM++g==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/engine-oniguruma/-/engine-oniguruma-4.3.1.tgz",
+      "integrity": "sha512-OXyNMzg0pews+msMj4cHeqT4xiYKKvbnn6VbdAXxfoFl3SSx4fJTc8FadECuc5/H9p3BzhNAoAUXKwAu9rWYhg==",
       "license": "MIT",
       "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.3.1",
         "@shikijs/vscode-textmate": "^10.0.2"
       },
       "engines": {
@@ -13288,33 +13666,33 @@
       }
     },
     "node_modules/fumadocs-core/node_modules/@shikijs/langs": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/langs/-/langs-4.2.0.tgz",
-      "integrity": "sha512-bwrVRlJ0wUhZxAbVdvBbv2TTC9yLsh4C/IO5Ofz0T8MQntgDvyVnkbjw9vi50r1kx7RCIJdnJnjZAwmAsXFLZQ==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/langs/-/langs-4.3.1.tgz",
+      "integrity": "sha512-m0l9nsDqgBHvbZbk7A0/kXz/impK3uB/c6rAn6Gpg/uPtdZRQ+alsN/17MU5thb68XTj/4DxkZAotrM0GGSpDQ==",
       "license": "MIT",
       "dependencies": {
-        "@shikijs/types": "4.2.0"
+        "@shikijs/types": "4.3.1"
       },
       "engines": {
         "node": ">=20"
       }
     },
     "node_modules/fumadocs-core/node_modules/@shikijs/themes": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/themes/-/themes-4.2.0.tgz",
-      "integrity": "sha512-RX8IHYeLv8Cu2W6ruc3RxUqWn0IYCqSrMBzi/uRGAmfyDNOnNO5BF/Px7o97n4XTpmFTo5GbRaazuOWj+2ak2w==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/themes/-/themes-4.3.1.tgz",
+      "integrity": "sha512-dgpoJ4WqNi2yTmizQHBJ5zcX6j2lE6icN/0yt4l1kkf16jrY/pwPLoTb1ETsWMz0OBLf9ZNvwmxft+cH+N9qSA==",
       "license": "MIT",
       "dependencies": {
-        "@shikijs/types": "4.2.0"
+        "@shikijs/types": "4.3.1"
       },
       "engines": {
         "node": ">=20"
       }
     },
     "node_modules/fumadocs-core/node_modules/@shikijs/types": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/types/-/types-4.2.0.tgz",
-      "integrity": "sha512-VT/MKtlpOhEPZloSH3Pb9WCZEBDoQVMa9jedp5UAwmJOar1DVc9DRODAxmYPW9M93IK4ryuqRejFfmlvlVDemw==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/types/-/types-4.3.1.tgz",
+      "integrity": "sha512-CHFxE0jztBIZRHH6gxXE7DXUCFXjReEGxZ/j0rfSLGKZuwp2xBYycEP14875DSa9KLL/6700oxIq6oO6ef9K2g==",
       "license": "MIT",
       "dependencies": {
         "@shikijs/vscode-textmate": "^10.0.2",
@@ -13325,17 +13703,17 @@
       }
     },
     "node_modules/fumadocs-core/node_modules/shiki": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/shiki/-/shiki-4.2.0.tgz",
-      "integrity": "sha512-hjNax6o/ylDy9lefQEaSDtzaT3iVNtZ3WmpQnbuQNoG4xvnSKf2kSKbihZVO4JRG1TTMejs7CmNRYlWgAL66pQ==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/shiki/-/shiki-4.3.1.tgz",
+      "integrity": "sha512-oR+qDVi2OjX1tmDpyv+3KviX01KzO6Af+0NNnKnsp9491UEGz2YpxTuJboS/6VhYpTdqzmuJBuiTlrAWWJAssw==",
       "license": "MIT",
       "dependencies": {
-        "@shikijs/core": "4.2.0",
-        "@shikijs/engine-javascript": "4.2.0",
-        "@shikijs/engine-oniguruma": "4.2.0",
-        "@shikijs/langs": "4.2.0",
-        "@shikijs/themes": "4.2.0",
-        "@shikijs/types": "4.2.0",
+        "@shikijs/core": "4.3.1",
+        "@shikijs/engine-javascript": "4.3.1",
+        "@shikijs/engine-oniguruma": "4.3.1",
+        "@shikijs/langs": "4.3.1",
+        "@shikijs/themes": "4.3.1",
+        "@shikijs/types": "4.3.1",
         "@shikijs/vscode-textmate": "^10.0.2",
         "@types/hast": "^3.0.4"
       },
@@ -13404,10 +13782,44 @@
         }
       }
     },
+    "node_modules/fumadocs-mdx/node_modules/js-yaml": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
+      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^2.0.1"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
+    "node_modules/fumadocs-mdx/node_modules/picomatch": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
+      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "node_modules/fumadocs-ui": {
-      "version": "16.10.4",
-      "resolved": "https://registry.npmjs.org/fumadocs-ui/-/fumadocs-ui-16.10.4.tgz",
-      "integrity": "sha512-/PzeT0ml4V87ilvdf10O4/EjGMJe5qKLrN9dG6wKYxWvvZgZE9414E/36LHOf+vFmr40Shjnl6QpkHhlQYwtcw==",
+      "version": "16.10.7",
+      "resolved": "https://registry.npmjs.org/fumadocs-ui/-/fumadocs-ui-16.10.7.tgz",
+      "integrity": "sha512-zE93/DKW5bhedXRKHYg3rhE/juYi+kXx1xl3ey1dArWbCiPx6lq6/4RLswYXS0lQp1W1f8NsbY1TeA8wSQuEvw==",
       "license": "MIT",
       "dependencies": {
         "@fuma-translate/react": "^1.0.2",
@@ -13423,21 +13835,21 @@
         "@radix-ui/react-slot": "^1.3.0",
         "@radix-ui/react-tabs": "^1.1.15",
         "class-variance-authority": "^0.7.1",
-        "lucide-react": "^1.20.0",
-        "motion": "^12.40.0",
+        "cnfast": "^0.0.8",
+        "lucide-react": "^1.21.0",
+        "motion": "^12.41.0",
         "next-themes": "^0.4.6",
         "react-remove-scroll": "^2.7.2",
         "rehype-raw": "^7.0.0",
         "scroll-into-view-if-needed": "^3.1.0",
         "shiki": "^4.2.0",
-        "tailwind-merge": "^3.6.0",
         "unist-util-visit": "^5.1.0"
       },
       "peerDependencies": {
         "@takumi-rs/image-response": "*",
         "@types/mdx": "*",
         "@types/react": "*",
-        "fumadocs-core": "16.10.4",
+        "fumadocs-core": "16.10.7",
         "next": "16.x.x",
         "react": "^19.2.0",
         "react-dom": "^19.2.0"
@@ -13458,13 +13870,13 @@
       }
     },
     "node_modules/fumadocs-ui/node_modules/@shikijs/core": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/core/-/core-4.2.0.tgz",
-      "integrity": "sha512-Hc87Ab1Ld/vEbZRCbwx344I5v+4RU8CVToUTRkqXL1+TjbuOp9U5Xa0M23V4GEWHxVn+yO5otb+HkQVm3ptWQQ==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/core/-/core-4.3.1.tgz",
+      "integrity": "sha512-ANMDxuaPsNMdDC1m4vfvhlDmJweMwkE5XitTwrq2rWHx5jM+dlm4MmHt2PP6t0uejfR77SuhrhJ0zEijIF/uhA==",
       "license": "MIT",
       "dependencies": {
-        "@shikijs/primitive": "4.2.0",
-        "@shikijs/types": "4.2.0",
+        "@shikijs/primitive": "4.3.1",
+        "@shikijs/types": "4.3.1",
         "@shikijs/vscode-textmate": "^10.0.2",
         "@types/hast": "^3.0.4",
         "hast-util-to-html": "^9.0.5"
@@ -13474,12 +13886,12 @@
       }
     },
     "node_modules/fumadocs-ui/node_modules/@shikijs/engine-javascript": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/engine-javascript/-/engine-javascript-4.2.0.tgz",
-      "integrity": "sha512-fjETeq1k5ffyXqRgS6+3hpvqseLalp1kjNfRbXpUgWR8FpZ1CmQfiNHovc5lncYjt/Vg5JK/WJEmLahjwMa0og==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/engine-javascript/-/engine-javascript-4.3.1.tgz",
+      "integrity": "sha512-JBItcnPuYq7jVJdZo/vMj94r+szT7XEjHFX+mvFDGSEIbVAXAGyHAHzhbWzpGOwYidCZrErJLLgn2PVeiokHnQ==",
       "license": "MIT",
       "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.3.1",
         "@shikijs/vscode-textmate": "^10.0.2",
         "oniguruma-to-es": "^4.3.6"
       },
@@ -13488,12 +13900,12 @@
       }
     },
     "node_modules/fumadocs-ui/node_modules/@shikijs/engine-oniguruma": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/engine-oniguruma/-/engine-oniguruma-4.2.0.tgz",
-      "integrity": "sha512-hTorK1dffPkpbMUk6Z+828PgRo7d07HbnizoP0hNPFjhxMHctj0Px/qoHeGMYafc6ju+u9iMldN4JbVzNQM++g==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/engine-oniguruma/-/engine-oniguruma-4.3.1.tgz",
+      "integrity": "sha512-OXyNMzg0pews+msMj4cHeqT4xiYKKvbnn6VbdAXxfoFl3SSx4fJTc8FadECuc5/H9p3BzhNAoAUXKwAu9rWYhg==",
       "license": "MIT",
       "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.3.1",
         "@shikijs/vscode-textmate": "^10.0.2"
       },
       "engines": {
@@ -13501,33 +13913,33 @@
       }
     },
     "node_modules/fumadocs-ui/node_modules/@shikijs/langs": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/langs/-/langs-4.2.0.tgz",
-      "integrity": "sha512-bwrVRlJ0wUhZxAbVdvBbv2TTC9yLsh4C/IO5Ofz0T8MQntgDvyVnkbjw9vi50r1kx7RCIJdnJnjZAwmAsXFLZQ==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/langs/-/langs-4.3.1.tgz",
+      "integrity": "sha512-m0l9nsDqgBHvbZbk7A0/kXz/impK3uB/c6rAn6Gpg/uPtdZRQ+alsN/17MU5thb68XTj/4DxkZAotrM0GGSpDQ==",
       "license": "MIT",
       "dependencies": {
-        "@shikijs/types": "4.2.0"
+        "@shikijs/types": "4.3.1"
       },
       "engines": {
         "node": ">=20"
       }
     },
     "node_modules/fumadocs-ui/node_modules/@shikijs/themes": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/themes/-/themes-4.2.0.tgz",
-      "integrity": "sha512-RX8IHYeLv8Cu2W6ruc3RxUqWn0IYCqSrMBzi/uRGAmfyDNOnNO5BF/Px7o97n4XTpmFTo5GbRaazuOWj+2ak2w==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/themes/-/themes-4.3.1.tgz",
+      "integrity": "sha512-dgpoJ4WqNi2yTmizQHBJ5zcX6j2lE6icN/0yt4l1kkf16jrY/pwPLoTb1ETsWMz0OBLf9ZNvwmxft+cH+N9qSA==",
       "license": "MIT",
       "dependencies": {
-        "@shikijs/types": "4.2.0"
+        "@shikijs/types": "4.3.1"
       },
       "engines": {
         "node": ">=20"
       }
     },
     "node_modules/fumadocs-ui/node_modules/@shikijs/types": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/types/-/types-4.2.0.tgz",
-      "integrity": "sha512-VT/MKtlpOhEPZloSH3Pb9WCZEBDoQVMa9jedp5UAwmJOar1DVc9DRODAxmYPW9M93IK4ryuqRejFfmlvlVDemw==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/types/-/types-4.3.1.tgz",
+      "integrity": "sha512-CHFxE0jztBIZRHH6gxXE7DXUCFXjReEGxZ/j0rfSLGKZuwp2xBYycEP14875DSa9KLL/6700oxIq6oO6ef9K2g==",
       "license": "MIT",
       "dependencies": {
         "@shikijs/vscode-textmate": "^10.0.2",
@@ -13538,17 +13950,17 @@
       }
     },
     "node_modules/fumadocs-ui/node_modules/shiki": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/shiki/-/shiki-4.2.0.tgz",
-      "integrity": "sha512-hjNax6o/ylDy9lefQEaSDtzaT3iVNtZ3WmpQnbuQNoG4xvnSKf2kSKbihZVO4JRG1TTMejs7CmNRYlWgAL66pQ==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/shiki/-/shiki-4.3.1.tgz",
+      "integrity": "sha512-oR+qDVi2OjX1tmDpyv+3KviX01KzO6Af+0NNnKnsp9491UEGz2YpxTuJboS/6VhYpTdqzmuJBuiTlrAWWJAssw==",
       "license": "MIT",
       "dependencies": {
-        "@shikijs/core": "4.2.0",
-        "@shikijs/engine-javascript": "4.2.0",
-        "@shikijs/engine-oniguruma": "4.2.0",
-        "@shikijs/langs": "4.2.0",
-        "@shikijs/themes": "4.2.0",
-        "@shikijs/types": "4.2.0",
+        "@shikijs/core": "4.3.1",
+        "@shikijs/engine-javascript": "4.3.1",
+        "@shikijs/engine-oniguruma": "4.3.1",
+        "@shikijs/langs": "4.3.1",
+        "@shikijs/themes": "4.3.1",
+        "@shikijs/types": "4.3.1",
         "@shikijs/vscode-textmate": "^10.0.2",
         "@types/hast": "^3.0.4"
       },
@@ -13634,6 +14046,12 @@
         "node": ">=18"
       }
     },
+    "node_modules/gearhash-jit": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/gearhash-jit/-/gearhash-jit-1.0.2.tgz",
+      "integrity": "sha512-UhzJL4KXSdqAKepy/tZwmi2Rcy0YMmtiC4DQS4SURCuIWdh8ECZtnXK2ePRMLigfB61hRKdLK/Vgg2bSw73izQ==",
+      "license": "MIT"
+    },
     "node_modules/gensync": {
       "version": "1.0.0-beta.2",
       "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz",
@@ -13803,6 +14221,21 @@
         "node": ">= 6"
       }
     },
+    "node_modules/global-agent": {
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/global-agent/-/global-agent-4.1.3.tgz",
+      "integrity": "sha512-KUJEViiuFT3I97t+GYMikLPJS2Lfo/S2F+DQuBWzuzaMPnvt5yyZePzArx36fBzpGTxZjIpDbXLeySLgh+k76g==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "globalthis": "^1.0.2",
+        "matcher": "^4.0.0",
+        "semver": "^7.3.5",
+        "serialize-error": "^8.1.0"
+      },
+      "engines": {
+        "node": ">=10.0"
+      }
+    },
     "node_modules/global-directory": {
       "version": "4.0.1",
       "resolved": "https://registry.npmjs.org/global-directory/-/global-directory-4.0.1.tgz",
@@ -13810,13 +14243,29 @@
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "ini": "4.1.1"
+        "ini": "4.1.1"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/globalthis": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/globalthis/-/globalthis-1.0.4.tgz",
+      "integrity": "sha512-DpLKbNU4WylpxJykQujfCcwYWiV/Jhm50Goo0wrVILAv5jOr9d+H+UR3PhSCD2rCCEIg0uc+G+muBTwD54JhDQ==",
+      "license": "MIT",
+      "dependencies": {
+        "define-properties": "^1.2.1",
+        "gopd": "^1.0.1"
       },
       "engines": {
-        "node": ">=18"
+        "node": ">= 0.4"
       },
       "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "url": "https://github.com/sponsors/ljharb"
       }
     },
     "node_modules/google-auth-library": {
@@ -13916,9 +14365,9 @@
       }
     },
     "node_modules/gray-matter/node_modules/js-yaml": {
-      "version": "3.14.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
-      "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
+      "version": "3.15.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz",
+      "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==",
       "license": "MIT",
       "dependencies": {
         "argparse": "^1.0.7",
@@ -13969,16 +14418,6 @@
         "uglify-js": "^3.1.4"
       }
     },
-    "node_modules/handlebars/node_modules/source-map": {
-      "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/has-flag": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
@@ -13992,7 +14431,6 @@
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/has-property-descriptors/-/has-property-descriptors-1.0.2.tgz",
       "integrity": "sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "es-define-property": "^1.0.0"
@@ -14373,9 +14811,9 @@
       "license": "MIT"
     },
     "node_modules/hono": {
-      "version": "4.12.26",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.26.tgz",
-      "integrity": "sha512-uyZtpnYxM9CmQ7QsQknM4zN8EftNqhON1qYeIKM0Se67CCEe2c44xyGURwB0axX2fBDu1dqHrHAc1hmNT8ITkw==",
+      "version": "4.12.27",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.27.tgz",
+      "integrity": "sha512-1yrb/+w6HWQJrUCLkJ2IF5jNIPvvFkblV5RNOYl6bV+OA6p9GLcMpHFFGTosSvHvcAUibuUukRqhlYI4z32C7Q==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
@@ -14491,9 +14929,9 @@
       }
     },
     "node_modules/iconv-lite": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
-      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
+      "version": "0.7.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz",
+      "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==",
       "license": "MIT",
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3.0.0"
@@ -14549,9 +14987,9 @@
       }
     },
     "node_modules/immer": {
-      "version": "10.2.0",
-      "resolved": "https://registry.npmjs.org/immer/-/immer-10.2.0.tgz",
-      "integrity": "sha512-d/+XTN3zfODyjr89gM3mPq1WNX2B8pYsu7eORitdwyA2sBubnTl3laYlBk4sXY5FUa5qTZGBDPJICVbvqzjlbw==",
+      "version": "11.1.11",
+      "resolved": "https://registry.npmjs.org/immer/-/immer-11.1.11.tgz",
+      "integrity": "sha512-qzXuyXAkPySAGYkfsAwodDPWT8Zm7/Uo5BNt4BjhMhG5WlWyZZ4wQqnWwdS8kjlQ1Cwu6gjw3A6+0gTQwlyYtw==",
       "license": "MIT",
       "funding": {
         "type": "opencollective",
@@ -14569,13 +15007,16 @@
       }
     },
     "node_modules/indent-string": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/indent-string/-/indent-string-4.0.0.tgz",
-      "integrity": "sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==",
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/indent-string/-/indent-string-5.0.0.tgz",
+      "integrity": "sha512-m6FAo/spmsW2Ab2fU35JTYwtOKa2yAwXSwgjSv1TJzh4Mh7mC3lzAOVLBprb72XsTrgkEIsl7YrFNAiDiRhIGg==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=8"
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
     "node_modules/inherits": {
@@ -14594,6 +15035,96 @@
         "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
       }
     },
+    "node_modules/ink": {
+      "version": "7.0.5",
+      "resolved": "https://registry.npmjs.org/ink/-/ink-7.0.5.tgz",
+      "integrity": "sha512-zWNjGHQPxSeiSAmDUOq+QPQ6CfmMhmNi85vrJIuy4prafKKUSoZlXEy4wbM7LuLuF1pDURk7qvF4fxrQlLxv3w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@alcalzone/ansi-tokenize": "^0.3.0",
+        "ansi-escapes": "^7.3.0",
+        "ansi-styles": "^6.2.3",
+        "auto-bind": "^5.0.1",
+        "chalk": "^5.6.2",
+        "cli-boxes": "^4.0.1",
+        "cli-cursor": "^4.0.0",
+        "cli-truncate": "^6.0.0",
+        "code-excerpt": "^4.0.0",
+        "es-toolkit": "^1.45.1",
+        "indent-string": "^5.0.0",
+        "is-in-ci": "^2.0.0",
+        "patch-console": "^2.0.0",
+        "react-reconciler": "^0.33.0",
+        "scheduler": "^0.27.0",
+        "signal-exit": "^3.0.7",
+        "slice-ansi": "^9.0.0",
+        "stack-utils": "^2.0.6",
+        "string-width": "^8.2.0",
+        "terminal-size": "^4.0.1",
+        "type-fest": "^5.5.0",
+        "widest-line": "^6.0.0",
+        "wrap-ansi": "^10.0.0",
+        "ws": "^8.20.0",
+        "yoga-layout": "~3.2.1"
+      },
+      "engines": {
+        "node": ">=22"
+      },
+      "peerDependencies": {
+        "@types/react": ">=19.2.0",
+        "react": ">=19.2.0",
+        "react-devtools-core": ">=6.1.2"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "react-devtools-core": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/ink/node_modules/signal-exit": {
+      "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
+      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/ink/node_modules/string-width": {
+      "version": "8.2.1",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-8.2.1.tgz",
+      "integrity": "sha512-IIaP0g3iy9Cyy18w3M9YcaDudujEAVHKt3a3QJg1+sr/oX96TbaGUubG0hJyCjCBThFH+tFpcIyoUHUn1ogaLA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "get-east-asian-width": "^1.5.0",
+        "strip-ansi": "^7.1.2"
+      },
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/ink/node_modules/type-fest": {
+      "version": "5.8.0",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-5.8.0.tgz",
+      "integrity": "sha512-YGYEVz3Fm5iy/AybuA0oyNFq7H4CgQNfRp/qfe8nurE1kuCeNm3/vfm9X4Mtl+qLyaKJUh5xrFZwogr41SMjYA==",
+      "dev": true,
+      "license": "(MIT OR CC0-1.0)",
+      "dependencies": {
+        "tagged-tag": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/inline-style-parser": {
       "version": "0.2.7",
       "resolved": "https://registry.npmjs.org/inline-style-parser/-/inline-style-parser-0.2.7.tgz",
@@ -14756,12 +15287,19 @@
       }
     },
     "node_modules/is-fullwidth-code-point": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-5.1.0.tgz",
+      "integrity": "sha512-5XHYaSyiqADb4RnZ1Bdad6cPp8Toise4TzEjcOYDHZkTCbKgiUl7WTUCpNWHuxmDt91wnsZBc9xinNzopv3JMQ==",
+      "dev": true,
       "license": "MIT",
+      "dependencies": {
+        "get-east-asian-width": "^1.3.1"
+      },
       "engines": {
-        "node": ">=8"
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
     "node_modules/is-glob": {
@@ -14787,6 +15325,22 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
+    "node_modules/is-in-ci": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/is-in-ci/-/is-in-ci-2.0.0.tgz",
+      "integrity": "sha512-cFeerHriAnhrQSbpAxL37W1wcJKUUX07HyLWZCW1URJT/ra3GyUTzBgUnh24TMVfNTV2Hij2HLxkPHFZfOZy5w==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "is-in-ci": "cli.js"
+      },
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/is-inside-container": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/is-inside-container/-/is-inside-container-1.0.0.tgz",
@@ -14951,29 +15505,16 @@
       }
     },
     "node_modules/is-wsl": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-2.2.0.tgz",
-      "integrity": "sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww==",
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-3.1.1.tgz",
+      "integrity": "sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "is-docker": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/is-wsl/node_modules/is-docker": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-2.2.1.tgz",
-      "integrity": "sha512-F+i2BKsFrH66iaUFc0woD8sLy8getkwTwtOBjvs56Cx4CgJDeKQeqfz8wAYiSb8JOprWhHH5p77PbmYCvvUuXQ==",
-      "dev": true,
-      "license": "MIT",
-      "bin": {
-        "is-docker": "cli.js"
+        "is-inside-container": "^1.0.0"
       },
       "engines": {
-        "node": ">=8"
+        "node": ">=16"
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
@@ -15052,9 +15593,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
-      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.1.tgz",
+      "integrity": "sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==",
       "funding": [
         {
           "type": "github",
@@ -15070,7 +15611,7 @@
         "argparse": "^2.0.1"
       },
       "bin": {
-        "js-yaml": "bin/js-yaml.js"
+        "js-yaml": "bin/js-yaml.mjs"
       }
     },
     "node_modules/jsdom": {
@@ -15114,16 +15655,6 @@
         }
       }
     },
-    "node_modules/jsdom/node_modules/undici": {
-      "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.28.0.tgz",
-      "integrity": "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=20.18.1"
-      }
-    },
     "node_modules/jsesc": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz",
@@ -15720,22 +16251,12 @@
       "integrity": "sha512-FWWMIEOxz3GwUI4Ts/IvgVy6LPvoMPgjMdQ185nN6psJyBJ4yOpzqm695/h5umdLJg2vW3GR5iG11MAkR2AzJA=="
     },
     "node_modules/linkify-it": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-5.0.1.tgz",
-      "integrity": "sha512-wVoTjP4Q6R0NW5hiZkVJaFZPWgtXfoGF+6LucL3/FtiNjmcHhYjEr5f1Kqjirc1nBW07J/ZuRFumqr2oqccEWg==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/puzrin"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/markdown-it"
-        }
-      ],
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-3.0.3.tgz",
+      "integrity": "sha512-ynTsyrFSdE5oZ/O9GEf00kPngmOfVwazR5GKDq6EYfhlpFug3J2zybX56a2PRRpc9P+FuSoGNAwjlbDs9jJBPQ==",
       "license": "MIT",
       "dependencies": {
-        "uc.micro": "^2.0.0"
+        "uc.micro": "^1.0.1"
       }
     },
     "node_modules/local-pkg": {
@@ -15931,9 +16452,9 @@
       "license": "ISC"
     },
     "node_modules/lucide-react": {
-      "version": "1.20.0",
-      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-1.20.0.tgz",
-      "integrity": "sha512-jhXLeC/7m0/tjL1nzMdKk6x256zWA6AtbhTVreHOiKPoeX2d6MK4FbyIQPpVq0E6iPWBisyy1TW+pEge/uMEuQ==",
+      "version": "1.23.0",
+      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-1.23.0.tgz",
+      "integrity": "sha512-38BpJcD0JhFosxHApP/BYsBetLpQFRoTRzEzstM/XCc3jsAG7wqaY1lgVwxiUe3xqYE+lNxo2PkCmYwXWrwwIw==",
       "license": "ISC",
       "peerDependencies": {
         "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0"
@@ -15968,9 +16489,9 @@
       }
     },
     "node_modules/markdown-it": {
-      "version": "14.2.0",
-      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.2.0.tgz",
-      "integrity": "sha512-1TGiQiJVRQ3NPmZH6sx5Cfnmg6GQm9jvC1ch4TK511NjSJvjzKLzn5pPfZRNZkRPZP0HqCioSndqH8v2nRaWVQ==",
+      "version": "14.3.0",
+      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.0.tgz",
+      "integrity": "sha512-RCEsPjR+sr0x+AuYp601tKTkgFG4YEPLCzHST3cQ/fhlJkqAkz1L2/Qbp1j9qw5SBwQHFBoW8+hoN5xssOF0Tw==",
       "funding": [
         {
           "type": "github",
@@ -15984,8 +16505,8 @@
       "license": "MIT",
       "dependencies": {
         "argparse": "^2.0.1",
-        "entities": "^4.4.0",
-        "linkify-it": "^5.0.1",
+        "entities": "^4.5.0",
+        "linkify-it": "^5.0.2",
         "mdurl": "^2.0.0",
         "punycode.js": "^2.3.1",
         "uc.micro": "^2.1.0"
@@ -16006,6 +16527,31 @@
         "url": "https://github.com/fb55/entities?sponsor=1"
       }
     },
+    "node_modules/markdown-it/node_modules/linkify-it": {
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-5.0.2.tgz",
+      "integrity": "sha512-ONTm2jCMAVZjgQa/Fy1kScXsuOoF5NPTsoFBdE1KVIZ2vAh/r9+Bqo+0jINCBYnavTPQZz38QzFTme79ENoN3Q==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/markdown-it"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "uc.micro": "^2.0.0"
+      }
+    },
+    "node_modules/markdown-it/node_modules/uc.micro": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/uc.micro/-/uc.micro-2.1.0.tgz",
+      "integrity": "sha512-ARDJmphmdvUk6Glw7y9DQ2bFkKBHwQHLi2lsaH6PPmz/Ka9sFOBsBluozhDltWmnv9u/cF6Rt87znRTPV+yp/A==",
+      "license": "MIT"
+    },
     "node_modules/markdown-table": {
       "version": "3.0.4",
       "resolved": "https://registry.npmjs.org/markdown-table/-/markdown-table-3.0.4.tgz",
@@ -16069,31 +16615,69 @@
         "@mastra/core": ">=1.34.0-0 <2.0.0-0"
       }
     },
-    "node_modules/mastra/node_modules/@mastra/loggers": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@mastra/loggers/-/loggers-1.1.2.tgz",
-      "integrity": "sha512-1YdWiUzBX14ULWI+5oDX4eIHt8AD1F5nbx98xevybjd/HqKBPmJni/chcngod2sJZfDcx4NyQE87c/s1Cj+ULQ==",
+    "node_modules/mastra/node_modules/commander": {
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-14.0.3.tgz",
+      "integrity": "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==",
       "dev": true,
-      "license": "Apache-2.0",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/mastra/node_modules/fs-extra": {
+      "version": "11.3.6",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.6.tgz",
+      "integrity": "sha512-w8ZNZr2mKIc7qeNaQ9AVPT1+iFaI+Avd4xudVOvdDJ8VytREi1Ft5Ih7hd9jjehod8vAM5GMsfQ/TpPf4EyoEA==",
+      "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "pino": "^10.3.1",
-        "pino-pretty": "^13.1.3"
+        "graceful-fs": "^4.2.0",
+        "jsonfile": "^6.0.1",
+        "universalify": "^2.0.0"
       },
       "engines": {
-        "node": ">=22.13.0"
-      },
-      "peerDependencies": {
-        "@mastra/core": ">=1.0.0-0 <2.0.0-0"
+        "node": ">=14.14"
       }
     },
-    "node_modules/mastra/node_modules/commander": {
-      "version": "14.0.3",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-14.0.3.tgz",
-      "integrity": "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==",
+    "node_modules/mastra/node_modules/strip-json-comments": {
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-5.0.3.tgz",
+      "integrity": "sha512-1tB5mhVo7U+ETBKNf92xT4hrQa3pm0MZ0PQvuDnWgAAGHDsfp4lPSpiS6psrSiet87wyGPh9ft6wmhOMQ0hDiw==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=20"
+        "node": ">=14.16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/matcher": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/matcher/-/matcher-4.0.0.tgz",
+      "integrity": "sha512-S6x5wmcDmsDRRU/c2dkccDwQPXoFczc5+HpQ2lON8pnvHlnvHAHj5WlLVvw6n6vNyHuVugYrFohYxbS+pvFpKQ==",
+      "license": "MIT",
+      "dependencies": {
+        "escape-string-regexp": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/matcher/node_modules/escape-string-regexp": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
+      "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
     "node_modules/math-intrinsics": {
@@ -16521,26 +17105,26 @@
       }
     },
     "node_modules/mermaid": {
-      "version": "11.15.0",
-      "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.15.0.tgz",
-      "integrity": "sha512-pTMbcf3rWdtLiYGpmoTjHEpeY8seiy6sR+9nD7LOs8KfUbHE4lOUAprTRqRAcWSQ6MQpdX+YEsxShtGsINtPtw==",
+      "version": "11.16.0",
+      "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.16.0.tgz",
+      "integrity": "sha512-Zvm3kbstgdpvIJPPItlL7fppIZ3kibvc1oZIGxdvk9t6UFz6flv+Jw7FtRGKwfcI8OckmH04LqG6LlS6X4B1pA==",
       "license": "MIT",
       "dependencies": {
-        "@braintree/sanitize-url": "^7.1.1",
+        "@braintree/sanitize-url": "^7.1.2",
         "@iconify/utils": "^3.0.2",
-        "@mermaid-js/parser": "^1.1.1",
+        "@mermaid-js/parser": "^1.2.0",
         "@types/d3": "^7.4.3",
         "@upsetjs/venn.js": "^2.0.0",
-        "cytoscape": "^3.33.1",
+        "cytoscape": "^3.33.3",
         "cytoscape-cose-bilkent": "^4.1.0",
         "cytoscape-fcose": "^2.2.0",
         "d3": "^7.9.0",
         "d3-sankey": "^0.12.3",
         "dagre-d3-es": "7.0.14",
-        "dayjs": "^1.11.19",
-        "dompurify": "^3.3.1",
+        "dayjs": "^1.11.20",
+        "dompurify": "^3.3.3",
         "es-toolkit": "^1.45.1",
-        "katex": "^0.16.25",
+        "katex": "^0.16.45",
         "khroma": "^2.1.0",
         "marked": "^16.3.0",
         "roughjs": "^4.6.6",
@@ -17380,19 +17964,6 @@
         "node": ">=8.6"
       }
     },
-    "node_modules/micromatch/node_modules/picomatch": {
-      "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
-      "devOptional": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=8.6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/jonschlinkert"
-      }
-    },
     "node_modules/mime": {
       "version": "2.6.0",
       "resolved": "https://registry.npmjs.org/mime/-/mime-2.6.0.tgz",
@@ -17510,6 +18081,18 @@
         "node": ">=16 || 14 >=14.17"
       }
     },
+    "node_modules/minizlib": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-3.1.0.tgz",
+      "integrity": "sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==",
+      "license": "MIT",
+      "dependencies": {
+        "minipass": "^7.1.2"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
     "node_modules/mkdirp-classic": {
       "version": "0.5.3",
       "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
@@ -17531,12 +18114,12 @@
       }
     },
     "node_modules/motion": {
-      "version": "12.40.0",
-      "resolved": "https://registry.npmjs.org/motion/-/motion-12.40.0.tgz",
-      "integrity": "sha512-yjrHUrBFW6kQvjJwRsoiPSAhC5tRwRqNGJWmiJ4CrGnbKp0V88AdzkhBmDoqIsIPfarOe0Uddd37Xq43/gIocA==",
+      "version": "12.42.2",
+      "resolved": "https://registry.npmjs.org/motion/-/motion-12.42.2.tgz",
+      "integrity": "sha512-Atvv11yUKIid41cVrRBDVX5m8tF8kNpExRSlbpt6APClhDjtwQssgFHhQzejxw7/7YYbjHSPKBVbHo05BuJT5Q==",
       "license": "MIT",
       "dependencies": {
-        "framer-motion": "^12.40.0",
+        "framer-motion": "^12.42.2",
         "tslib": "^2.4.0"
       },
       "peerDependencies": {
@@ -17557,9 +18140,9 @@
       }
     },
     "node_modules/motion-dom": {
-      "version": "12.40.0",
-      "resolved": "https://registry.npmjs.org/motion-dom/-/motion-dom-12.40.0.tgz",
-      "integrity": "sha512-HxU3ZaBwNPVQUBQf1xxgq+7JrPNZvjLVxgbpEZL7RrWJnsxOf0/OM+yrHG9ogLQ31Do/r57Oz2gQWPK+6q62mg==",
+      "version": "12.42.2",
+      "resolved": "https://registry.npmjs.org/motion-dom/-/motion-dom-12.42.2.tgz",
+      "integrity": "sha512-5gIMWLp/PycBtJRJWRgjxke5n8dlvkSn2DrYW+tr3XcqAZY1xZh6BJyooJXCM8wdfM7wfMjkBJNLge1CKPUIRA==",
       "license": "MIT",
       "dependencies": {
         "motion-utils": "^12.39.0"
@@ -17598,16 +18181,16 @@
       }
     },
     "node_modules/nan": {
-      "version": "2.27.0",
-      "resolved": "https://registry.npmjs.org/nan/-/nan-2.27.0.tgz",
-      "integrity": "sha512-hC+0LidcL3XE4rp1C4H54KujgXKzbfyTngZTwBByQxsOxCEKZT0MPQ4hOKUH2jU1OYstqdDH4onyHPDzcV0XdQ==",
+      "version": "2.28.0",
+      "resolved": "https://registry.npmjs.org/nan/-/nan-2.28.0.tgz",
+      "integrity": "sha512-fTsDz99OTq2sVePhGdp4qQhggZFtKr64ZNVyVajRKtMOkJxYekplBh577PiJB12v/D3s2E5cGtOI45LWp6rnLQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/nanoid": {
-      "version": "5.1.11",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-5.1.11.tgz",
-      "integrity": "sha512-v+KEsUv2ps74PaSKv0gHTxTCgMXOIfBEbaqa6w6ISIGC7ZsvHN4N9oJ8d4cmf0n5oTzQz2SLmThbQWhjd/8eKg==",
+      "version": "3.3.15",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.15.tgz",
+      "integrity": "sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA==",
       "funding": [
         {
           "type": "github",
@@ -17616,10 +18199,10 @@
       ],
       "license": "MIT",
       "bin": {
-        "nanoid": "bin/nanoid.js"
+        "nanoid": "bin/nanoid.cjs"
       },
       "engines": {
-        "node": "^18 || >=20"
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
       }
     },
     "node_modules/napi-build-utils": {
@@ -17684,12 +18267,12 @@
       "license": "MIT"
     },
     "node_modules/next": {
-      "version": "16.2.4",
-      "resolved": "https://registry.npmjs.org/next/-/next-16.2.4.tgz",
-      "integrity": "sha512-kPvz56wF5frc+FxlHI5qnklCzbq53HTwORaWBGdT0vNoKh1Aya9XC8aPauH4NJxqtzbWsS5mAbctm4cr+EkQ2Q==",
+      "version": "16.2.10",
+      "resolved": "https://registry.npmjs.org/next/-/next-16.2.10.tgz",
+      "integrity": "sha512-2som5AVXb3kE6Yjine3/mNbBayYF58eguBWIVVUdr1y/L426xyVEgYxgBG+1QC34P2x5E+tcDup6XkuOAX3dCA==",
       "license": "MIT",
       "dependencies": {
-        "@next/env": "16.2.4",
+        "@next/env": "16.2.10",
         "@swc/helpers": "0.5.15",
         "baseline-browser-mapping": "^2.9.19",
         "caniuse-lite": "^1.0.30001579",
@@ -17703,14 +18286,14 @@
         "node": ">=20.9.0"
       },
       "optionalDependencies": {
-        "@next/swc-darwin-arm64": "16.2.4",
-        "@next/swc-darwin-x64": "16.2.4",
-        "@next/swc-linux-arm64-gnu": "16.2.4",
-        "@next/swc-linux-arm64-musl": "16.2.4",
-        "@next/swc-linux-x64-gnu": "16.2.4",
-        "@next/swc-linux-x64-musl": "16.2.4",
-        "@next/swc-win32-arm64-msvc": "16.2.4",
-        "@next/swc-win32-x64-msvc": "16.2.4",
+        "@next/swc-darwin-arm64": "16.2.10",
+        "@next/swc-darwin-x64": "16.2.10",
+        "@next/swc-linux-arm64-gnu": "16.2.10",
+        "@next/swc-linux-arm64-musl": "16.2.10",
+        "@next/swc-linux-x64-gnu": "16.2.10",
+        "@next/swc-linux-x64-musl": "16.2.10",
+        "@next/swc-win32-arm64-msvc": "16.2.10",
+        "@next/swc-win32-x64-msvc": "16.2.10",
         "sharp": "^0.34.5"
       },
       "peerDependencies": {
@@ -17747,9 +18330,9 @@
       }
     },
     "node_modules/node-abi": {
-      "version": "3.92.0",
-      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.92.0.tgz",
-      "integrity": "sha512-KdHvFWZjEKDf0cakgFjebl371GPsISX2oZHcuyKqM7DtogIsHrqKeLTo8wBHxaXRAQlY2PsPlZmfo+9ZCxEREQ==",
+      "version": "3.94.0",
+      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.94.0.tgz",
+      "integrity": "sha512-W5ZNO5KRPB5TkYmGVD9F6YqhsglXJzE6etpbmT+f6EQElhiX/UTG551cnsRGvLG3fyZEg9HwaDmNmj5nwJ4z9g==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -17831,9 +18414,9 @@
       }
     },
     "node_modules/node-releases": {
-      "version": "2.0.47",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.47.tgz",
-      "integrity": "sha512-Uzmd6LXpouKo8EUK68IjH4+E01w/hXyV3R3g/geCJo+rXLNfh1xucB+LOzYEOQPSiUK3h/xZf0cQGcSsmyL2Og==",
+      "version": "2.0.50",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.50.tgz",
+      "integrity": "sha512-J6l92tKHX6w8Jy5nO1Vuc01NoIiRGi/d6qBKVxh+IQ8Cr3b6HbVNfKiF8ZpFKufTwpwxMmce2W3iQZ861ZRyTg==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -17912,7 +18495,6 @@
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/object-keys/-/object-keys-1.1.1.tgz",
       "integrity": "sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -17973,16 +18555,16 @@
       }
     },
     "node_modules/onetime": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/onetime/-/onetime-7.0.0.tgz",
-      "integrity": "sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ==",
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz",
+      "integrity": "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "mimic-function": "^5.0.0"
+        "mimic-fn": "^2.1.0"
       },
       "engines": {
-        "node": ">=18"
+        "node": ">=6"
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
@@ -18005,6 +18587,29 @@
         "regex-recursion": "^6.0.2"
       }
     },
+    "node_modules/onnxruntime-common": {
+      "version": "1.26.0",
+      "resolved": "https://registry.npmjs.org/onnxruntime-common/-/onnxruntime-common-1.26.0.tgz",
+      "integrity": "sha512-qVyMR4lcWgbkc4getFV+GQijsTnbg/siteoqcDwa3sI/LxbrMSNw4ePyvCq/ymdQaRomCA7YuWmhzsswxvymdw==",
+      "license": "MIT"
+    },
+    "node_modules/onnxruntime-node": {
+      "version": "1.26.0",
+      "resolved": "https://registry.npmjs.org/onnxruntime-node/-/onnxruntime-node-1.26.0.tgz",
+      "integrity": "sha512-OHl6PiOEOqxaLHL0N9eFrbzS7IGmu3BtJNH3RTEnRAheCIkfc3gjcjl4sGcjp9C22ZC9YTquDOxSdT/stBQ6BQ==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "os": [
+        "win32",
+        "darwin",
+        "linux"
+      ],
+      "dependencies": {
+        "adm-zip": "^0.5.16",
+        "global-agent": "^4.1.3",
+        "onnxruntime-common": "1.26.0"
+      }
+    },
     "node_modules/open": {
       "version": "10.2.0",
       "resolved": "https://registry.npmjs.org/open/-/open-10.2.0.tgz",
@@ -18025,15 +18630,27 @@
       }
     },
     "node_modules/openai": {
-      "version": "6.44.0",
-      "resolved": "https://registry.npmjs.org/openai/-/openai-6.44.0.tgz",
-      "integrity": "sha512-09/gH+8jH0RgUwsgWHAaxsKGRT5zVZ95IaJUnqAWj6XejIBmnFRwq2WUIF37VtDEsmGrtPmvCs5+yBSeZGWvkA==",
+      "version": "6.45.0",
+      "resolved": "https://registry.npmjs.org/openai/-/openai-6.45.0.tgz",
+      "integrity": "sha512-5DQVNErssk0afNpTTHUm/qZPU4iKR9OYdNid8Ib4puq4gHNNvGWZht2zY4h9a8JMF949Ik6m8gQutllVPbjdnw==",
       "license": "Apache-2.0",
       "peerDependencies": {
+        "@aws-sdk/credential-provider-node": ">=3.972.0 <4",
+        "@smithy/hash-node": ">=4.3.0 <5",
+        "@smithy/signature-v4": ">=5.4.0 <6",
         "ws": "^8.18.0",
         "zod": "^3.25 || ^4.0"
       },
       "peerDependenciesMeta": {
+        "@aws-sdk/credential-provider-node": {
+          "optional": true
+        },
+        "@smithy/hash-node": {
+          "optional": true
+        },
+        "@smithy/signature-v4": {
+          "optional": true
+        },
         "ws": {
           "optional": true
         },
@@ -18083,6 +18700,22 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/ora/node_modules/cli-cursor": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/cli-cursor/-/cli-cursor-5.0.0.tgz",
+      "integrity": "sha512-aCj4O5wKyszjMmDT4tZj93kxyydN/K5zPWSCe6/0AV/AA1pqe5ZBIw0a2ZfPQV7lL5/yb5HsUreJ6UFAF1tEQw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "restore-cursor": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/ora/node_modules/emoji-regex": {
       "version": "10.6.0",
       "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-10.6.0.tgz",
@@ -18090,6 +18723,39 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/ora/node_modules/onetime": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/onetime/-/onetime-7.0.0.tgz",
+      "integrity": "sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "mimic-function": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/ora/node_modules/restore-cursor": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/restore-cursor/-/restore-cursor-5.1.0.tgz",
+      "integrity": "sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "onetime": "^7.0.0",
+        "signal-exit": "^4.1.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/ora/node_modules/string-width": {
       "version": "7.2.0",
       "resolved": "https://registry.npmjs.org/string-width/-/string-width-7.2.0.tgz",
@@ -18124,9 +18790,9 @@
       }
     },
     "node_modules/p-map": {
-      "version": "7.0.4",
-      "resolved": "https://registry.npmjs.org/p-map/-/p-map-7.0.4.tgz",
-      "integrity": "sha512-tkAQEw8ysMzmkhgw8k+1U/iPhWNhykKnSk4Rd5zLoPJCuJaGRPo6YposrZgaxHKzDHdDWWZvE/Sk7hsL2X/CpQ==",
+      "version": "7.0.5",
+      "resolved": "https://registry.npmjs.org/p-map/-/p-map-7.0.5.tgz",
+      "integrity": "sha512-e8vJF4XdVkzqqSHguEMz41mQO1wKwxKm5ENrUJQUu9kLDCtn83cxbyHZcszr4QC5zEA7WffRRC4gsTecC7J9oA==",
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -18210,15 +18876,15 @@
       "license": "BlueOak-1.0.0"
     },
     "node_modules/package-manager-detector": {
-      "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/package-manager-detector/-/package-manager-detector-1.6.0.tgz",
-      "integrity": "sha512-61A5ThoTiDG/C8s8UMZwSorAGwMJ0ERVGj2OjoW5pAalsNOg15+iQiPzrLJ4jhZ1HJzmC2PIHT2oEiH3R5fzNA==",
+      "version": "1.7.0",
+      "resolved": "https://registry.npmjs.org/package-manager-detector/-/package-manager-detector-1.7.0.tgz",
+      "integrity": "sha512-xg1eHpwYL/D/HEdWw2goFZP6vV0FH7W+PZ5rFkGjdIDLtxq7EkzBUeT3m+lndYCt8wKbmofUu1MUdMCXkCk9ZQ==",
       "license": "MIT"
     },
     "node_modules/papaparse": {
-      "version": "5.5.3",
-      "resolved": "https://registry.npmjs.org/papaparse/-/papaparse-5.5.3.tgz",
-      "integrity": "sha512-5QvjGxYVjxO59MGU2lHVYpRWBBtKHnlIAcSe1uNFCkkptUh63NFRj0FJQm7nR67puEruUci/ZkjmEFrjCAyP4A==",
+      "version": "5.5.4",
+      "resolved": "https://registry.npmjs.org/papaparse/-/papaparse-5.5.4.tgz",
+      "integrity": "sha512-SwzWD9gl/ElwYLCI0nUja1mFJzjq2D8ziShfNBa7zCHzkOozeOGDwHWQ+tvCzEZcewecWZ5U7kUopDnG+DFYEQ==",
       "license": "MIT"
     },
     "node_modules/parse-entities": {
@@ -18280,6 +18946,16 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/patch-console": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/patch-console/-/patch-console-2.0.0.tgz",
+      "integrity": "sha512-0YNdUceMdaQwoKce1gatDScmMo5pu/tfABfnzEqeG0gtTmd7mh/WcwgUjtAeOU7N8nFFlbQBnFK2gXW5fGvmMA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+      }
+    },
     "node_modules/patch-package": {
       "version": "8.0.1",
       "resolved": "https://registry.npmjs.org/patch-package/-/patch-package-8.0.1.tgz",
@@ -18343,21 +19019,6 @@
         "url": "https://github.com/chalk/chalk?sponsor=1"
       }
     },
-    "node_modules/patch-package/node_modules/fs-extra": {
-      "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-10.1.0.tgz",
-      "integrity": "sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "graceful-fs": "^4.2.0",
-        "jsonfile": "^6.0.1",
-        "universalify": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
     "node_modules/patch-package/node_modules/is-docker": {
       "version": "2.2.1",
       "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-2.2.1.tgz",
@@ -18374,6 +19035,19 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/patch-package/node_modules/is-wsl": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-2.2.0.tgz",
+      "integrity": "sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-docker": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/patch-package/node_modules/open": {
       "version": "7.4.2",
       "resolved": "https://registry.npmjs.org/open/-/open-7.4.2.tgz",
@@ -18459,14 +19133,14 @@
       "license": "MIT"
     },
     "node_modules/pg": {
-      "version": "8.21.0",
-      "resolved": "https://registry.npmjs.org/pg/-/pg-8.21.0.tgz",
-      "integrity": "sha512-AUP1EYJuHraQGsVoCQVIcM7TEJVGtDzxWtGFZd8rds9d+CCXlU5Js1rYgfLNvxy9iJrpHjGrRjoi/3BT9fRyiA==",
+      "version": "8.22.0",
+      "resolved": "https://registry.npmjs.org/pg/-/pg-8.22.0.tgz",
+      "integrity": "sha512-8wih1vVIBMxoUM2oB4soJsD9tDnDpLv4OXBJ+EJzFsvycD+lfyIreC2gGHq78f8jbLLt+bvlPTFdFZfJkOuzAA==",
       "license": "MIT",
       "dependencies": {
-        "pg-connection-string": "^2.13.0",
+        "pg-connection-string": "^2.14.0",
         "pg-pool": "^3.14.0",
-        "pg-protocol": "^1.14.0",
+        "pg-protocol": "^1.15.0",
         "pg-types": "2.2.0",
         "pgpass": "1.0.5"
       },
@@ -18493,9 +19167,9 @@
       "optional": true
     },
     "node_modules/pg-connection-string": {
-      "version": "2.13.0",
-      "resolved": "https://registry.npmjs.org/pg-connection-string/-/pg-connection-string-2.13.0.tgz",
-      "integrity": "sha512-EMnU9E2fSULdsbErBbMaXJvFeD9B4+nPcM3f+4lsiCR0BHLPrLVjv3DbyM2hgQQviKJaTWIRRTjKjWlHg3p2ig==",
+      "version": "2.14.0",
+      "resolved": "https://registry.npmjs.org/pg-connection-string/-/pg-connection-string-2.14.0.tgz",
+      "integrity": "sha512-XwWDGcLRGCXAR8F/AM5bG7Q+A3Wm2s6QeEjlOKZLlH3UYcguiqCWKyWXVag5TLTIjR7oOJUY8kcADaZgWPyLeg==",
       "license": "MIT"
     },
     "node_modules/pg-int8": {
@@ -18517,9 +19191,9 @@
       }
     },
     "node_modules/pg-protocol": {
-      "version": "1.14.0",
-      "resolved": "https://registry.npmjs.org/pg-protocol/-/pg-protocol-1.14.0.tgz",
-      "integrity": "sha512-n5taZ1kO3s9ngDTVxsEznOqCyToTgz0FLuPq0B33COy5pPpuWJpY3/2oRBVETuOgzdqRXfWpM9HIhp2LBBT1BA==",
+      "version": "1.15.0",
+      "resolved": "https://registry.npmjs.org/pg-protocol/-/pg-protocol-1.15.0.tgz",
+      "integrity": "sha512-cq9sECI5s0+uPUXjbz8ioyPJni6RzsRib0US67i5IoTZKw8fNeYlVE7u8F4dG7vEJJtc5wdD1K189lCCUwqWTQ==",
       "license": "MIT"
     },
     "node_modules/pg-types": {
@@ -18554,12 +19228,13 @@
       "license": "ISC"
     },
     "node_modules/picomatch": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
+      "devOptional": true,
       "license": "MIT",
       "engines": {
-        "node": ">=12"
+        "node": ">=8.6"
       },
       "funding": {
         "url": "https://github.com/sponsors/jonschlinkert"
@@ -18620,6 +19295,18 @@
         "pino-pretty": "bin.js"
       }
     },
+    "node_modules/pino-pretty/node_modules/strip-json-comments": {
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-5.0.3.tgz",
+      "integrity": "sha512-1tB5mhVo7U+ETBKNf92xT4hrQa3pm0MZ0PQvuDnWgAAGHDsfp4lPSpiS6psrSiet87wyGPh9ft6wmhOMQ0hDiw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/pino-std-serializers": {
       "version": "7.1.0",
       "resolved": "https://registry.npmjs.org/pino-std-serializers/-/pino-std-serializers-7.1.0.tgz",
@@ -18648,13 +19335,13 @@
       }
     },
     "node_modules/playwright": {
-      "version": "1.61.0",
-      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.61.0.tgz",
-      "integrity": "sha512-Z+7BeeqQPRRzklHsVFP4KTGIyMxKUmfeRA4WisM6G3/XW6nwGeX6fX9qYaDa+CiUqpOkb2f6X3nar05R3kSuJQ==",
+      "version": "1.61.1",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.61.1.tgz",
+      "integrity": "sha512-DWnY5o3YbLWK4GovuAVwpqL+1VwGNdUGrRr++8j8PtQQzvAVZUIMjKQ90fY689sEJZJBbZVw1rXaOKSTitkzPQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "playwright-core": "1.61.0"
+        "playwright-core": "1.61.1"
       },
       "bin": {
         "playwright": "cli.js"
@@ -18667,9 +19354,9 @@
       }
     },
     "node_modules/playwright-core": {
-      "version": "1.61.0",
-      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.61.0.tgz",
-      "integrity": "sha512-caX7TrY3Ml6egyDX0WUcTHDxodl/b51y5wJOdCEA36QviK/s2g081hvmGs8eaE3DWb6NYZQ6BjO/QkNRPenoPA==",
+      "version": "1.61.1",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.61.1.tgz",
+      "integrity": "sha512-h7Qlt6m4REp25qvIdvbDtVmD4LqVXfpRxhORv9L0jzETM05p4fuPJ3dKyuSXQxDSbXnmS79HAgi9589lGSpLkg==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
@@ -18696,9 +19383,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.15",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
-      "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
+      "version": "8.5.16",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.16.tgz",
+      "integrity": "sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg==",
       "funding": [
         {
           "type": "opencollective",
@@ -18730,24 +19417,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/postcss/node_modules/nanoid": {
-      "version": "3.3.12",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
-      "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
-      "license": "MIT",
-      "bin": {
-        "nanoid": "bin/nanoid.cjs"
-      },
-      "engines": {
-        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
-      }
-    },
     "node_modules/postgres-array": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/postgres-array/-/postgres-array-2.0.0.tgz",
@@ -18788,12 +19457,12 @@
       }
     },
     "node_modules/posthog-node": {
-      "version": "5.38.0",
-      "resolved": "https://registry.npmjs.org/posthog-node/-/posthog-node-5.38.0.tgz",
-      "integrity": "sha512-xEojUWq7ajYfsMPZIexG9xtvhewpqrPWvL/qRhnm8W3KVZi6BlXHe29tjywZJglrDwEQpqdtYKbRXyg2zF9MWw==",
+      "version": "5.39.4",
+      "resolved": "https://registry.npmjs.org/posthog-node/-/posthog-node-5.39.4.tgz",
+      "integrity": "sha512-+fCQ7htBFRQQFbIzl1T0TA7bDwYyaB9XP308ZFMCUoB5LzTzOFxBa6TYVrxdH/VQl43WXTp6sf0QsG2Z4XlNBg==",
       "license": "MIT",
       "dependencies": {
-        "@posthog/core": "^1.33.0"
+        "@posthog/core": "^1.39.5"
       },
       "engines": {
         "node": "^20.20.0 || >=22.22.0"
@@ -18904,6 +19573,15 @@
       ],
       "license": "MIT"
     },
+    "node_modules/progress": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/progress/-/progress-2.0.3.tgz",
+      "integrity": "sha512-7PiHtLll5LdnKIMw100I+8xJXR5gW2QwWYkT6iJva0bXitZKa/XMrSbdmg3r2Xnaidz9Qumd0VPaMrZlF9V9sA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
     "node_modules/proper-lockfile": {
       "version": "4.1.2",
       "resolved": "https://registry.npmjs.org/proper-lockfile/-/proper-lockfile-4.1.2.tgz",
@@ -18916,16 +19594,6 @@
         "signal-exit": "^3.0.2"
       }
     },
-    "node_modules/proper-lockfile/node_modules/retry": {
-      "version": "0.12.0",
-      "resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz",
-      "integrity": "sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 4"
-      }
-    },
     "node_modules/proper-lockfile/node_modules/signal-exit": {
       "version": "3.0.7",
       "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
@@ -19099,9 +19767,9 @@
       }
     },
     "node_modules/prosemirror-view": {
-      "version": "1.41.9",
-      "resolved": "https://registry.npmjs.org/prosemirror-view/-/prosemirror-view-1.41.9.tgz",
-      "integrity": "sha512-clTunTX+eaLbr87L1V1QPheRlEQJyTlL3gXe9x3jQIk3rL0RVWxviDGz8tFaydwIVm+hKhYCyr+R/zBtWr9s6A==",
+      "version": "1.42.0",
+      "resolved": "https://registry.npmjs.org/prosemirror-view/-/prosemirror-view-1.42.0.tgz",
+      "integrity": "sha512-N54DF3OXNWDuP81G1kbfCys8ZzIjuL1VnvJ2mk5STSu/fNxWIcX/EutQLA3s9KR/2wVhgDi4hzBB/1fINVxk0A==",
       "license": "MIT",
       "dependencies": {
         "prosemirror-model": "^1.25.8",
@@ -19177,12 +19845,13 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.15.2",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz",
-      "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==",
+      "version": "6.15.3",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz",
+      "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==",
       "license": "BSD-3-Clause",
       "dependencies": {
-        "side-channel": "^1.1.0"
+        "es-define-property": "^1.0.1",
+        "side-channel": "^1.1.1"
       },
       "engines": {
         "node": ">=0.6"
@@ -19236,66 +19905,66 @@
       "license": "MIT"
     },
     "node_modules/radix-ui": {
-      "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/radix-ui/-/radix-ui-1.6.0.tgz",
-      "integrity": "sha512-EUEC70O03EgxWMP5aoqfBZ6iLC5bczFagGy7zhSYRt8o5DP7IWNiP3ywetse3L9b8843ExB0OGWZvgbYVJuNeg==",
+      "version": "1.6.1",
+      "resolved": "https://registry.npmjs.org/radix-ui/-/radix-ui-1.6.1.tgz",
+      "integrity": "sha512-QXDXJtB6sK83mLASONYUZCauatcWb+knFviFpN1EhtdbbmlsRmzCLrbZSKztnNiem2KOHIBbiDbauVB7SORXMw==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
-        "@radix-ui/react-accessible-icon": "1.1.10",
-        "@radix-ui/react-accordion": "1.2.14",
-        "@radix-ui/react-alert-dialog": "1.1.17",
-        "@radix-ui/react-arrow": "1.1.10",
-        "@radix-ui/react-aspect-ratio": "1.1.10",
-        "@radix-ui/react-avatar": "1.2.0",
-        "@radix-ui/react-checkbox": "1.3.5",
-        "@radix-ui/react-collapsible": "1.1.14",
-        "@radix-ui/react-collection": "1.1.10",
+        "@radix-ui/react-accessible-icon": "1.1.11",
+        "@radix-ui/react-accordion": "1.2.15",
+        "@radix-ui/react-alert-dialog": "1.1.18",
+        "@radix-ui/react-arrow": "1.1.11",
+        "@radix-ui/react-aspect-ratio": "1.1.11",
+        "@radix-ui/react-avatar": "1.2.1",
+        "@radix-ui/react-checkbox": "1.3.6",
+        "@radix-ui/react-collapsible": "1.1.15",
+        "@radix-ui/react-collection": "1.1.11",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
-        "@radix-ui/react-context-menu": "2.3.1",
-        "@radix-ui/react-dialog": "1.1.17",
+        "@radix-ui/react-context-menu": "2.3.2",
+        "@radix-ui/react-dialog": "1.1.18",
         "@radix-ui/react-direction": "1.1.2",
-        "@radix-ui/react-dismissable-layer": "1.1.13",
-        "@radix-ui/react-dropdown-menu": "2.1.18",
+        "@radix-ui/react-dismissable-layer": "1.1.14",
+        "@radix-ui/react-dropdown-menu": "2.1.19",
         "@radix-ui/react-focus-guards": "1.1.4",
-        "@radix-ui/react-focus-scope": "1.1.10",
-        "@radix-ui/react-form": "0.1.10",
-        "@radix-ui/react-hover-card": "1.1.17",
-        "@radix-ui/react-label": "2.1.10",
-        "@radix-ui/react-menu": "2.1.18",
-        "@radix-ui/react-menubar": "1.1.18",
-        "@radix-ui/react-navigation-menu": "1.2.16",
-        "@radix-ui/react-one-time-password-field": "0.1.10",
-        "@radix-ui/react-password-toggle-field": "0.1.5",
-        "@radix-ui/react-popover": "1.1.17",
-        "@radix-ui/react-popper": "1.3.1",
-        "@radix-ui/react-portal": "1.1.12",
+        "@radix-ui/react-focus-scope": "1.1.11",
+        "@radix-ui/react-form": "0.1.11",
+        "@radix-ui/react-hover-card": "1.1.18",
+        "@radix-ui/react-label": "2.1.11",
+        "@radix-ui/react-menu": "2.1.19",
+        "@radix-ui/react-menubar": "1.1.19",
+        "@radix-ui/react-navigation-menu": "1.2.17",
+        "@radix-ui/react-one-time-password-field": "0.1.11",
+        "@radix-ui/react-password-toggle-field": "0.1.6",
+        "@radix-ui/react-popover": "1.1.18",
+        "@radix-ui/react-popper": "1.3.2",
+        "@radix-ui/react-portal": "1.1.13",
         "@radix-ui/react-presence": "1.1.6",
-        "@radix-ui/react-primitive": "2.1.6",
-        "@radix-ui/react-progress": "1.1.10",
-        "@radix-ui/react-radio-group": "1.4.1",
-        "@radix-ui/react-roving-focus": "1.1.13",
-        "@radix-ui/react-scroll-area": "1.2.12",
-        "@radix-ui/react-select": "2.3.1",
-        "@radix-ui/react-separator": "1.1.10",
-        "@radix-ui/react-slider": "1.4.1",
+        "@radix-ui/react-primitive": "2.1.7",
+        "@radix-ui/react-progress": "1.1.11",
+        "@radix-ui/react-radio-group": "1.4.2",
+        "@radix-ui/react-roving-focus": "1.1.14",
+        "@radix-ui/react-scroll-area": "1.2.13",
+        "@radix-ui/react-select": "2.3.2",
+        "@radix-ui/react-separator": "1.1.11",
+        "@radix-ui/react-slider": "1.4.2",
         "@radix-ui/react-slot": "1.3.0",
-        "@radix-ui/react-switch": "1.3.1",
-        "@radix-ui/react-tabs": "1.1.15",
-        "@radix-ui/react-toast": "1.2.17",
-        "@radix-ui/react-toggle": "1.1.12",
-        "@radix-ui/react-toggle-group": "1.1.13",
-        "@radix-ui/react-toolbar": "1.1.13",
-        "@radix-ui/react-tooltip": "1.2.10",
+        "@radix-ui/react-switch": "1.3.2",
+        "@radix-ui/react-tabs": "1.1.16",
+        "@radix-ui/react-toast": "1.2.18",
+        "@radix-ui/react-toggle": "1.1.13",
+        "@radix-ui/react-toggle-group": "1.1.14",
+        "@radix-ui/react-toolbar": "1.1.14",
+        "@radix-ui/react-tooltip": "1.2.11",
         "@radix-ui/react-use-callback-ref": "1.1.2",
         "@radix-ui/react-use-controllable-state": "1.2.3",
         "@radix-ui/react-use-effect-event": "0.0.3",
-        "@radix-ui/react-use-escape-keydown": "1.1.2",
+        "@radix-ui/react-use-escape-keydown": "1.1.3",
         "@radix-ui/react-use-is-hydrated": "0.1.1",
         "@radix-ui/react-use-layout-effect": "1.1.2",
         "@radix-ui/react-use-size": "1.1.2",
-        "@radix-ui/react-visually-hidden": "1.2.6"
+        "@radix-ui/react-visually-hidden": "1.2.7"
       },
       "peerDependencies": {
         "@types/react": "*",
@@ -19313,12 +19982,16 @@
       }
     },
     "node_modules/range-parser": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
-      "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==",
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.3.0.tgz",
+      "integrity": "sha512-hek2mFQpPuI4E1BBKrSto+BU3e3x4xuarsbiwr3+lf7p44juvFMV0XFWQAP3xUyqXA4RrXLIoaSUGbSt056ZMw==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/raw-body": {
@@ -19359,20 +20032,10 @@
       "devOptional": true,
       "license": "ISC"
     },
-    "node_modules/rc/node_modules/strip-json-comments": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
-      "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
-      "devOptional": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/react": {
-      "version": "19.2.7",
-      "resolved": "https://registry.npmjs.org/react/-/react-19.2.7.tgz",
-      "integrity": "sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==",
+      "version": "19.2.6",
+      "resolved": "https://registry.npmjs.org/react/-/react-19.2.6.tgz",
+      "integrity": "sha512-sfWGGfavi0xr8Pg0sVsyHMAOziVYKgPLNrS7ig+ivMNb3wbCBw3KxtflsGBAwD3gYQlE/AEZsTLgToRrSCjb0Q==",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -19429,6 +20092,28 @@
         "react": "^19.2.7"
       }
     },
+    "node_modules/react-is": {
+      "version": "19.2.7",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-19.2.7.tgz",
+      "integrity": "sha512-kZFnouyVv7eP/Phmrlo9FK+zcAdriZJvzxXHF1Sl1P377WSGe2G/JxVolhTrB/jeV47lKImhNUsijjHAAbcl/A==",
+      "license": "MIT"
+    },
+    "node_modules/react-reconciler": {
+      "version": "0.33.0",
+      "resolved": "https://registry.npmjs.org/react-reconciler/-/react-reconciler-0.33.0.tgz",
+      "integrity": "sha512-KetWRytFv1epdpJc3J4G75I4WrplZE5jOL7Yq0p34+OVOKF4Se7WrdIdVC45XsSSmUTlht2FM/fM1FZb1mfQeA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "scheduler": "^0.27.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      },
+      "peerDependencies": {
+        "react": "^19.2.0"
+      }
+    },
     "node_modules/react-redux": {
       "version": "9.3.0",
       "resolved": "https://registry.npmjs.org/react-redux/-/react-redux-9.3.0.tgz",
@@ -19500,9 +20185,9 @@
       }
     },
     "node_modules/react-resizable-panels": {
-      "version": "4.11.2",
-      "resolved": "https://registry.npmjs.org/react-resizable-panels/-/react-resizable-panels-4.11.2.tgz",
-      "integrity": "sha512-+kfFbDZ8mygc7g0vxOcDzCVGuwiIUOnILqPoUHo6/uP+Mmyx6HzZU+kj1aOPDlktXuobYbr6BtQekvJwHRX4Eg==",
+      "version": "4.12.1",
+      "resolved": "https://registry.npmjs.org/react-resizable-panels/-/react-resizable-panels-4.12.1.tgz",
+      "integrity": "sha512-ElE/UpOvMLRWtAqbCgyizHXcbws8RPMyN3cBqmdY17Nxr5f01+DEwzOLqhgcy68GSnjtIUFgKWKl8aIgx5aypQ==",
       "license": "MIT",
       "peerDependencies": {
         "react": "^18.0.0 || ^19.0.0",
@@ -19594,9 +20279,9 @@
       }
     },
     "node_modules/recharts": {
-      "version": "3.8.1",
-      "resolved": "https://registry.npmjs.org/recharts/-/recharts-3.8.1.tgz",
-      "integrity": "sha512-mwzmO1s9sFL0TduUpwndxCUNoXsBw3u3E/0+A+cLcrSfQitSG62L32N69GhqUrrT5qKcAE3pCGVINC6pqkBBQg==",
+      "version": "3.9.2",
+      "resolved": "https://registry.npmjs.org/recharts/-/recharts-3.9.2.tgz",
+      "integrity": "sha512-G4fy+Pk46RaXgwWMh+Nzhyo/lbFAVqXo9gtetlyehe6Ehge9CsgDuOTwQDD+i1+llaLktNBiNq4bhnGlDRXFtw==",
       "license": "MIT",
       "workspaces": [
         "www"
@@ -19607,9 +20292,9 @@
         "decimal.js-light": "^2.5.1",
         "es-toolkit": "^1.39.3",
         "eventemitter3": "^5.0.1",
-        "immer": "^10.1.1",
+        "immer": "^11.1.8",
         "react-redux": "8.x.x || 9.x.x",
-        "reselect": "5.1.1",
+        "reselect": "5.2.0",
         "tiny-invariant": "^1.3.3",
         "use-sync-external-store": "^1.2.2",
         "victory-vendor": "^37.0.2"
@@ -19623,12 +20308,6 @@
         "react-is": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
       }
     },
-    "node_modules/recharts/node_modules/reselect": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/reselect/-/reselect-5.1.1.tgz",
-      "integrity": "sha512-K/BG6eIky/SBpzfHZv/dd+9JBFiS4SWV7FIujVyJRux6e45+73RaUHXLmIR1f7WOMaQ0U1km6qwklRQxpJJY0w==",
-      "license": "MIT"
-    },
     "node_modules/recma-build-jsx": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/recma-build-jsx/-/recma-build-jsx-1.0.0.tgz",
@@ -19710,6 +20389,16 @@
         "node": ">=8"
       }
     },
+    "node_modules/redent/node_modules/indent-string": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/indent-string/-/indent-string-4.0.0.tgz",
+      "integrity": "sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/redux": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/redux/-/redux-5.0.1.tgz",
@@ -19873,9 +20562,9 @@
       }
     },
     "node_modules/remark-cjk-friendly": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/remark-cjk-friendly/-/remark-cjk-friendly-2.2.0.tgz",
-      "integrity": "sha512-tJ+FkYnE6I+rl6DIQEarJLwvATHPmIE88ac0NWZjB24WR7hdwowvnystZK+df4mC53x0OJEtiexlKbFn9Zz0hA==",
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/remark-cjk-friendly/-/remark-cjk-friendly-2.3.1.tgz",
+      "integrity": "sha512-f+pKZRxCRwNEGFBKNRAZAqU91GIK1SAo3ZyFHWRUgC9zcxRR0BXKd6YwqgSsxtW0rNpUDtONj7H5nje2WL3fcA==",
       "license": "MIT",
       "dependencies": {
         "mdast-util-to-markdown-cjk-friendly": "1.0.0",
@@ -19895,9 +20584,9 @@
       }
     },
     "node_modules/remark-cjk-friendly-gfm-strikethrough": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/remark-cjk-friendly-gfm-strikethrough/-/remark-cjk-friendly-gfm-strikethrough-2.2.0.tgz",
-      "integrity": "sha512-sj+Jobl4pUmaE539dxuEBntTgkafi/Adl816dBdbpzyPe3n3DceTYokXFGtwX2vjfR4wv8yFJSZac5VUDzjocw==",
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/remark-cjk-friendly-gfm-strikethrough/-/remark-cjk-friendly-gfm-strikethrough-2.3.1.tgz",
+      "integrity": "sha512-JE3TGgouk/sy92SemNMEUhO5mNP4on04cmzOV3s3R5Dbk160ewmpM4tgPiinKKvoJ5UW2fTu7FOYsjVbusSA9w==",
       "license": "MIT",
       "dependencies": {
         "mdast-util-to-markdown-cjk-friendly-gfm-strikethrough": "1.0.0",
@@ -20076,26 +20765,34 @@
       }
     },
     "node_modules/restore-cursor": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/restore-cursor/-/restore-cursor-5.1.0.tgz",
-      "integrity": "sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA==",
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/restore-cursor/-/restore-cursor-4.0.0.tgz",
+      "integrity": "sha512-I9fPXU9geO9bHOt9pHHOhOkYerIMsmVaWB0rA2AI9ERh/+x/i7MV5HKBNrg+ljO5eoPVgCcnFuRjJ9uH6I/3eg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "onetime": "^7.0.0",
-        "signal-exit": "^4.1.0"
+        "onetime": "^5.1.0",
+        "signal-exit": "^3.0.2"
       },
       "engines": {
-        "node": ">=18"
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/restore-cursor/node_modules/signal-exit": {
+      "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
+      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
+      "dev": true,
+      "license": "ISC"
+    },
     "node_modules/retry": {
-      "version": "0.13.1",
-      "resolved": "https://registry.npmjs.org/retry/-/retry-0.13.1.tgz",
-      "integrity": "sha512-XQBQ3I8W1Cge0Seh+6gjj03LbmRFWuoszgK9ooCpwYIrhhoO80pfq4cUkU5DkknwfOfFteRwlZ56PYOGYyFWdg==",
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz",
+      "integrity": "sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">= 4"
@@ -20133,13 +20830,13 @@
       "license": "Unlicense"
     },
     "node_modules/rolldown": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.3.tgz",
-      "integrity": "sha512-i00lAJ2ks1BYr7rjNjKC7BcqAS7nVfiT3QX1SI5aY+AFHblCmaUf9OE9dbdzDvW6dJxbi2ZCZiy9v3CcwOiX3g==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.1.4.tgz",
+      "integrity": "sha512-IjZYiLxZwpnhwhdBH2ugdTGVSdhCQUmLxLoqyjiL0JxYjyRst+5a0P3xfrTxJ5F638j4Mvvw5FAX5XE6eHpXbA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@oxc-project/types": "=0.133.0",
+        "@oxc-project/types": "=0.138.0",
         "@rolldown/pluginutils": "^1.0.0"
       },
       "bin": {
@@ -20149,27 +20846,27 @@
         "node": "^20.19.0 || >=22.12.0"
       },
       "optionalDependencies": {
-        "@rolldown/binding-android-arm64": "1.0.3",
-        "@rolldown/binding-darwin-arm64": "1.0.3",
-        "@rolldown/binding-darwin-x64": "1.0.3",
-        "@rolldown/binding-freebsd-x64": "1.0.3",
-        "@rolldown/binding-linux-arm-gnueabihf": "1.0.3",
-        "@rolldown/binding-linux-arm64-gnu": "1.0.3",
-        "@rolldown/binding-linux-arm64-musl": "1.0.3",
-        "@rolldown/binding-linux-ppc64-gnu": "1.0.3",
-        "@rolldown/binding-linux-s390x-gnu": "1.0.3",
-        "@rolldown/binding-linux-x64-gnu": "1.0.3",
-        "@rolldown/binding-linux-x64-musl": "1.0.3",
-        "@rolldown/binding-openharmony-arm64": "1.0.3",
-        "@rolldown/binding-wasm32-wasi": "1.0.3",
-        "@rolldown/binding-win32-arm64-msvc": "1.0.3",
-        "@rolldown/binding-win32-x64-msvc": "1.0.3"
+        "@rolldown/binding-android-arm64": "1.1.4",
+        "@rolldown/binding-darwin-arm64": "1.1.4",
+        "@rolldown/binding-darwin-x64": "1.1.4",
+        "@rolldown/binding-freebsd-x64": "1.1.4",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.1.4",
+        "@rolldown/binding-linux-arm64-gnu": "1.1.4",
+        "@rolldown/binding-linux-arm64-musl": "1.1.4",
+        "@rolldown/binding-linux-ppc64-gnu": "1.1.4",
+        "@rolldown/binding-linux-s390x-gnu": "1.1.4",
+        "@rolldown/binding-linux-x64-gnu": "1.1.4",
+        "@rolldown/binding-linux-x64-musl": "1.1.4",
+        "@rolldown/binding-openharmony-arm64": "1.1.4",
+        "@rolldown/binding-wasm32-wasi": "1.1.4",
+        "@rolldown/binding-win32-arm64-msvc": "1.1.4",
+        "@rolldown/binding-win32-x64-msvc": "1.1.4"
       }
     },
     "node_modules/rollup": {
-      "version": "4.62.0",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.62.0.tgz",
-      "integrity": "sha512-nc72Wgq62I7rtDV4izT5/aaS0zxy3kttkinf9586ApknY3jZO9NYsmtc24fUckA0X7Q2v+ML4a15pdUlV5V/jA==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.62.2.tgz",
+      "integrity": "sha512-RFnrW4lhXA3s3eqHDZvN654g8OTjzRfqpIRJYczCGB6HzphckVAi/Qh4tbPUbRuDi7s1Llv8g/NspLkttY3gTA==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -20183,31 +20880,31 @@
         "npm": ">=8.0.0"
       },
       "optionalDependencies": {
-        "@rollup/rollup-android-arm-eabi": "4.62.0",
-        "@rollup/rollup-android-arm64": "4.62.0",
-        "@rollup/rollup-darwin-arm64": "4.62.0",
-        "@rollup/rollup-darwin-x64": "4.62.0",
-        "@rollup/rollup-freebsd-arm64": "4.62.0",
-        "@rollup/rollup-freebsd-x64": "4.62.0",
-        "@rollup/rollup-linux-arm-gnueabihf": "4.62.0",
-        "@rollup/rollup-linux-arm-musleabihf": "4.62.0",
-        "@rollup/rollup-linux-arm64-gnu": "4.62.0",
-        "@rollup/rollup-linux-arm64-musl": "4.62.0",
-        "@rollup/rollup-linux-loong64-gnu": "4.62.0",
-        "@rollup/rollup-linux-loong64-musl": "4.62.0",
-        "@rollup/rollup-linux-ppc64-gnu": "4.62.0",
-        "@rollup/rollup-linux-ppc64-musl": "4.62.0",
-        "@rollup/rollup-linux-riscv64-gnu": "4.62.0",
-        "@rollup/rollup-linux-riscv64-musl": "4.62.0",
-        "@rollup/rollup-linux-s390x-gnu": "4.62.0",
-        "@rollup/rollup-linux-x64-gnu": "4.62.0",
-        "@rollup/rollup-linux-x64-musl": "4.62.0",
-        "@rollup/rollup-openbsd-x64": "4.62.0",
-        "@rollup/rollup-openharmony-arm64": "4.62.0",
-        "@rollup/rollup-win32-arm64-msvc": "4.62.0",
-        "@rollup/rollup-win32-ia32-msvc": "4.62.0",
-        "@rollup/rollup-win32-x64-gnu": "4.62.0",
-        "@rollup/rollup-win32-x64-msvc": "4.62.0",
+        "@rollup/rollup-android-arm-eabi": "4.62.2",
+        "@rollup/rollup-android-arm64": "4.62.2",
+        "@rollup/rollup-darwin-arm64": "4.62.2",
+        "@rollup/rollup-darwin-x64": "4.62.2",
+        "@rollup/rollup-freebsd-arm64": "4.62.2",
+        "@rollup/rollup-freebsd-x64": "4.62.2",
+        "@rollup/rollup-linux-arm-gnueabihf": "4.62.2",
+        "@rollup/rollup-linux-arm-musleabihf": "4.62.2",
+        "@rollup/rollup-linux-arm64-gnu": "4.62.2",
+        "@rollup/rollup-linux-arm64-musl": "4.62.2",
+        "@rollup/rollup-linux-loong64-gnu": "4.62.2",
+        "@rollup/rollup-linux-loong64-musl": "4.62.2",
+        "@rollup/rollup-linux-ppc64-gnu": "4.62.2",
+        "@rollup/rollup-linux-ppc64-musl": "4.62.2",
+        "@rollup/rollup-linux-riscv64-gnu": "4.62.2",
+        "@rollup/rollup-linux-riscv64-musl": "4.62.2",
+        "@rollup/rollup-linux-s390x-gnu": "4.62.2",
+        "@rollup/rollup-linux-x64-gnu": "4.62.2",
+        "@rollup/rollup-linux-x64-musl": "4.62.2",
+        "@rollup/rollup-openbsd-x64": "4.62.2",
+        "@rollup/rollup-openharmony-arm64": "4.62.2",
+        "@rollup/rollup-win32-arm64-msvc": "4.62.2",
+        "@rollup/rollup-win32-ia32-msvc": "4.62.2",
+        "@rollup/rollup-win32-x64-gnu": "4.62.2",
+        "@rollup/rollup-win32-x64-msvc": "4.62.2",
         "fsevents": "~2.3.2"
       }
     },
@@ -20231,6 +20928,13 @@
         "rollup": "^1.20.0 || ^2.0.0 || ^3.0.0 || ^4.0.0"
       }
     },
+    "node_modules/rollup-plugin-esbuild/node_modules/es-module-lexer": {
+      "version": "1.7.0",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.7.0.tgz",
+      "integrity": "sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==",
+      "devOptional": true,
+      "license": "MIT"
+    },
     "node_modules/rope-sequence": {
       "version": "1.3.4",
       "resolved": "https://registry.npmjs.org/rope-sequence/-/rope-sequence-1.3.4.tgz",
@@ -20430,9 +21134,9 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/semver": {
-      "version": "7.8.4",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.4.tgz",
-      "integrity": "sha512-rUCObTnP32Q08R2uuIrt7r9PlEonuTmtuXYcW6s5kjdlj3xbnwe+21yXptAUYcMAABLkYYTtnmzb3w3EDZfueA==",
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -20467,13 +21171,40 @@
         "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/sentiment": {
-      "version": "5.0.2",
-      "resolved": "https://registry.npmjs.org/sentiment/-/sentiment-5.0.2.tgz",
-      "integrity": "sha512-ZeC3y0JsOYTdwujt5uOd7ILJNilbgFzUtg/LEG4wUv43LayFNLZ28ec8+Su+h3saHlJmIwYxBzfDHHZuiMA15g==",
-      "license": "MIT",
+    "node_modules/sentiment": {
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/sentiment/-/sentiment-5.0.2.tgz",
+      "integrity": "sha512-ZeC3y0JsOYTdwujt5uOd7ILJNilbgFzUtg/LEG4wUv43LayFNLZ28ec8+Su+h3saHlJmIwYxBzfDHHZuiMA15g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8.0"
+      }
+    },
+    "node_modules/serialize-error": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/serialize-error/-/serialize-error-8.1.0.tgz",
+      "integrity": "sha512-3NnuWfM6vBYoy5gZFvHiYsVbafvI9vZv/+jlIigFn4oP4zjNPK3LhcY0xSCgeb1a5L8jO71Mit9LlNoi2UfDDQ==",
+      "license": "MIT",
+      "dependencies": {
+        "type-fest": "^0.20.2"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/serialize-error/node_modules/type-fest": {
+      "version": "0.20.2",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz",
+      "integrity": "sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==",
+      "license": "(MIT OR CC0-1.0)",
       "engines": {
-        "node": ">=8.0"
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
     "node_modules/serve": {
@@ -20741,9 +21472,9 @@
       }
     },
     "node_modules/shell-quote": {
-      "version": "1.8.4",
-      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz",
-      "integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==",
+      "version": "1.9.0",
+      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.9.0.tgz",
+      "integrity": "sha512-Iov+JwFv/2HcTpcwNMKd8+IWNb8tboQJNQTkAY/LLVK7gGH9jy+LGkVqPxfekHl+yMmiqXszdGWXgkfml7hjqA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -20939,6 +21670,23 @@
         "node": ">=6"
       }
     },
+    "node_modules/slice-ansi": {
+      "version": "9.0.0",
+      "resolved": "https://registry.npmjs.org/slice-ansi/-/slice-ansi-9.0.0.tgz",
+      "integrity": "sha512-SO/3iYL5S3W57LLEniscOGPZgOqZUPCx6d3dB+52B80yJ0XstzsC/eV8gnA4tM3MHDrKz+OCFSLNjswdSC+/bA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^6.2.3",
+        "is-fullwidth-code-point": "^5.1.0"
+      },
+      "engines": {
+        "node": ">=22"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/slice-ansi?sponsor=1"
+      }
+    },
     "node_modules/socket.io-client": {
       "version": "4.8.3",
       "resolved": "https://registry.npmjs.org/socket.io-client/-/socket.io-client-4.8.3.tgz",
@@ -20987,12 +21735,13 @@
       }
     },
     "node_modules/source-map": {
-      "version": "0.7.6",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.7.6.tgz",
-      "integrity": "sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ==",
+      "version": "0.6.1",
+      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
+      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
+      "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
-        "node": ">= 12"
+        "node": ">=0.10.0"
       }
     },
     "node_modules/source-map-js": {
@@ -21015,16 +21764,6 @@
         "source-map": "^0.6.0"
       }
     },
-    "node_modules/source-map-support/node_modules/source-map": {
-      "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/space-separated-tokens": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/space-separated-tokens/-/space-separated-tokens-2.0.2.tgz",
@@ -21050,6 +21789,29 @@
       "integrity": "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==",
       "license": "BSD-3-Clause"
     },
+    "node_modules/stack-utils": {
+      "version": "2.0.6",
+      "resolved": "https://registry.npmjs.org/stack-utils/-/stack-utils-2.0.6.tgz",
+      "integrity": "sha512-XlkWvfIm6RmsWtNJx+uqtKLS8eqFbxUg0ZzLXqY0caEy9l7hruX8IpiDnjsLavoBgqCCR71TqWO8MaXYheJ3RQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "escape-string-regexp": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/stack-utils/node_modules/escape-string-regexp": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-2.0.0.tgz",
+      "integrity": "sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/stackback": {
       "version": "0.0.2",
       "resolved": "https://registry.npmjs.org/stackback/-/stackback-0.0.2.tgz",
@@ -21217,6 +21979,15 @@
         "node": ">=8"
       }
     },
+    "node_modules/string-width-cjs/node_modules/is-fullwidth-code-point": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/string-width-cjs/node_modules/strip-ansi": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
@@ -21238,6 +22009,15 @@
         "node": ">=8"
       }
     },
+    "node_modules/string-width/node_modules/is-fullwidth-code-point": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/string-width/node_modules/strip-ansi": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
@@ -21336,15 +22116,13 @@
       }
     },
     "node_modules/strip-json-comments": {
-      "version": "5.0.3",
-      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-5.0.3.tgz",
-      "integrity": "sha512-1tB5mhVo7U+ETBKNf92xT4hrQa3pm0MZ0PQvuDnWgAAGHDsfp4lPSpiS6psrSiet87wyGPh9ft6wmhOMQ0hDiw==",
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
+      "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
+      "devOptional": true,
       "license": "MIT",
       "engines": {
-        "node": ">=14.16"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "node": ">=0.10.0"
       }
     },
     "node_modules/stubborn-fs": {
@@ -21485,9 +22263,9 @@
       }
     },
     "node_modules/swr": {
-      "version": "2.4.1",
-      "resolved": "https://registry.npmjs.org/swr/-/swr-2.4.1.tgz",
-      "integrity": "sha512-2CC6CiKQtEwaEeNiqWTAw9PGykW8SR5zZX8MZk6TeAvEAnVS7Visz8WzphqgtQ8v2xz/4Q5K+j+SeMaKXeeQIA==",
+      "version": "2.4.2",
+      "resolved": "https://registry.npmjs.org/swr/-/swr-2.4.2.tgz",
+      "integrity": "sha512-ej644Y2bvkIajfR32KGeSSdBXQW+ScjGjkybZgSE7kFpk9eGnV44XY9FJylXi+W75pavSX1PVNB57W5EbhGIYw==",
       "license": "MIT",
       "dependencies": {
         "dequal": "^2.0.3",
@@ -21504,6 +22282,19 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/tagged-tag": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/tagged-tag/-/tagged-tag-1.0.0.tgz",
+      "integrity": "sha512-yEFYrVhod+hdNyx7g5Bnkkb0G6si8HJurOoOEgC8B/O0uXLHlaey/65KRv6cuWBNhBgHKAROVpc7QyYqE5gFng==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/tailwind-merge": {
       "version": "3.6.0",
       "resolved": "https://registry.npmjs.org/tailwind-merge/-/tailwind-merge-3.6.0.tgz",
@@ -21515,9 +22306,9 @@
       }
     },
     "node_modules/tailwindcss": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.3.1.tgz",
-      "integrity": "sha512-hk+TB1m+K8CYNrP6rjQaq/Y+4Zylwpa87mLYBKCunwnnQ9p+fHb7kmSfGqyEJoxF/O6CDyABWVFEafNSYKll+Q==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.3.2.tgz",
+      "integrity": "sha512-WtctNNSH8A9jlMIqxzuYumOHU5uGZyRv0Q5svQl+oEPy5w84YpBxdb7MdqyiSPQge5jTJ6zFQLq0PFygdccSBA==",
       "dev": true,
       "license": "MIT"
     },
@@ -21535,10 +22326,26 @@
         "url": "https://opencollective.com/webpack"
       }
     },
+    "node_modules/tar": {
+      "version": "7.5.19",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.19.tgz",
+      "integrity": "sha512-4LeEWl96twnS2Q7Bz4MGqgazLqO+hJN63GZxXoIqh1T3VweYD997gbU1ItNsQafqqXTXd5WFyFdReLtwvRBNiw==",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "@isaacs/fs-minipass": "^4.0.0",
+        "chownr": "^3.0.0",
+        "minipass": "^7.1.2",
+        "minizlib": "^3.1.0",
+        "yallist": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/tar-fs": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz",
-      "integrity": "sha512-mDAjwmZdh7LTT6pNleZ05Yt65HC3E+NiQzl672vQG38jIrehtJk/J3mNwIg+vShQPcLF/LV7CMnDW6vjj6sfYQ==",
+      "version": "2.1.5",
+      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.5.tgz",
+      "integrity": "sha512-OboTd8mmMhZDNPV+UjQcK9yKAatXu2aJ+r1w4im1Otd4M4fl2hwvdoXUxIYHFTHWK/3y3FarBP70v3vwmGlOxw==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -21548,6 +22355,13 @@
         "tar-stream": "^2.1.4"
       }
     },
+    "node_modules/tar-fs/node_modules/chownr": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
+      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
+      "license": "ISC",
+      "optional": true
+    },
     "node_modules/tar-fs/node_modules/readable-stream": {
       "version": "3.6.2",
       "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
@@ -21603,6 +22417,19 @@
         "streamx": "^2.12.5"
       }
     },
+    "node_modules/terminal-size": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/terminal-size/-/terminal-size-4.0.1.tgz",
+      "integrity": "sha512-avMLDQpUI9I5XFrklECw1ZEUPJhqzcwSWsyyI8blhRLT+8N1jLJWLWWYQpB2q2xthq8xDvjZPISVh53T/+CLYQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/text-decoder": {
       "version": "1.2.7",
       "resolved": "https://registry.npmjs.org/text-decoder/-/text-decoder-1.2.7.tgz",
@@ -21681,6 +22508,18 @@
         "url": "https://github.com/sponsors/SuperchupuDev"
       }
     },
+    "node_modules/tinyglobby/node_modules/picomatch": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
+      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "node_modules/tinyrainbow": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.1.0.tgz",
@@ -21692,22 +22531,22 @@
       }
     },
     "node_modules/tldts": {
-      "version": "7.4.3",
-      "resolved": "https://registry.npmjs.org/tldts/-/tldts-7.4.3.tgz",
-      "integrity": "sha512-A3BDQBeeukYPzB4QdQ1DtdlUmp4x2OCH8n5UVhEWbyANxNep8GavottKzd1xYKFJKjUgMyPT7EzOfnBO55s8Sg==",
+      "version": "7.4.6",
+      "resolved": "https://registry.npmjs.org/tldts/-/tldts-7.4.6.tgz",
+      "integrity": "sha512-rbP0Gyx8b3Ae9yO//CU2wbSnQNoQ66m1nJdSbSHmnwKwzkkz/u8mERYU8T2rmlmy+bJvRNn84yNCW8gYqox44Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "tldts-core": "^7.4.3"
+        "tldts-core": "^7.4.6"
       },
       "bin": {
         "tldts": "bin/cli.js"
       }
     },
     "node_modules/tldts-core": {
-      "version": "7.4.3",
-      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-7.4.3.tgz",
-      "integrity": "sha512-27ep5H9PzdBrNd5OFM/j3WCU8F3kPwM9D0BOaOf7uYfxMJfyr0K5Tjj69Gri+sZlh2WXd5buIm47NuPF29CDiw==",
+      "version": "7.4.6",
+      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-7.4.6.tgz",
+      "integrity": "sha512-TkQNGJIhlEphpHCjKodMTSe23egUZr/g+flI2qkLgiJ/maAzSgXypSLRTNH3nCmqgayEmtcJBiLcfODSAr1xoA==",
       "dev": true,
       "license": "MIT"
     },
@@ -21735,9 +22574,9 @@
       }
     },
     "node_modules/toad-cache": {
-      "version": "3.7.1",
-      "resolved": "https://registry.npmjs.org/toad-cache/-/toad-cache-3.7.1.tgz",
-      "integrity": "sha512-5DXWzE4Vz7xNHsv+xQ+MGfJYyC78Aok3tEr0MNwHoRf7vZnga1mQXZ4/Nsodld4VR6Wd+VhfmqnNrsRJyYPfrQ==",
+      "version": "3.7.4",
+      "resolved": "https://registry.npmjs.org/toad-cache/-/toad-cache-3.7.4.tgz",
+      "integrity": "sha512-m1TdR/rvT7kgGJZhspNtXdsdYk0fddFpJJFlG5s+UkPFo6lkLoZ3YLOaovPYjq1R75NP5JfeTlSHaOsE09peCg==",
       "license": "MIT",
       "engines": {
         "node": ">=20"
@@ -21836,9 +22675,9 @@
       "license": "0BSD"
     },
     "node_modules/tsx": {
-      "version": "4.22.4",
-      "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.22.4.tgz",
-      "integrity": "sha512-X8EX+XV4QR5xCsrgxaED954zTDfY8KqlDtskKEL0cHhyS/P8b4IFOvGDQpsC9Q1XnLq915wEfwwY/zzskCtmhg==",
+      "version": "4.23.0",
+      "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.23.0.tgz",
+      "integrity": "sha512-eUdUIaCr963q2h5u3+QwvYp0+eqPvn+egeqZUm0hwERCqqx1E3kK5ehbGCvqSE5MQAULr67ww0cA3jKc3YkM1w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21966,9 +22805,9 @@
       }
     },
     "node_modules/uc.micro": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/uc.micro/-/uc.micro-2.1.0.tgz",
-      "integrity": "sha512-ARDJmphmdvUk6Glw7y9DQ2bFkKBHwQHLi2lsaH6PPmz/Ka9sFOBsBluozhDltWmnv9u/cF6Rt87znRTPV+yp/A==",
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/uc.micro/-/uc.micro-1.0.6.tgz",
+      "integrity": "sha512-8Y75pvTYkLJW2hWQHXxoqRgV7qb9B+9vFEtidML+7koHUFapnVJAZ6cKs+Qjz5Aw3aZWHMC6u0wJE3At+nSGwA==",
       "license": "MIT"
     },
     "node_modules/ufo": {
@@ -22006,12 +22845,13 @@
       }
     },
     "node_modules/undici": {
-      "version": "6.24.1",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.24.1.tgz",
-      "integrity": "sha512-sC+b0tB1whOCzbtlx20fx3WgCXwkW627p4EA9uM+/tNNPkSS+eSEld6pAs9nDv7WbY1UUljBMYPtu9BCOrCWKA==",
+      "version": "7.28.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.28.0.tgz",
+      "integrity": "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==",
+      "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=18.17"
+        "node": ">=20.18.1"
       }
     },
     "node_modules/undici-types": {
@@ -22208,6 +23048,19 @@
         "url": "https://github.com/sponsors/sxzz"
       }
     },
+    "node_modules/unplugin-utils/node_modules/picomatch": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
+      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
+      "devOptional": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "node_modules/update-browserslist-db": {
       "version": "1.2.3",
       "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
@@ -22370,16 +23223,16 @@
       "license": "MIT"
     },
     "node_modules/uuid": {
-      "version": "11.1.1",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.1.tgz",
-      "integrity": "sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==",
+      "version": "14.0.1",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.1.tgz",
+      "integrity": "sha512-6ZxzVpzDXDa3bJWaHilVayA+BH/1zmxCJoVgvmqJnid/gPoKHxUrS/aC/T6LGQtNHT+XHG9fXPJB4d+IrU30Ew==",
       "funding": [
         "https://github.com/sponsors/broofa",
         "https://github.com/sponsors/ctavan"
       ],
       "license": "MIT",
       "bin": {
-        "uuid": "dist/esm/bin/uuid"
+        "uuid": "dist-node/bin/uuid"
       }
     },
     "node_modules/vary": {
@@ -22469,16 +23322,16 @@
       }
     },
     "node_modules/vite": {
-      "version": "8.0.16",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.16.tgz",
-      "integrity": "sha512-h9bXPmJichP5fLmVQo3PyaGSDE2n3aPuomeAlVRm0JLmt4rY6zmPKd59HYI4LNW8oTK7tlTsuC7l/m7awx9Jcw==",
+      "version": "8.1.3",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.1.3.tgz",
+      "integrity": "sha512-Ds+gBRbj0lwRO2Y5hwnUBdxSwlAve9LeRyU4sNnAr0ewW0gWF0n5bgXgUzbgZ49MV9BVUAQUFYVcDUcilUExMA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "lightningcss": "^1.32.0",
         "picomatch": "^4.0.4",
-        "postcss": "^8.5.15",
-        "rolldown": "1.0.3",
+        "postcss": "^8.5.16",
+        "rolldown": "~1.1.3",
         "tinyglobby": "^0.2.17"
       },
       "bin": {
@@ -22495,7 +23348,7 @@
       },
       "peerDependencies": {
         "@types/node": "^20.19.0 || >=22.12.0",
-        "@vitejs/devtools": "^0.1.18",
+        "@vitejs/devtools": "^0.3.0",
         "esbuild": "^0.27.0 || ^0.28.0",
         "jiti": ">=1.21.0",
         "less": "^4.0.0",
@@ -22561,6 +23414,19 @@
         "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
       }
     },
+    "node_modules/vite/node_modules/picomatch": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
+      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "node_modules/vitest": {
       "version": "4.1.9",
       "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.9.tgz",
@@ -22651,12 +23517,18 @@
         }
       }
     },
-    "node_modules/vitest/node_modules/es-module-lexer": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.1.0.tgz",
-      "integrity": "sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ==",
+    "node_modules/vitest/node_modules/picomatch": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
+      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
     },
     "node_modules/w3c-keyname": {
       "version": "2.2.8",
@@ -22771,41 +23643,33 @@
       }
     },
     "node_modules/widest-line": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/widest-line/-/widest-line-4.0.1.tgz",
-      "integrity": "sha512-o0cyEG0e8GPzT4iGHphIOh0cJOV8fivsXxddQasHPHfoZf1ZexrfeA21w2NaEN1RHE+fXlfISmOE8R9N3u3Qig==",
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/widest-line/-/widest-line-6.0.0.tgz",
+      "integrity": "sha512-U89AsyEeAsyoF0zVJBkG9zBgekjgjK7yk9sje3F4IQpXBJ10TF6ByLlIfjMhcmHMJgHZI4KHt4rdNfktzxIAMA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "string-width": "^5.0.1"
+        "string-width": "^8.1.0"
       },
       "engines": {
-        "node": ">=12"
+        "node": ">=20"
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/widest-line/node_modules/emoji-regex": {
-      "version": "9.2.2",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
-      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/widest-line/node_modules/string-width": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
-      "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
+      "version": "8.2.1",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-8.2.1.tgz",
+      "integrity": "sha512-IIaP0g3iy9Cyy18w3M9YcaDudujEAVHKt3a3QJg1+sr/oX96TbaGUubG0hJyCjCBThFH+tFpcIyoUHUn1ogaLA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "eastasianwidth": "^0.2.0",
-        "emoji-regex": "^9.2.2",
-        "strip-ansi": "^7.0.1"
+        "get-east-asian-width": "^1.5.0",
+        "strip-ansi": "^7.1.2"
       },
       "engines": {
-        "node": ">=12"
+        "node": ">=20"
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
@@ -22950,22 +23814,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/wsl-utils/node_modules/is-wsl": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-3.1.1.tgz",
-      "integrity": "sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "is-inside-container": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=16"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/xml-name-validator": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-5.0.0.tgz",
@@ -23007,11 +23855,13 @@
       "license": "MIT"
     },
     "node_modules/yallist": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
-      "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==",
-      "devOptional": true,
-      "license": "ISC"
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
+      "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=18"
+      }
     },
     "node_modules/yaml": {
       "version": "2.9.0",
@@ -23070,6 +23920,13 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/yoga-layout": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/yoga-layout/-/yoga-layout-3.2.1.tgz",
+      "integrity": "sha512-0LPOt3AxKqMdFBZA3HBAt/t/8vIKq7VaQYbuA8WxCgung+p9TVyKRYdpvCb80HcdTN2NkbIKbhNwKUfm3tQywQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/zeroentropy": {
       "version": "0.1.0-alpha.7",
       "resolved": "https://registry.npmjs.org/zeroentropy/-/zeroentropy-0.1.0-alpha.7.tgz",
@@ -23189,9 +24046,9 @@
         "@hono/node-server": "^1.19.14",
         "@mastra/ai-sdk": "1.4.5-alpha.0",
         "@mastra/core": "1.42.0-alpha.3",
-        "@mastra/duckdb": "1.4.1-alpha.0",
         "@mastra/editor": "0.11.2-alpha.0",
         "@mastra/evals": "1.2.4-alpha.0",
+        "@mastra/fastembed": "^1.1.2",
         "@mastra/loggers": "1.1.2-alpha.0",
         "@mastra/memory": "1.20.2-alpha.0",
         "@mastra/observability": "1.14.1-alpha.1",
@@ -23199,7 +24056,7 @@
         "@mastra/rag": "2.2.1-alpha.0",
         "@mastra/voice-openai": "0.12.2-alpha.0",
         "@supabase/supabase-js": "^2.105.4",
-        "@zapier/zapier-sdk": "^0.70.4",
+        "@zapier/zapier-sdk": "^0.81.0",
         "ai": "^6.0.177",
         "async-mutex": "^0.5.0",
         "chat": "^4.28.1",
@@ -23222,7 +24079,7 @@
       "devDependencies": {
         "@copilotkit/aimock": "^1.14.3",
         "@types/node": "^20",
-        "@zapier/zapier-sdk-cli": "^0.54.3",
+        "@zapier/zapier-sdk-cli": "^0.62.0",
         "mastra": "1.12.3-alpha.3",
         "typescript": "^5",
         "vitest": "^4.1.4",
@@ -23233,18 +24090,6 @@
         "@mastra/deployer-vercel": "1.1.37-alpha.0"
       }
     },
-    "packages/agents/node_modules/@zapier/zapier-sdk": {
-      "version": "0.70.4",
-      "resolved": "https://registry.npmjs.org/@zapier/zapier-sdk/-/zapier-sdk-0.70.4.tgz",
-      "integrity": "sha512-XQGTeanJbBrCJm2AVi1NZvrmyk9coGAeHqQFPzu2ZeiGua0yDoaVrQVllUE4Gu229YSlK23ZV8B29dyH+eRA+Q==",
-      "license": "SEE LICENSE IN LICENSE",
-      "dependencies": {
-        "@zapier/policy-context": "0.7.0",
-        "@zapier/policy-schema": "0.11.0",
-        "@zapier/zapier-sdk-core": "0.12.0",
-        "zod": "4.3.6"
-      }
-    },
     "packages/web": {
       "name": "@foreman/web",
       "version": "0.1.0",
@@ -23267,6 +24112,7 @@
         "@supabase/ssr": "^0.10.2",
         "@supabase/supabase-js": "^2.104.1",
         "ai": "^6.0.168",
+        "ansi-to-react": "^6.2.6",
         "class-variance-authority": "^0.7.1",
         "classnames": "^2.5.1",
         "clsx": "^2.1.1",
@@ -23284,7 +24130,7 @@
         "lucide-react": "^1.11.0",
         "motion": "^12.38.0",
         "nanoid": "^5.1.3",
-        "next": "16.2.4",
+        "next": "16.2.10",
         "next-themes": "^0.4.6",
         "orderedmap": "^2.1.1",
         "papaparse": "^5.5.2",
@@ -23301,6 +24147,7 @@
         "react-data-grid": "7.0.0-beta.47",
         "react-day-picker": "^10.0.0",
         "react-dom": "^19.2.0",
+        "react-is": "^19.2.7",
         "react-resizable-panels": "^4.11.0",
         "recharts": "^3.8.0",
         "shiki": "^3.23.0",
@@ -23328,13 +24175,29 @@
     },
     "packages/web/node_modules/@types/node": {
       "version": "22.19.21",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.21.tgz",
-      "integrity": "sha512-VMeFBSCKQKmm2swI2kW51SFusDqekC6q9trBCvJ/JliDchFSuoYYKN7yVNjPthP1HKZcx3U1gI/wTcEBjEFKTA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "undici-types": "~6.21.0"
       }
+    },
+    "packages/web/node_modules/nanoid": {
+      "version": "5.1.16",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-5.1.16.tgz",
+      "integrity": "sha512-kVrnsrJqMR8+oLJnGEmSWw9BivK5mt7H3FZatVRjrc5wGqFYuBxX1yG7+A7Gi5AefkX6t/oCkizcQgpu0cY1dQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "bin": {
+        "nanoid": "bin/nanoid.js"
+      },
+      "engines": {
+        "node": "^18 || >=20"
+      }
     }
   }
 }
diff --git a/package.json b/package.json
index 3fa7989e..655743f2 100644
--- a/package.json
+++ b/package.json
@@ -21,6 +21,8 @@
     "lint:fix": "biome check --fix .",
     "format": "biome format --write .",
     "check:deps": "node scripts/check-dep-uniqueness.mjs",
+    "dead-code": "npx fallow dead-code",
+    "dead-code:json": "npx fallow dead-code --format json",
     "sdk:check": "node scripts/zapier-sdk-watch.mjs",
     "sdk:check:quiet": "node scripts/zapier-sdk-watch.mjs --quiet",
     "audit:ci": "npm audit --audit-level=moderate",
@@ -30,10 +32,24 @@
     "esbuild": ">=0.25.0",
     "zod": "4.3.6",
     "postcss": "^8.5.10",
-    "@mastra/core": "1.42.0-alpha.3"
+    "@mastra/core": "1.42.0-alpha.3",
+    "@mastra/deployer": "1.42.0-alpha.3",
+    "@mastra/server": "1.42.0-alpha.3",
+    "@mastra/ai-sdk": "1.4.5-alpha.0",
+    "@mastra/editor": "0.11.2-alpha.0",
+    "@mastra/evals": "1.2.4-alpha.0",
+    "@mastra/fastembed": "1.1.2",
+    "@mastra/loggers": "1.1.2-alpha.0",
+    "@mastra/memory": "1.20.2-alpha.0",
+    "@mastra/observability": "1.14.1-alpha.1",
+    "@mastra/pg": "1.13.0-alpha.0",
+    "@mastra/rag": "2.2.1-alpha.0",
+    "@mastra/voice-openai": "0.12.2-alpha.0",
+    "@mastra/deployer-cloudflare": "1.1.43-alpha.0",
+    "@mastra/deployer-vercel": "1.1.37-alpha.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.12",
+    "@biomejs/biome": "2.4.16",
     "@copilotkit/aimock": "^1.14.3",
     "@playwright/test": "^1.59.1",
     "@tailwindcss/postcss": "^4",
@@ -44,7 +60,7 @@
     "@types/react-dom": "^19",
     "@types/supertest": "^7.2.0",
     "@vitest/ui": "^4.1.4",
-    "@zapier/zapier-sdk-cli": "^0.54.3",
+    "@zapier/zapier-sdk-cli": "^0.62.0",
     "autoprefixer": "^10.5.0",
     "drizzle-kit": "^0.31.10",
     "jsdom": "^29.0.2",
diff --git a/packages/agents/.gitignore b/packages/agents/.gitignore
index a6954037..7d1c93f6 100644
--- a/packages/agents/.gitignore
+++ b/packages/agents/.gitignore
@@ -10,3 +10,4 @@ datasets/
 .env.local
 mastra-dev.log
 server.log
+scripts/.pkce-url.txt
diff --git a/packages/agents/package.json b/packages/agents/package.json
index 6b5af874..4e3cf952 100644
--- a/packages/agents/package.json
+++ b/packages/agents/package.json
@@ -10,12 +10,13 @@
     "build:cloudflare": "DEPLOY_TARGET=cloudflare mastra build",
     "start": "node --env-file=.env.local .mastra/output/index.mjs 2>&1 | tee server.log",
     "start:webhooks": "npx tsx --env-file=.env.local src/webhook-server.ts",
-    "start:cron": "npx tsx --env-file=.env.local src/cron-driver-server.ts",
+    "start:inbox-worker": "npx tsx --env-file=.env.local src/inbox-worker-server.ts",
     "dev:mock": "npx @copilotkit/aimock --config aimock.json --port 4010",
     "dev:telegram": "npx tsx --env-file=.env.local src/telegram/start-polling.ts",
     "db:types": "npx supabase gen types typescript --local --workdir ../.. --schema public | npx biome format --stdin-file-path=database.types.ts > src/lib/db/database.types.ts",
     "db:types:check": "npx supabase gen types typescript --local --workdir ../.. --schema public | npx biome format --stdin-file-path=database.types.ts | diff - src/lib/db/database.types.ts",
     "test": "vitest run --exclude tests/sdk/** --exclude tests/live/**",
+    "typecheck": "tsc --noEmit",
     "verify:aimock": "node scripts/verify-aimock-coverage.mjs",
     "test:live": "node --env-file=.env.local ../../node_modules/vitest/vitest.mjs run --config vitest.live.config.ts",
     "test:sdk": "vitest run --config vitest.sdk.config.ts",
@@ -26,6 +27,8 @@
     "catalog:seed": "npx tsx --env-file=.env.local scripts/seed-catalog.ts",
     "catalog:seed:quick": "npx tsx --env-file=.env.local scripts/seed-catalog.ts --apps-only",
     "catalog:embed": "npx tsx --env-file=.env.local scripts/seed-catalog.ts --embed-only",
+    "embeddings:reindex": "npx tsx scripts/reindex-embeddings.ts",
+    "knowledge:reindex": "npx tsx --env-file=.env.local scripts/knowledge-reindex.ts",
     "datasets:smoke": "npx tsx --env-file=.env.local scripts/datasets-smoke.ts",
     "datasets:load-raw": "npx tsx --env-file=.env.local scripts/datasets-load-raw.ts",
     "datasets:label": "npx tsx --env-file=.env.local scripts/datasets-label.ts",
@@ -49,9 +52,9 @@
     "@hono/node-server": "^1.19.14",
     "@mastra/ai-sdk": "1.4.5-alpha.0",
     "@mastra/core": "1.42.0-alpha.3",
-    "@mastra/duckdb": "1.4.1-alpha.0",
     "@mastra/editor": "0.11.2-alpha.0",
     "@mastra/evals": "1.2.4-alpha.0",
+    "@mastra/fastembed": "^1.1.2",
     "@mastra/loggers": "1.1.2-alpha.0",
     "@mastra/memory": "1.20.2-alpha.0",
     "@mastra/observability": "1.14.1-alpha.1",
@@ -59,7 +62,7 @@
     "@mastra/rag": "2.2.1-alpha.0",
     "@mastra/voice-openai": "0.12.2-alpha.0",
     "@supabase/supabase-js": "^2.105.4",
-    "@zapier/zapier-sdk": "^0.70.4",
+    "@zapier/zapier-sdk": "^0.81.0",
     "ai": "^6.0.177",
     "async-mutex": "^0.5.0",
     "chat": "^4.28.1",
@@ -86,7 +89,7 @@
   "devDependencies": {
     "@copilotkit/aimock": "^1.14.3",
     "@types/node": "^20",
-    "@zapier/zapier-sdk-cli": "^0.54.3",
+    "@zapier/zapier-sdk-cli": "^0.62.0",
     "mastra": "1.12.3-alpha.3",
     "typescript": "^5",
     "vitest": "^4.1.4",
diff --git a/packages/agents/preview-template/.gitignore b/packages/agents/preview-template/.gitignore
new file mode 100644
index 00000000..f06235c4
--- /dev/null
+++ b/packages/agents/preview-template/.gitignore
@@ -0,0 +1,2 @@
+node_modules
+dist
diff --git a/packages/agents/preview-template/index.html b/packages/agents/preview-template/index.html
new file mode 100644
index 00000000..4e8e8c11
--- /dev/null
+++ b/packages/agents/preview-template/index.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Foreman Preview</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>
diff --git a/packages/agents/preview-template/package-lock.json b/packages/agents/preview-template/package-lock.json
new file mode 100644
index 00000000..fd014efe
--- /dev/null
+++ b/packages/agents/preview-template/package-lock.json
@@ -0,0 +1,4999 @@
+{
+  "name": "@foreman/preview-template",
+  "version": "0.1.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "@foreman/preview-template",
+      "version": "0.1.0",
+      "dependencies": {
+        "@base-ui/react": "^1.4.1",
+        "@hookform/resolvers": "^5.2.2",
+        "@tanstack/react-table": "^8.21.3",
+        "class-variance-authority": "^0.7.1",
+        "clsx": "^2.1.1",
+        "cmdk": "^1.1.1",
+        "date-fns": "^4.1.0",
+        "embla-carousel-react": "^8.6.0",
+        "input-otp": "^1.4.2",
+        "lucide-react": "^1.11.0",
+        "next-themes": "^0.4.6",
+        "radix-ui": "^1.4.3",
+        "react": "^19.2.0",
+        "react-day-picker": "^10.0.0",
+        "react-dom": "^19.2.0",
+        "react-hook-form": "^7.64.0",
+        "react-resizable-panels": "^4.11.0",
+        "recharts": "^3.8.0",
+        "sonner": "^1.7.4",
+        "tailwind-merge": "^3.5.0",
+        "vaul": "^1.1.2",
+        "zod": "^4.3.6"
+      },
+      "devDependencies": {
+        "@tailwindcss/vite": "^4.1.13",
+        "@types/node": "^22.8.6",
+        "@types/react": "^19",
+        "@types/react-dom": "^19",
+        "@vitejs/plugin-react": "^4.3.4",
+        "tailwindcss": "^4.1.13",
+        "typescript": "^5.6.3",
+        "vite": "^6.0.0"
+      }
+    },
+    "node_modules/@babel/code-frame": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.7.tgz",
+      "integrity": "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-validator-identifier": "^7.29.7",
+        "js-tokens": "^4.0.0",
+        "picocolors": "^1.1.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/compat-data": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.7.tgz",
+      "integrity": "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/core": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz",
+      "integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.7",
+        "@babel/helper-compilation-targets": "^7.29.7",
+        "@babel/helper-module-transforms": "^7.29.7",
+        "@babel/helpers": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/template": "^7.29.7",
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7",
+        "@jridgewell/remapping": "^2.3.5",
+        "convert-source-map": "^2.0.0",
+        "debug": "^4.1.0",
+        "gensync": "^1.0.0-beta.2",
+        "json5": "^2.2.3",
+        "semver": "^6.3.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/babel"
+      }
+    },
+    "node_modules/@babel/generator": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.7.tgz",
+      "integrity": "sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^7.29.7",
+        "@babel/types": "^7.29.7",
+        "@jridgewell/gen-mapping": "^0.3.12",
+        "@jridgewell/trace-mapping": "^0.3.28",
+        "jsesc": "^3.0.2"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-compilation-targets": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.29.7.tgz",
+      "integrity": "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/compat-data": "^7.29.7",
+        "@babel/helper-validator-option": "^7.29.7",
+        "browserslist": "^4.24.0",
+        "lru-cache": "^5.1.1",
+        "semver": "^6.3.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-globals": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.29.7.tgz",
+      "integrity": "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-module-imports": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz",
+      "integrity": "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-module-transforms": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz",
+      "integrity": "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-module-imports": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7",
+        "@babel/traverse": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
+      }
+    },
+    "node_modules/@babel/helper-plugin-utils": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.29.7.tgz",
+      "integrity": "sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-string-parser": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
+      "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-validator-identifier": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
+      "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-validator-option": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.29.7.tgz",
+      "integrity": "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helpers": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.7.tgz",
+      "integrity": "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/parser": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.7.tgz",
+      "integrity": "sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^7.29.7"
+      },
+      "bin": {
+        "parser": "bin/babel-parser.js"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-react-jsx-self": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-jsx-self/-/plugin-transform-react-jsx-self-7.29.7.tgz",
+      "integrity": "sha512-TL0hMc9xzy86VD31nUiwzd5otRAcyEPcsegCxolO0PvcXuH1v0kECe/UIznYFihpkvU5wg/jk4v0TTEFfm53fw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-react-jsx-source": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-jsx-source/-/plugin-transform-react-jsx-source-7.29.7.tgz",
+      "integrity": "sha512-06IyK09H3wi4cGbhDBwp5gUGo0IKtnYa8tyTiephirPCK6fbobVGiXMMI5zLQ4aKEYP3wZ3ArU44o+8KMrSG/Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/runtime": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.29.7.tgz",
+      "integrity": "sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/template": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.29.7.tgz",
+      "integrity": "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/code-frame": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/types": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/traverse": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.7.tgz",
+      "integrity": "sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.7",
+        "@babel/helper-globals": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.7",
+        "debug": "^4.3.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/types": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.7.tgz",
+      "integrity": "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-string-parser": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@base-ui/react": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/@base-ui/react/-/react-1.6.0.tgz",
+      "integrity": "sha512-/jzjTWJYXhRFO45Bev9lc3cHbmjzCMpUqbMZ2AgKy/z25mY9B6shGSNcXcjQar9n5doM0KYW1W8fcFv2jZBuMw==",
+      "license": "MIT",
+      "dependencies": {
+        "@babel/runtime": "^7.29.2",
+        "@base-ui/utils": "0.3.1",
+        "@floating-ui/react-dom": "^2.1.8",
+        "@floating-ui/utils": "^0.2.11",
+        "use-sync-external-store": "^1.6.0"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/mui-org"
+      },
+      "peerDependencies": {
+        "@date-fns/tz": "^1.2.0",
+        "@types/react": "^17 || ^18 || ^19",
+        "date-fns": "^4.0.0",
+        "react": "^17 || ^18 || ^19",
+        "react-dom": "^17 || ^18 || ^19"
+      },
+      "peerDependenciesMeta": {
+        "@date-fns/tz": {
+          "optional": true
+        },
+        "@types/react": {
+          "optional": true
+        },
+        "date-fns": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@base-ui/utils": {
+      "version": "0.3.1",
+      "resolved": "https://registry.npmjs.org/@base-ui/utils/-/utils-0.3.1.tgz",
+      "integrity": "sha512-gFFiltORVmW/N6IILTGxizP3PBpVpysqML1ALY5Vk0mH+7faVkCknOU31goYHN5Aoek2dkjxva1XOD2Ce9WuIg==",
+      "license": "MIT",
+      "dependencies": {
+        "@babel/runtime": "^7.29.2",
+        "@floating-ui/utils": "^0.2.11",
+        "reselect": "^5.2.0",
+        "use-sync-external-store": "^1.6.0"
+      },
+      "peerDependencies": {
+        "@types/react": "^17 || ^18 || ^19",
+        "react": "^17 || ^18 || ^19",
+        "react-dom": "^17 || ^18 || ^19"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@date-fns/tz": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@date-fns/tz/-/tz-1.5.0.tgz",
+      "integrity": "sha512-lwYN/vDPeNRULcepoE/LO2Pgx+7/RV+S9ARfbc9lr2DtGkOD7pAiruHvbR1RX3Qyf6ja47EWJDMsNK5vK08DJg==",
+      "license": "MIT"
+    },
+    "node_modules/@esbuild/aix-ppc64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.12.tgz",
+      "integrity": "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.12.tgz",
+      "integrity": "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.12.tgz",
+      "integrity": "sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.12.tgz",
+      "integrity": "sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.12.tgz",
+      "integrity": "sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.12.tgz",
+      "integrity": "sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.12.tgz",
+      "integrity": "sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.12.tgz",
+      "integrity": "sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.12.tgz",
+      "integrity": "sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.12.tgz",
+      "integrity": "sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ia32": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.12.tgz",
+      "integrity": "sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-loong64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.12.tgz",
+      "integrity": "sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-mips64el": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.12.tgz",
+      "integrity": "sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ppc64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.12.tgz",
+      "integrity": "sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-riscv64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.12.tgz",
+      "integrity": "sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-s390x": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.12.tgz",
+      "integrity": "sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.12.tgz",
+      "integrity": "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.12.tgz",
+      "integrity": "sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.12.tgz",
+      "integrity": "sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.12.tgz",
+      "integrity": "sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.12.tgz",
+      "integrity": "sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.25.12.tgz",
+      "integrity": "sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/sunos-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.12.tgz",
+      "integrity": "sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.12.tgz",
+      "integrity": "sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-ia32": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.12.tgz",
+      "integrity": "sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.12.tgz",
+      "integrity": "sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@floating-ui/core": {
+      "version": "1.7.5",
+      "resolved": "https://registry.npmjs.org/@floating-ui/core/-/core-1.7.5.tgz",
+      "integrity": "sha512-1Ih4WTWyw0+lKyFMcBHGbb5U5FtuHJuujoyyr5zTaWS5EYMeT6Jb2AuDeftsCsEuchO+mM2ij5+q9crhydzLhQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@floating-ui/utils": "^0.2.11"
+      }
+    },
+    "node_modules/@floating-ui/dom": {
+      "version": "1.7.6",
+      "resolved": "https://registry.npmjs.org/@floating-ui/dom/-/dom-1.7.6.tgz",
+      "integrity": "sha512-9gZSAI5XM36880PPMm//9dfiEngYoC6Am2izES1FF406YFsjvyBMmeJ2g4SAju3xWwtuynNRFL2s9hgxpLI5SQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@floating-ui/core": "^1.7.5",
+        "@floating-ui/utils": "^0.2.11"
+      }
+    },
+    "node_modules/@floating-ui/react-dom": {
+      "version": "2.1.8",
+      "resolved": "https://registry.npmjs.org/@floating-ui/react-dom/-/react-dom-2.1.8.tgz",
+      "integrity": "sha512-cC52bHwM/n/CxS87FH0yWdngEZrjdtLW/qVruo68qg+prK7ZQ4YGdut2GyDVpoGeAYe/h899rVeOVm6Oi40k2A==",
+      "license": "MIT",
+      "dependencies": {
+        "@floating-ui/dom": "^1.7.6"
+      },
+      "peerDependencies": {
+        "react": ">=16.8.0",
+        "react-dom": ">=16.8.0"
+      }
+    },
+    "node_modules/@floating-ui/utils": {
+      "version": "0.2.11",
+      "resolved": "https://registry.npmjs.org/@floating-ui/utils/-/utils-0.2.11.tgz",
+      "integrity": "sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg==",
+      "license": "MIT"
+    },
+    "node_modules/@hookform/resolvers": {
+      "version": "5.4.0",
+      "resolved": "https://registry.npmjs.org/@hookform/resolvers/-/resolvers-5.4.0.tgz",
+      "integrity": "sha512-EIsqr/t/qbinPIhGjMdtvutIN1Kk4uwbROE9/UQ93CAVGR7GkA7Y92+fX80OzXi/OB67jVFYwKGO1WzkxmkFZw==",
+      "license": "MIT",
+      "dependencies": {
+        "@standard-schema/utils": "^0.3.0"
+      },
+      "peerDependencies": {
+        "react-hook-form": "^7.55.0"
+      }
+    },
+    "node_modules/@jridgewell/gen-mapping": {
+      "version": "0.3.13",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
+      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.0",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
+    },
+    "node_modules/@jridgewell/remapping": {
+      "version": "2.3.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
+      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.3.5",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
+    },
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
+      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.5.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
+      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.31",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
+      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/resolve-uri": "^3.1.0",
+        "@jridgewell/sourcemap-codec": "^1.4.14"
+      }
+    },
+    "node_modules/@radix-ui/number": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/number/-/number-1.1.2.tgz",
+      "integrity": "sha512-ceTwaxc4I5IOi97DgCotl3pqiyRGvffcc0oOsE2dQYaJOFIDsDt4VWG6xEbg1QePv9QWausCEIppud/tJ1wNig==",
+      "license": "MIT"
+    },
+    "node_modules/@radix-ui/primitive": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@radix-ui/primitive/-/primitive-1.1.4.tgz",
+      "integrity": "sha512-7AdCK9PQyiljKoBDbN8OuctCbd/esdwZPQ8RtOE3SsyQtUpiPb+ND75q0jEhC1m1ecBI0MFNeLJvwIh9iKHRcQ==",
+      "license": "MIT"
+    },
+    "node_modules/@radix-ui/react-accessible-icon": {
+      "version": "1.1.10",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-accessible-icon/-/react-accessible-icon-1.1.10.tgz",
+      "integrity": "sha512-TraSwZUqTcVbiDV2/RXzAXC7aeVVXchq0daPFZE7zAxYFaMzjOUggLOfQH9KFLgRizuwVKZO/crveV1eeO3/ZQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-visually-hidden": "1.2.6"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-accordion": {
+      "version": "1.2.14",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-accordion/-/react-accordion-1.2.14.tgz",
+      "integrity": "sha512-iE8YB9nmTBH8zd73ofBISZ8JCzgMoMkATJr7qDwa6u5F1+7mTM81V6fa71jgZ65rpjVpecDf1vSnwIFP9Ly1zw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-collapsible": "1.1.14",
+        "@radix-ui/react-collection": "1.1.10",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-direction": "1.1.2",
+        "@radix-ui/react-id": "1.1.2",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-use-controllable-state": "1.2.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-alert-dialog": {
+      "version": "1.1.17",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-alert-dialog/-/react-alert-dialog-1.1.17.tgz",
+      "integrity": "sha512-563ygGeyWPrxyVCNp7OV4rE2aIXhFPknpFyo4wbDlcyMMPZ6ySh+zC5WTvY0ZFLgPTg/QB6tA8PyDQyJ2b4cPg==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-dialog": "1.1.17",
+        "@radix-ui/react-primitive": "2.1.6"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-arrow": {
+      "version": "1.1.10",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-arrow/-/react-arrow-1.1.10.tgz",
+      "integrity": "sha512-j2VTDz1vgCsmuG0k5lBfOcM8n5JPFqZBcMryasFjHYMhwxYL5SRUV5lMSUpRdNtw3D/Sv8pzJtrlAgkssYSsQQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-primitive": "2.1.6"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-aspect-ratio": {
+      "version": "1.1.10",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-aspect-ratio/-/react-aspect-ratio-1.1.10.tgz",
+      "integrity": "sha512-kbI7NrqhDeuytYrq7JjAsoXczvL8wgj2tc1MyaYWm+50bMKHCHQtVWCryslx4cCpmCTTkBcwQckE4CmmGV2haQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-primitive": "2.1.6"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-avatar": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-avatar/-/react-avatar-1.2.0.tgz",
+      "integrity": "sha512-am/CwltXtmtdtP+5FbYblYDnMa/zuKcMJP1i3/SJMDXXfj2mG+BTqLH2wucqeyyiQMursUtg/5cK+Nh2pCaSOA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-use-callback-ref": "1.1.2",
+        "@radix-ui/react-use-is-hydrated": "0.1.1",
+        "@radix-ui/react-use-layout-effect": "1.1.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-checkbox": {
+      "version": "1.3.5",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-checkbox/-/react-checkbox-1.3.5.tgz",
+      "integrity": "sha512-pREzrmNnVwGvYaBoM64huTRK7B3lrTRuwj8A9nwhPiEtMb+yudiWh6zWAqEtP0Dzd5+iBa1Ki7V1pCxV8ExMdA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-presence": "1.1.6",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-use-controllable-state": "1.2.3",
+        "@radix-ui/react-use-previous": "1.1.2",
+        "@radix-ui/react-use-size": "1.1.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-collapsible": {
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-collapsible/-/react-collapsible-1.1.14.tgz",
+      "integrity": "sha512-9bT+FvifX1FK2Mj6UEsTdyu0cN3JaA3KdfhaBao+ONrYFy/pyOy3TU1TNw7iOk1o+0hOEq67RojlUUmoFGwxyA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-id": "1.1.2",
+        "@radix-ui/react-presence": "1.1.6",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-use-controllable-state": "1.2.3",
+        "@radix-ui/react-use-layout-effect": "1.1.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-collection": {
+      "version": "1.1.10",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-collection/-/react-collection-1.1.10.tgz",
+      "integrity": "sha512-IVVz4EvBcKjrzKgof714qDnz/SzQAkLA2Emh5edlHbgcE6fNd3Un6CJLlaYcnm8N4JmAtzQgse4dOKxcD2yc9g==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-slot": "1.3.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-compose-refs": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-compose-refs/-/react-compose-refs-1.1.3.tgz",
+      "integrity": "sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-context": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-context/-/react-context-1.1.4.tgz",
+      "integrity": "sha512-QwH4PO5urrbO+FaGd5Aglg+YJgWTyyuZ3g/6mKvsqraLkglDdckw9JafgL5McL5VEJ6EPNduPaT3ZE9BttDAqg==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-context-menu": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-context-menu/-/react-context-menu-2.3.1.tgz",
+      "integrity": "sha512-XbrxS68W5dyiE4fAb96yvJwSVU5x66B20A99sD5Mk3xSWK/LqeOnx6TZnim1KieMjXS/CTFq8reOAjWxas2G8Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-menu": "2.1.18",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-use-controllable-state": "1.2.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-dialog": {
+      "version": "1.1.17",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-dialog/-/react-dialog-1.1.17.tgz",
+      "integrity": "sha512-TDTYmpdq8dI2+Xgvgj9AJ8Ghqq+Eph/TRVEdaFQPDItIY+6QSkU7MJMeevw1568Yw/2Ijz8BTphPSP2XejKphw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-dismissable-layer": "1.1.13",
+        "@radix-ui/react-focus-guards": "1.1.4",
+        "@radix-ui/react-focus-scope": "1.1.10",
+        "@radix-ui/react-id": "1.1.2",
+        "@radix-ui/react-portal": "1.1.12",
+        "@radix-ui/react-presence": "1.1.6",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-slot": "1.3.0",
+        "@radix-ui/react-use-controllable-state": "1.2.3",
+        "aria-hidden": "^1.2.4",
+        "react-remove-scroll": "^2.7.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-direction": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-direction/-/react-direction-1.1.2.tgz",
+      "integrity": "sha512-C3vFhbyi4SW3PmbAi6Awpu4OzJtd0MxGurvSsYtr7p7nM8RNB3VAF3CUmnp2j50knpkrRcB7+ycVXzgLgF6yNA==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-dismissable-layer": {
+      "version": "1.1.13",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-dismissable-layer/-/react-dismissable-layer-1.1.13.tgz",
+      "integrity": "sha512-2v+zNAWWe0ySxgC0D0yeXMPQ23xZVgXZTerTz+JKlmdRj6gfTqmCcR29jb6d290DezXPGgruHWDX/vYUebtErg==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-use-callback-ref": "1.1.2",
+        "@radix-ui/react-use-escape-keydown": "1.1.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-dropdown-menu": {
+      "version": "2.1.18",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-dropdown-menu/-/react-dropdown-menu-2.1.18.tgz",
+      "integrity": "sha512-PZGV82gFk0WltDRI//SsG28ZIjlo9ANTmoNYg0jLNzXXiDsAy5PkOOYQaVD1pPxY6t7gxffb1QMD6qaUvsBZdw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-id": "1.1.2",
+        "@radix-ui/react-menu": "2.1.18",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-use-controllable-state": "1.2.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-focus-guards": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-focus-guards/-/react-focus-guards-1.1.4.tgz",
+      "integrity": "sha512-cot/aB/mOm0IYVYTTmQcEEK1M48lZWi8FlYe5nDPQQ8NYZUlXEFgncJ9p2Kzer3RKSrY7cTTpEMLZKNo9QoP5Q==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-focus-scope": {
+      "version": "1.1.10",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-focus-scope/-/react-focus-scope-1.1.10.tgz",
+      "integrity": "sha512-Fas/lXQqhVvqwAb64s5RFeHiHYElZ6SUQbZaNd6EkfhP/Al7wTIQ9WIR4QVX475tlu5yFCEdDcJH6/UwsZjMWw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-use-callback-ref": "1.1.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-form": {
+      "version": "0.1.10",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-form/-/react-form-0.1.10.tgz",
+      "integrity": "sha512-1NfuvctVtX4sU3Mmq/IdrR8UunxiCMiVg3A5UENKhFzxUBeOyaQQ+lmaQaV7Tc8cqvBKsJL3/KGBsixK0D8WFg==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-id": "1.1.2",
+        "@radix-ui/react-label": "2.1.10",
+        "@radix-ui/react-primitive": "2.1.6"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-hover-card": {
+      "version": "1.1.17",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-hover-card/-/react-hover-card-1.1.17.tgz",
+      "integrity": "sha512-GjZQIEANVkuuWeztlKz6QEHe31ZX2iDfHzcTMCQVZXC0JyQrgfKWSC+LOOEw6aVV64zyjzobIzSA4AU4eKWrHA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-dismissable-layer": "1.1.13",
+        "@radix-ui/react-popper": "1.3.1",
+        "@radix-ui/react-portal": "1.1.12",
+        "@radix-ui/react-presence": "1.1.6",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-use-controllable-state": "1.2.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-id": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-id/-/react-id-1.1.2.tgz",
+      "integrity": "sha512-orBC88futVpqCmhX1p4cvquNHsELQ+w+vBJnuj3ftETI5bJb0bZn3Tqu3SWN2IOcPycTnMGnhwoermvISt72sA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-use-layout-effect": "1.1.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-label": {
+      "version": "2.1.10",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-label/-/react-label-2.1.10.tgz",
+      "integrity": "sha512-ib0zvq2ZsAqKm5tRnqGJn3vOxSgIts5ToxsXT0q1S/GfLD1Zj7UOEnkw8u2w6sRmn47djpQWuSU1DCL1R29/yw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-primitive": "2.1.6"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-menu": {
+      "version": "2.1.18",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-menu/-/react-menu-2.1.18.tgz",
+      "integrity": "sha512-lj8Rxjtn6zJq1oSbE/uDtAwCbB9BnxgHD+8MwJMuTh6u1dPamYhW9iuELr/Z8d0D/UysFblYYHeBPwi7T4k0YQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-collection": "1.1.10",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-direction": "1.1.2",
+        "@radix-ui/react-dismissable-layer": "1.1.13",
+        "@radix-ui/react-focus-guards": "1.1.4",
+        "@radix-ui/react-focus-scope": "1.1.10",
+        "@radix-ui/react-id": "1.1.2",
+        "@radix-ui/react-popper": "1.3.1",
+        "@radix-ui/react-portal": "1.1.12",
+        "@radix-ui/react-presence": "1.1.6",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-roving-focus": "1.1.13",
+        "@radix-ui/react-slot": "1.3.0",
+        "@radix-ui/react-use-callback-ref": "1.1.2",
+        "aria-hidden": "^1.2.4",
+        "react-remove-scroll": "^2.7.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-menubar": {
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-menubar/-/react-menubar-1.1.18.tgz",
+      "integrity": "sha512-hX7EGx/oFq6DPY27GQuP/2wP48GHf5LG6r06VgNJlG+znmDS8OfopZcRcGly3L4lsB9FqpmLx6JQSE9P3BUpyw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-collection": "1.1.10",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-direction": "1.1.2",
+        "@radix-ui/react-id": "1.1.2",
+        "@radix-ui/react-menu": "2.1.18",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-roving-focus": "1.1.13",
+        "@radix-ui/react-use-controllable-state": "1.2.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-navigation-menu": {
+      "version": "1.2.16",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-navigation-menu/-/react-navigation-menu-1.2.16.tgz",
+      "integrity": "sha512-nJ0SkrSQgudyYhMiYeHA1ayLVuduEJCFLan1RZZN7c9kqzzCFLaU9kuy81uNtqzweM9YaQPgWzxi9MwQ9jZ04g==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-collection": "1.1.10",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-direction": "1.1.2",
+        "@radix-ui/react-dismissable-layer": "1.1.13",
+        "@radix-ui/react-id": "1.1.2",
+        "@radix-ui/react-presence": "1.1.6",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-use-callback-ref": "1.1.2",
+        "@radix-ui/react-use-controllable-state": "1.2.3",
+        "@radix-ui/react-use-layout-effect": "1.1.2",
+        "@radix-ui/react-use-previous": "1.1.2",
+        "@radix-ui/react-visually-hidden": "1.2.6"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-one-time-password-field": {
+      "version": "0.1.10",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-one-time-password-field/-/react-one-time-password-field-0.1.10.tgz",
+      "integrity": "sha512-GHkcJ+WVj91At+OvUVTD4R3W0/wxw9t/sG5xFUBYXaCbtWiooZX5Md376QjJqgH4VsVyXrbVNHO2O4NYcmjfVg==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/number": "1.1.2",
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-collection": "1.1.10",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-direction": "1.1.2",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-roving-focus": "1.1.13",
+        "@radix-ui/react-use-controllable-state": "1.2.3",
+        "@radix-ui/react-use-effect-event": "0.0.3",
+        "@radix-ui/react-use-is-hydrated": "0.1.1",
+        "@radix-ui/react-use-layout-effect": "1.1.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-password-toggle-field": {
+      "version": "0.1.5",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-password-toggle-field/-/react-password-toggle-field-0.1.5.tgz",
+      "integrity": "sha512-fVuA82u0b/fClpbEJv8yp1nU9eSvoSEOERsU/hhf3FXGPIvkmE7oEaHEu8poowoXO39/Va7zq2E0TUcYr1dBRg==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-id": "1.1.2",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-use-controllable-state": "1.2.3",
+        "@radix-ui/react-use-effect-event": "0.0.3",
+        "@radix-ui/react-use-is-hydrated": "0.1.1"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-popover": {
+      "version": "1.1.17",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-popover/-/react-popover-1.1.17.tgz",
+      "integrity": "sha512-/YSAOdJ7YJvdn7bn5sdSx2egW+SKY+u7O5RyAVs94Ymrg2fg5QTSFPMRkzvhGyFuE4/qsmPBdrwYoZMZh/4f+g==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-dismissable-layer": "1.1.13",
+        "@radix-ui/react-focus-guards": "1.1.4",
+        "@radix-ui/react-focus-scope": "1.1.10",
+        "@radix-ui/react-id": "1.1.2",
+        "@radix-ui/react-popper": "1.3.1",
+        "@radix-ui/react-portal": "1.1.12",
+        "@radix-ui/react-presence": "1.1.6",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-slot": "1.3.0",
+        "@radix-ui/react-use-controllable-state": "1.2.3",
+        "aria-hidden": "^1.2.4",
+        "react-remove-scroll": "^2.7.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-popper": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-popper/-/react-popper-1.3.1.tgz",
+      "integrity": "sha512-bhnq/0DEPTi2lsOD3J5rTL65qUKHbKbhqHsmN9TMiclSXpipi651ooUKPPp6G5lF/WiHBdn1s0Wuqsn+myVAvw==",
+      "license": "MIT",
+      "dependencies": {
+        "@floating-ui/react-dom": "^2.0.0",
+        "@radix-ui/react-arrow": "1.1.10",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-use-callback-ref": "1.1.2",
+        "@radix-ui/react-use-layout-effect": "1.1.2",
+        "@radix-ui/react-use-rect": "1.1.2",
+        "@radix-ui/react-use-size": "1.1.2",
+        "@radix-ui/rect": "1.1.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-portal": {
+      "version": "1.1.12",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-portal/-/react-portal-1.1.12.tgz",
+      "integrity": "sha512-m309havGzsjLHHaIX50G5PlvRs3xkgPCsGk/5PTvYm8D5q33yG0J7w/712PTOhid7NTaFETtnSXjngHQavvhVw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-use-layout-effect": "1.1.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-presence": {
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-presence/-/react-presence-1.1.6.tgz",
+      "integrity": "sha512-zdTk4PlUO0E18HnZ3wYbW0KkJJxWCdiNYp6g6X1PtONFhxVkg01vliTJAmwIszU6mHiyBOoW9P0rAugl5/hULQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-use-layout-effect": "1.1.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-primitive": {
+      "version": "2.1.6",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-primitive/-/react-primitive-2.1.6.tgz",
+      "integrity": "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-slot": "1.3.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-progress": {
+      "version": "1.1.10",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-progress/-/react-progress-1.1.10.tgz",
+      "integrity": "sha512-JYzEg60lk79PwKM27WZyKd7PW8O4OM5jOaFfRPfOyeXmMw7tLJh5kSj+CEjVTehszuwml/AdCzPGMXBTGf4BBw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-primitive": "2.1.6"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-radio-group": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-radio-group/-/react-radio-group-1.4.1.tgz",
+      "integrity": "sha512-/SSxZdKEo2Eo29FFRKd06EfFDYp8HryKg0WYg7QLXaydPzl52YfSvCH2a3QDBRdtcuwACroJT8UVjQVgOJ7P9A==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-direction": "1.1.2",
+        "@radix-ui/react-presence": "1.1.6",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-roving-focus": "1.1.13",
+        "@radix-ui/react-use-controllable-state": "1.2.3",
+        "@radix-ui/react-use-previous": "1.1.2",
+        "@radix-ui/react-use-size": "1.1.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-roving-focus": {
+      "version": "1.1.13",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-roving-focus/-/react-roving-focus-1.1.13.tgz",
+      "integrity": "sha512-9gkwneI0guf8JDmrFxPjJF6Ozzgioyw+/lonYNCwefS9ZHA05er0BVHiXr+LbWGHxUfczvMY6G1oiZZi1VzjRw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-collection": "1.1.10",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-direction": "1.1.2",
+        "@radix-ui/react-id": "1.1.2",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-use-callback-ref": "1.1.2",
+        "@radix-ui/react-use-controllable-state": "1.2.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-scroll-area": {
+      "version": "1.2.12",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-scroll-area/-/react-scroll-area-1.2.12.tgz",
+      "integrity": "sha512-xuafVzQiTCLsyEjakowTdG3OgTXsmO7IdCiO77otIa+z44xoLNs9Do5eg7POFumIOCjtG6djfm6RKUKpUa/csA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/number": "1.1.2",
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-direction": "1.1.2",
+        "@radix-ui/react-presence": "1.1.6",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-use-callback-ref": "1.1.2",
+        "@radix-ui/react-use-layout-effect": "1.1.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-select": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-select/-/react-select-2.3.1.tgz",
+      "integrity": "sha512-w6eDvY78LE9ZUiNnXCA1QVK8RYN7k9galFv09kjVydJqBAgHd7Y9A6h0UJ/6DCZNGZMZrB2ohcSW1Bo9d8+wWA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/number": "1.1.2",
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-collection": "1.1.10",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-direction": "1.1.2",
+        "@radix-ui/react-dismissable-layer": "1.1.13",
+        "@radix-ui/react-focus-guards": "1.1.4",
+        "@radix-ui/react-focus-scope": "1.1.10",
+        "@radix-ui/react-id": "1.1.2",
+        "@radix-ui/react-popper": "1.3.1",
+        "@radix-ui/react-portal": "1.1.12",
+        "@radix-ui/react-presence": "1.1.6",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-slot": "1.3.0",
+        "@radix-ui/react-use-callback-ref": "1.1.2",
+        "@radix-ui/react-use-controllable-state": "1.2.3",
+        "@radix-ui/react-use-layout-effect": "1.1.2",
+        "@radix-ui/react-use-previous": "1.1.2",
+        "@radix-ui/react-visually-hidden": "1.2.6",
+        "aria-hidden": "^1.2.4",
+        "react-remove-scroll": "^2.7.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-separator": {
+      "version": "1.1.10",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-separator/-/react-separator-1.1.10.tgz",
+      "integrity": "sha512-Y6K6jLQCVfCnTL2MEtGxDLffkhNfEfHsEg3Wa8JU+IWdn3EWbLXd3OuOfQRN7p/W/cUce1WyTk3QeuAoDBzN9g==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-primitive": "2.1.6"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-slider": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-slider/-/react-slider-1.4.1.tgz",
+      "integrity": "sha512-r91WSpQucNGFKAIxT8FT0H0zyjd5tJlqObLp7LOMV4z49KoDCwjy01w3vDOU4e1wxhF9IgjYco7SB6byOW7Buw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/number": "1.1.2",
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-collection": "1.1.10",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-direction": "1.1.2",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-use-controllable-state": "1.2.3",
+        "@radix-ui/react-use-layout-effect": "1.1.2",
+        "@radix-ui/react-use-previous": "1.1.2",
+        "@radix-ui/react-use-size": "1.1.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-slot": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-slot/-/react-slot-1.3.0.tgz",
+      "integrity": "sha512-MojKku4U/miO8Av4Dkb+ctMAQx7JmY96LmtDQlAarCRtd7rN52QCSzBF+XAvr5S6coSVj9HEPBgHAHKEJVk/WA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-compose-refs": "1.1.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-switch": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-switch/-/react-switch-1.3.1.tgz",
+      "integrity": "sha512-55bQtCnOB0BohomSHi6qvQXpJEEqUGDm6hRrM0Bph5OXwhSegqkd8IqgBAQkM1IlgUlWZIxpxRcpOEfRIgimyw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-use-controllable-state": "1.2.3",
+        "@radix-ui/react-use-previous": "1.1.2",
+        "@radix-ui/react-use-size": "1.1.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-tabs": {
+      "version": "1.1.15",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-tabs/-/react-tabs-1.1.15.tgz",
+      "integrity": "sha512-kxc9gI6/HfcU4nfMMVS3AmQK414kbU1IE6UCJmMmxjhO3cRPXOyYnmvyKD+ODt7q56nRq9l7Wovi6uaGwKgMlg==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-direction": "1.1.2",
+        "@radix-ui/react-id": "1.1.2",
+        "@radix-ui/react-presence": "1.1.6",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-roving-focus": "1.1.13",
+        "@radix-ui/react-use-controllable-state": "1.2.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-toast": {
+      "version": "1.2.17",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-toast/-/react-toast-1.2.17.tgz",
+      "integrity": "sha512-uL4kyyWy000pPL43fGGCV5qT6ZchCWEQZOSlkYiPwPt8Hy1iW38RjeptIvz1/SZesrW6Vn58Ct3sV7tfEfiAbw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-collection": "1.1.10",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-dismissable-layer": "1.1.13",
+        "@radix-ui/react-portal": "1.1.12",
+        "@radix-ui/react-presence": "1.1.6",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-use-callback-ref": "1.1.2",
+        "@radix-ui/react-use-controllable-state": "1.2.3",
+        "@radix-ui/react-use-layout-effect": "1.1.2",
+        "@radix-ui/react-visually-hidden": "1.2.6"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-toggle": {
+      "version": "1.1.12",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-toggle/-/react-toggle-1.1.12.tgz",
+      "integrity": "sha512-AsAVsYNZIlRBsci7BhE+QyQeKd1h6TffJYt+lF0QQkd5OpQ3klfIByPsCb4G0h/Fq6PJwh1FYNluzBFYzhk4+w==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-use-controllable-state": "1.2.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-toggle-group": {
+      "version": "1.1.13",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-toggle-group/-/react-toggle-group-1.1.13.tgz",
+      "integrity": "sha512-Xb9PLtlvU66F36LiKba6dFswu6V2mDkgidO4fNSbQHQwmZ9ObxMIO17MN/LJ4aWJecVuSVLAHPZjyeMzJrgeiA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-direction": "1.1.2",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-roving-focus": "1.1.13",
+        "@radix-ui/react-toggle": "1.1.12",
+        "@radix-ui/react-use-controllable-state": "1.2.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-toolbar": {
+      "version": "1.1.13",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-toolbar/-/react-toolbar-1.1.13.tgz",
+      "integrity": "sha512-Za1l4f6fzTkGgz/iynAMN8iaqiKff2wm2/QwiLmHPtDQreWEBrvSimgQFIekxMUdRPhILM7xdIXxuS/o/DGZag==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-direction": "1.1.2",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-roving-focus": "1.1.13",
+        "@radix-ui/react-separator": "1.1.10",
+        "@radix-ui/react-toggle-group": "1.1.13"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-tooltip": {
+      "version": "1.2.10",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-tooltip/-/react-tooltip-1.2.10.tgz",
+      "integrity": "sha512-NlNe8D0dWEpVfXFli90IO6X07Josx/b1iu98tDnx9Xv0HT4wLIL+m2VOheMHhK7qbp2HoTBqALEFzGyZs/levw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-dismissable-layer": "1.1.13",
+        "@radix-ui/react-id": "1.1.2",
+        "@radix-ui/react-popper": "1.3.1",
+        "@radix-ui/react-portal": "1.1.12",
+        "@radix-ui/react-presence": "1.1.6",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-slot": "1.3.0",
+        "@radix-ui/react-use-controllable-state": "1.2.3",
+        "@radix-ui/react-visually-hidden": "1.2.6"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-callback-ref": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-callback-ref/-/react-use-callback-ref-1.1.2.tgz",
+      "integrity": "sha512-xCso9j1/u8sEgP1RNHjFrXJLApL8LiqOkI1R4ywuN00rxWdYg4oQXuwKLS3i0j5NWLromUD27/4nlxj2UFVvIw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-controllable-state": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-controllable-state/-/react-use-controllable-state-1.2.3.tgz",
+      "integrity": "sha512-PLzC90MS+ReootmjC597dvopoelpZ8Q61HJkDXZSExitIq7PL55vHNnesAHwguHK0aPfBnpdNzQtv1uliaqQrA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-use-effect-event": "0.0.3",
+        "@radix-ui/react-use-layout-effect": "1.1.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-effect-event": {
+      "version": "0.0.3",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-effect-event/-/react-use-effect-event-0.0.3.tgz",
+      "integrity": "sha512-6c8ZqvPTWILEKnyVkP53EGRCcpnJiKTC21sS/6R1GF5xKyHJJWQEPfkqlcgUkdRQivd6tb23abUwe4ngWmY0JA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-use-layout-effect": "1.1.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-escape-keydown": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-escape-keydown/-/react-use-escape-keydown-1.1.2.tgz",
+      "integrity": "sha512-2uVLvLjgO7NZCWw01/FdqRwmA42J0BcjPMUCA+koFEOAb+zjqIP7SiFz/7zWPrKnVmSqr76Omq2ALyCuX4dhLw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-use-callback-ref": "1.1.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-is-hydrated": {
+      "version": "0.1.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-is-hydrated/-/react-use-is-hydrated-0.1.1.tgz",
+      "integrity": "sha512-qwOiz4Tjo8CNnrOLAYUMXeZwDzXgXpvK4TKQPmWLECM9XoWvA6+0Z2/7Ag3A4ivjS4ovbLJPbskkxioFyBhr8A==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-layout-effect": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-layout-effect/-/react-use-layout-effect-1.1.2.tgz",
+      "integrity": "sha512-jrBWOxZITuGcnjRCM2t2U5ZPkCLxD+Ym6DjfssS5haTj2iiak/DOb64JeN6OdLfLgptb6/e2kKR+ZuTrGoZTPA==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-previous": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-previous/-/react-use-previous-1.1.2.tgz",
+      "integrity": "sha512-IGBQPtRFdhN6MQ8dbegVmBq1LVZluya3F1jWY+puIcQC3MHctRwTDSBWCkL/3ZcnMJLTMJ++Z+ktmvg0F89iCw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-rect": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-rect/-/react-use-rect-1.1.2.tgz",
+      "integrity": "sha512-d8a+bBY/FxikNPlgJJoaBHZX+zKVbWHYJGTLnLvveQgFSTntkGdEKv3JDtHrMS0DNYpllz2nRsTLGLKYttbpmw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/rect": "1.1.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-size": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-size/-/react-use-size-1.1.2.tgz",
+      "integrity": "sha512-giWQp+4mxjBPt4KZ0MmyuykFNWfbDxKt4x+fPkRYmgRFJSbCZFzUglvMb/Kjn38tm10YP4ufiQZDx3zna4LU6w==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-use-layout-effect": "1.1.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-visually-hidden": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-visually-hidden/-/react-visually-hidden-1.2.6.tgz",
+      "integrity": "sha512-jCE0WljWifTI4niIMCll06kGpsJTAPiZVU9H4WR1N6qW7At9ystHbN7dDB+we2xH535roFHj7qKS+RGj0FMDWQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-primitive": "2.1.6"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/rect": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/rect/-/rect-1.1.2.tgz",
+      "integrity": "sha512-xnXE7wG13PI+cxieVssYXlQJuYVRhH9NBoxt3KNwzghDIA69GMm7d4wXRouHIYjE+KvS6U/MsMO73NdS2MH9ZA==",
+      "license": "MIT"
+    },
+    "node_modules/@reduxjs/toolkit": {
+      "version": "2.12.0",
+      "resolved": "https://registry.npmjs.org/@reduxjs/toolkit/-/toolkit-2.12.0.tgz",
+      "integrity": "sha512-KiT+RzZbp6mQET+Mg+h2c97+9j1sNflUxQkIHI7Yuzf6Peu+OYpmkn6nbHWmLLWj+1ZODUJFwGZ7gx3L9R9EOw==",
+      "license": "MIT",
+      "dependencies": {
+        "@standard-schema/spec": "^1.0.0",
+        "@standard-schema/utils": "^0.3.0",
+        "immer": "^11.0.0",
+        "redux": "^5.0.1",
+        "redux-thunk": "^3.1.0",
+        "reselect": "^5.1.0"
+      },
+      "peerDependencies": {
+        "react": "^16.9.0 || ^17.0.0 || ^18 || ^19",
+        "react-redux": "^7.2.1 || ^8.1.3 || ^9.0.0"
+      },
+      "peerDependenciesMeta": {
+        "react": {
+          "optional": true
+        },
+        "react-redux": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@reduxjs/toolkit/node_modules/immer": {
+      "version": "11.1.8",
+      "resolved": "https://registry.npmjs.org/immer/-/immer-11.1.8.tgz",
+      "integrity": "sha512-/tbkHMW7y10Lx6i1crLjD4/OhNkRG+Fo7byZHtah0547nIeXYcpIXaUh0IAQY6gO5459qpGGYapcEOHtFXkIuA==",
+      "license": "MIT",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/immer"
+      }
+    },
+    "node_modules/@rolldown/pluginutils": {
+      "version": "1.0.0-beta.27",
+      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.0-beta.27.tgz",
+      "integrity": "sha512-+d0F4MKMCbeVUJwG96uQ4SgAznZNSq93I3V+9NHA4OpvqG8mRCpGdKmK8l/dl02h2CCDHwW2FqilnTyDcAnqjA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@rollup/rollup-android-arm-eabi": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.62.2.tgz",
+      "integrity": "sha512-6o7ZLZK+BeenkZCFNDXqpbjw9bD6nuWonvS/lwQJp7NoVVxm6p3qE7qQ5jGuBjiFsgvqjD8mZAU5oWxTmbOeOg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ]
+    },
+    "node_modules/@rollup/rollup-android-arm64": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.62.2.tgz",
+      "integrity": "sha512-BaH7BllCACHoH1LguOU56UItGfUWjujlO65kS9LAodViaN4bwIKd7oeW/ZHJ/4ljr/7MIiENnNy3HJ0zXv8Zkw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ]
+    },
+    "node_modules/@rollup/rollup-darwin-arm64": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.62.2.tgz",
+      "integrity": "sha512-v39RCCvj4He82I9sFmk+M1VZ0PLM9sfsLVikjfx2hYBNALhrrOR2D3JjQA6AhlaSOgcR+RzrKY7e1+bT6SUO/A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@rollup/rollup-darwin-x64": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.62.2.tgz",
+      "integrity": "sha512-yl0y2vq3S3lHeuXhEdss6TWfKW8vkujImO12tn4ZkG/4oghr09LvdYm2RElVjokTQiUvDUGXLGsYeLqUMCKpGA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@rollup/rollup-freebsd-arm64": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.62.2.tgz",
+      "integrity": "sha512-tT4pvt4qXD+vEoezupCWi+a1F0vvDiksiHc+PxRlYTOH1I6/X4id9jPxTP+Fg+545euaFT1jJVs4CEdHZAU1vw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ]
+    },
+    "node_modules/@rollup/rollup-freebsd-x64": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.62.2.tgz",
+      "integrity": "sha512-6nU5F2wCW+qvCBhTn1pdIU3bzsIoF7EUwsCDRxilWGprQR6yd508YnH9+OKFCwpfS8pjZqDUmnCAr7exax0XCg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.62.2.tgz",
+      "integrity": "sha512-n1GJHPOvpIfhi3TmrCeh6S6URt9BFCt0KQE3qvexyGCTAKpR4Lg+eWvNZEqu7epxwus/8ElT3hacYEucm49SZg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-arm-musleabihf": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.62.2.tgz",
+      "integrity": "sha512-JqgflS8wEB+UXV/vS1RpRbifGBeN4D5lz8D8oOFbFZw4vedvdOgCFAjfBmIMdW3yL10XpQQ0Ambepw6MXrhOnA==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-arm64-gnu": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.62.2.tgz",
+      "integrity": "sha512-wnFJkogWvN4jm/hQRF2UBaeUmk20j5+DmHvoyWii2b8HJDyvz1MF2OU/6ynXt2KR63rbZLWkFpoytpdc/yBuSA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-arm64-musl": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.62.2.tgz",
+      "integrity": "sha512-HVu2bp0zhvJ8xHEV9+UUs7S90VadmBSY3LcIMvozbPo4AuMGDWlz3ymHLHZPX4hR67TKTt8Qp5PJ5RBg/i+RMQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-loong64-gnu": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.62.2.tgz",
+      "integrity": "sha512-mQqqAV8QaoSgr9I2fKDLY2BAVvmKjWoGiu/cSYQonsLvtqwEn1E4QYfnCOcp5zoEqNhsDYin1s6jx/VJmrxlZg==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-loong64-musl": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.62.2.tgz",
+      "integrity": "sha512-IxKLoxCQ2IWi6bT2akyDUBGsOImDKB+sPp4EsTmwFQ/fMwpCKm8uLSSgP/Kx/QYUgKis6SEZ5/Nlhup0DIA0PQ==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-ppc64-gnu": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.62.2.tgz",
+      "integrity": "sha512-Mk5ha2RQSgyFfmYYLkBpPnUk8D8FriBxesO1u9O75X0mHgXL1UQcH5Itl2lurWL2tj0RxV9b9tJgipac0hRY9A==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-ppc64-musl": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.62.2.tgz",
+      "integrity": "sha512-CjvEnqJL/0/TQ3TXX3OPIJ/kmBellrWd4heXUmHeJlTnmwjKpSJzoehLaL6Xk0ZnMHBu9dZuFADNOrtjF4v+2w==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-riscv64-gnu": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.62.2.tgz",
+      "integrity": "sha512-1SiZbzwdkaDURsew/tSOrooKiYy7EQGT6m8ufavAi9NEyQb/6VuIxFXAL1fqa4iZe3g4NbNk4P7J32z2tw5Mgg==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-riscv64-musl": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.62.2.tgz",
+      "integrity": "sha512-nQts12zJ3NQRoE6uYljOH89v7szzLDvG2JD/vsX+vGXU8w/At1GowTZ5/7qeFQ8m7L55rpR8Okugnuo5bgjy2Q==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-s390x-gnu": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.62.2.tgz",
+      "integrity": "sha512-E9/ll019jhPIJgpzfZoIkBGhcz+kKNgVWYRY0zr9srBdPPFVpvOKW8VaJKUbeK+eZXyQF9ltME+Kk6affeaPgg==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-x64-gnu": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.62.2.tgz",
+      "integrity": "sha512-5BqxR/pshjey51iliyzTD5Xi3EN0aLmQ2lZ3lvefVV9c82BvrLo2/6OT55iifpWBufs6kdwWbuOKS841DrmK9A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-x64-musl": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.62.2.tgz",
+      "integrity": "sha512-uNN83XxQrRAh/w0/pmAfibcwyb6YWt4gP+dpnQKPVJshAloQ785ii8CT8ZCIxkGg9opVsvAlGhFitSm6D1Jjpg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-openbsd-x64": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.62.2.tgz",
+      "integrity": "sha512-srjEIxSH3LRnJN6THczDHWQplqEMFiAJrTab0msUryh9kwNpkICf3Ea6q6MN/2cZwRFUNx5w+h6Hpi4QuHS6Zg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ]
+    },
+    "node_modules/@rollup/rollup-openharmony-arm64": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.62.2.tgz",
+      "integrity": "sha512-8hOJnxgbyObnCm5AlRA3A931xX19xq80RjVTKgJOvEKWqJruP/Uf12IbAOaDjjEXYRewwHLfmF0YRIdK3OwKWA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ]
+    },
+    "node_modules/@rollup/rollup-win32-arm64-msvc": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.62.2.tgz",
+      "integrity": "sha512-mmF4AY1i0hG/bLWUctUq59gtmgaSIRa3cu/A3JFRp/sCNEme2bgDEiDS22P9FbnJB8NJNF4jPJiSP5RHQpUTDg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@rollup/rollup-win32-ia32-msvc": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.62.2.tgz",
+      "integrity": "sha512-DZgkknc6jhHrk46V25vbAM0zZkyP0nSDkJB8/dRkLTxv470dOmWDqGoEJl/9A0dFfS7yE3REOwNDxpHwSLSt0Q==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@rollup/rollup-win32-x64-gnu": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.62.2.tgz",
+      "integrity": "sha512-T6xr6ucWSFto+VGajA8YH26LdpHRuP4YLHEKAtCWvJDOlnmWcDZVCI2Jmjr+IFHDlt2zRaTAKE4tfjTaWLgJBg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@rollup/rollup-win32-x64-msvc": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.62.2.tgz",
+      "integrity": "sha512-BfzEnDJOt9T8M989/lA37EcJgat01wLRnoi5dQf3QzOH7jzpqTAzdDbVfRljVr5r+jzKqpbHeyOfAaXxAd0PAA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@standard-schema/spec": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
+      "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
+      "license": "MIT"
+    },
+    "node_modules/@standard-schema/utils": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/@standard-schema/utils/-/utils-0.3.0.tgz",
+      "integrity": "sha512-e7Mew686owMaPJVNNLs55PUvgz371nKgwsc4vxE49zsODpJEnxgxRo2y/OKrqueavXgZNMDVj3DdHFlaSAeU8g==",
+      "license": "MIT"
+    },
+    "node_modules/@tailwindcss/node": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.1.tgz",
+      "integrity": "sha512-6NDaqRoAMSXD1mr/RXu0HBvNE9a2n5tHPsxu9XHLws8o4Twes5rBM2205SUUiJ9goAtadrN6xTGX0UDEwp/N4A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/remapping": "^2.3.5",
+        "enhanced-resolve": "5.21.6",
+        "jiti": "^2.7.0",
+        "lightningcss": "1.32.0",
+        "magic-string": "^0.30.21",
+        "source-map-js": "^1.2.1",
+        "tailwindcss": "4.3.1"
+      }
+    },
+    "node_modules/@tailwindcss/oxide": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.3.1.tgz",
+      "integrity": "sha512-yVPyo8RNkabVr3O2EhHEE0Rewu7YKzc1DhIqfL46LKveFrmu9XbDazNOJY7/GRuvw1h6u3utWnR29H/p5JPlgA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 20"
+      },
+      "optionalDependencies": {
+        "@tailwindcss/oxide-android-arm64": "4.3.1",
+        "@tailwindcss/oxide-darwin-arm64": "4.3.1",
+        "@tailwindcss/oxide-darwin-x64": "4.3.1",
+        "@tailwindcss/oxide-freebsd-x64": "4.3.1",
+        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.1",
+        "@tailwindcss/oxide-linux-arm64-gnu": "4.3.1",
+        "@tailwindcss/oxide-linux-arm64-musl": "4.3.1",
+        "@tailwindcss/oxide-linux-x64-gnu": "4.3.1",
+        "@tailwindcss/oxide-linux-x64-musl": "4.3.1",
+        "@tailwindcss/oxide-wasm32-wasi": "4.3.1",
+        "@tailwindcss/oxide-win32-arm64-msvc": "4.3.1",
+        "@tailwindcss/oxide-win32-x64-msvc": "4.3.1"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-android-arm64": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.3.1.tgz",
+      "integrity": "sha512-SVlyf61g374l5cHyg8x9kf5xmLcOaxvOTsbsqDnSsDJaKOEFZ7GCvi84VAVGpxojYOs1+3K6M0UjXfqPU8vmOQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-darwin-arm64": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.3.1.tgz",
+      "integrity": "sha512-hVnWLwv+e/l7c4WKyVtHVrIPvYdqWHjRB3MDIqARynzFtnQg85kmQEFCbV9Ja0VVx4xXTIiDWY60Y7iz/iNoDA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-darwin-x64": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.3.1.tgz",
+      "integrity": "sha512-Cf7abu0WVgbhU7ANgPUnSAvm7nCvMweusHb8FnaHlLfv/Caq4GYaEZg7ZImzzmjx4lIAfuS8q+eLIS7A7IzxIg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-freebsd-x64": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.3.1.tgz",
+      "integrity": "sha512-ZZqzX2Y+GXtXXfqSfpJhDm60OoZfvLHLCgm+J7NVqgHHJjG/m9ugZI77RwTsVd4fnBJuCFP6Ae6kTJb71UdS8g==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-arm-gnueabihf": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.3.1.tgz",
+      "integrity": "sha512-/Ah/xik0LaMYfv9DZ0S/t4pBlBNYOcqtRwusjgovHkvT8ixueWCLyJjsaF5kQIckjb4IT8Q6K6p/iPmZMixYgg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-arm64-gnu": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.3.1.tgz",
+      "integrity": "sha512-gqdFoVJlw444GvpnheZLHmvTzSxI/cOUUh2KSNejQjTcYkW062SVD+En0rUgD+QV91bz1XGIGtt1HJd48xUGbQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-arm64-musl": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.3.1.tgz",
+      "integrity": "sha512-Bwv9KwOvE0VKa86xPFif9b9c3Y1NxOV1P0gLti/IYaWEsQYZXDlxfGEtA8mdDZ7SG3wyNXAWYT5SIn3giL57oA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-x64-gnu": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.3.1.tgz",
+      "integrity": "sha512-Ymi8O8T15HYQdOUWUtTI6ldN0neHP85FC+Qz32xTcZ7iJXtem/x8ITev0o1e9e5rkqj4lONZfTRLvkmin1+tKg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-x64-musl": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.3.1.tgz",
+      "integrity": "sha512-M+P/91qJ6uILLw4k2G93GMDRAXj61SMvFQYt39AqvUqYgExXpLL5aepfns7sj4HiAQeolirQF9E0lzRvdf4zPQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.1.tgz",
+      "integrity": "sha512-zsM8uOeqvVGHsAXsJxsT28ttosFahLJKCLOTUBqRAtKnVgGSRitds9T432QiT8b77Yga7JIBkulIRRlJPtYhRA==",
+      "bundleDependencies": [
+        "@napi-rs/wasm-runtime",
+        "@emnapi/core",
+        "@emnapi/runtime",
+        "@tybys/wasm-util",
+        "@emnapi/wasi-threads",
+        "tslib"
+      ],
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "^1.10.0",
+        "@emnapi/runtime": "^1.10.0",
+        "@emnapi/wasi-threads": "^1.2.1",
+        "@napi-rs/wasm-runtime": "^1.1.4",
+        "@tybys/wasm-util": "^0.10.2",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.1.tgz",
+      "integrity": "sha512-aiNvSq9BsVk8V513lDKlrCFAgf8qBMPZTpgEhInL+NwQqs97mYmupVMrPrgBBSL8Pv/0zXu9MrMF9rMun1ZeNg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-win32-x64-msvc": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.3.1.tgz",
+      "integrity": "sha512-xDEyu1rg290472FEGaKHnzyDyh5QH+AlWvsU5hMoMtPpzmKlRI0jaYKCgSHDYtaQWZOYbMaduSyCwFwY4n1HmA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/vite": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/vite/-/vite-4.3.1.tgz",
+      "integrity": "sha512-hItDHuIIlEV61R+faXu66s1K36aTurO/Qw0e45Vskz57gXl9pWOT6eg3zmcEui6CZXddbN7zd41bwmvag4JGwQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@tailwindcss/node": "4.3.1",
+        "@tailwindcss/oxide": "4.3.1",
+        "tailwindcss": "4.3.1"
+      },
+      "peerDependencies": {
+        "vite": "^5.2.0 || ^6 || ^7 || ^8"
+      }
+    },
+    "node_modules/@tanstack/react-table": {
+      "version": "8.21.3",
+      "resolved": "https://registry.npmjs.org/@tanstack/react-table/-/react-table-8.21.3.tgz",
+      "integrity": "sha512-5nNMTSETP4ykGegmVkhjcS8tTLW6Vl4axfEGQN3v0zdHYbK4UfoqfPChclTrJ4EoK9QynqAu9oUf8VEmrpZ5Ww==",
+      "license": "MIT",
+      "dependencies": {
+        "@tanstack/table-core": "8.21.3"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/tannerlinsley"
+      },
+      "peerDependencies": {
+        "react": ">=16.8",
+        "react-dom": ">=16.8"
+      }
+    },
+    "node_modules/@tanstack/table-core": {
+      "version": "8.21.3",
+      "resolved": "https://registry.npmjs.org/@tanstack/table-core/-/table-core-8.21.3.tgz",
+      "integrity": "sha512-ldZXEhOBb8Is7xLs01fR3YEc3DERiz5silj8tnGkFZytt1abEvl/GhUmCE0PMLaMPTa3Jk4HbKmRlHmu+gCftg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/tannerlinsley"
+      }
+    },
+    "node_modules/@types/babel__core": {
+      "version": "7.20.5",
+      "resolved": "https://registry.npmjs.org/@types/babel__core/-/babel__core-7.20.5.tgz",
+      "integrity": "sha512-qoQprZvz5wQFJwMDqeseRXWv3rqMvhgpbXFfVyWhbx9X47POIA6i/+dXefEmZKoAgOaTdaIgNSMqMIU61yRyzA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^7.20.7",
+        "@babel/types": "^7.20.7",
+        "@types/babel__generator": "*",
+        "@types/babel__template": "*",
+        "@types/babel__traverse": "*"
+      }
+    },
+    "node_modules/@types/babel__generator": {
+      "version": "7.27.0",
+      "resolved": "https://registry.npmjs.org/@types/babel__generator/-/babel__generator-7.27.0.tgz",
+      "integrity": "sha512-ufFd2Xi92OAVPYsy+P4n7/U7e68fex0+Ee8gSG9KX7eo084CWiQ4sdxktvdl0bOPupXtVJPY19zk6EwWqUQ8lg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^7.0.0"
+      }
+    },
+    "node_modules/@types/babel__template": {
+      "version": "7.4.4",
+      "resolved": "https://registry.npmjs.org/@types/babel__template/-/babel__template-7.4.4.tgz",
+      "integrity": "sha512-h/NUaSyG5EyxBIp8YRxo4RMe2/qQgvyowRwVMzhYhBCONbW8PUsg4lkFMrhgZhUe5z3L3MiLDuvyJ/CaPa2A8A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^7.1.0",
+        "@babel/types": "^7.0.0"
+      }
+    },
+    "node_modules/@types/babel__traverse": {
+      "version": "7.28.0",
+      "resolved": "https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.28.0.tgz",
+      "integrity": "sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^7.28.2"
+      }
+    },
+    "node_modules/@types/d3-array": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/@types/d3-array/-/d3-array-3.2.2.tgz",
+      "integrity": "sha512-hOLWVbm7uRza0BYXpIIW5pxfrKe0W+D5lrFiAEYR+pb6w3N2SwSMaJbXdUfSEv+dT4MfHBLtn5js0LAWaO6otw==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-color": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/@types/d3-color/-/d3-color-3.1.3.tgz",
+      "integrity": "sha512-iO90scth9WAbmgv7ogoq57O9YpKmFBbmoEoCHDB2xMBY0+/KVrqAaCDyCE16dUspeOvIxFFRI+0sEtqDqy2b4A==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-ease": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@types/d3-ease/-/d3-ease-3.0.2.tgz",
+      "integrity": "sha512-NcV1JjO5oDzoK26oMzbILE6HW7uVXOHLQvHshBUW4UMdZGfiY6v5BeQwh9a9tCzv+CeefZQHJt5SRgK154RtiA==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-interpolate": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@types/d3-interpolate/-/d3-interpolate-3.0.4.tgz",
+      "integrity": "sha512-mgLPETlrpVV1YRJIglr4Ez47g7Yxjl1lj7YKsiMCb27VJH9W8NVM6Bb9d8kkpG/uAQS5AmbA48q2IAolKKo1MA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/d3-color": "*"
+      }
+    },
+    "node_modules/@types/d3-path": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-path/-/d3-path-3.1.1.tgz",
+      "integrity": "sha512-VMZBYyQvbGmWyWVea0EHs/BwLgxc+MKi1zLDCONksozI4YJMcTt8ZEuIR4Sb1MMTE8MMW49v0IwI5+b7RmfWlg==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-scale": {
+      "version": "4.0.9",
+      "resolved": "https://registry.npmjs.org/@types/d3-scale/-/d3-scale-4.0.9.tgz",
+      "integrity": "sha512-dLmtwB8zkAeO/juAMfnV+sItKjlsw2lKdZVVy6LRr0cBmegxSABiLEpGVmSJJ8O08i4+sGR6qQtb6WtuwJdvVw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/d3-time": "*"
+      }
+    },
+    "node_modules/@types/d3-shape": {
+      "version": "3.1.8",
+      "resolved": "https://registry.npmjs.org/@types/d3-shape/-/d3-shape-3.1.8.tgz",
+      "integrity": "sha512-lae0iWfcDeR7qt7rA88BNiqdvPS5pFVPpo5OfjElwNaT2yyekbM0C9vK+yqBqEmHr6lDkRnYNoTBYlAgJa7a4w==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/d3-path": "*"
+      }
+    },
+    "node_modules/@types/d3-time": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@types/d3-time/-/d3-time-3.0.4.tgz",
+      "integrity": "sha512-yuzZug1nkAAaBlBBikKZTgzCeA+k1uy4ZFwWANOfKw5z5LRhV0gNA7gNkKm7HoK+HRN0wX3EkxGk0fpbWhmB7g==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-timer": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@types/d3-timer/-/d3-timer-3.0.2.tgz",
+      "integrity": "sha512-Ps3T8E8dZDam6fUyNiMkekK3XUsaUEik+idO9/YjPtfj2qruF8tFBXS7XhtE4iIXBLxhmLjP3SXpLhVf21I9Lw==",
+      "license": "MIT"
+    },
+    "node_modules/@types/estree": {
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
+      "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/node": {
+      "version": "22.20.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.0.tgz",
+      "integrity": "sha512-QWlFW2wf3nTjC13/DqRnBpR4ZO36VJH/JVBkA/vcnmbTBNQIlnObqyqZE1tUR7+Ni23Lda8R1BxMfbXRpCUx5g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~6.21.0"
+      }
+    },
+    "node_modules/@types/react": {
+      "version": "19.2.17",
+      "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.17.tgz",
+      "integrity": "sha512-MXfmqaVPEVgkBT/aY0aGCkRWWtByiYQXo3xdQ8r5RzuFrPiRn8Gar2tQdXSUQ2GKV3bkXckek89V8wQBY2Q/Aw==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "csstype": "^3.2.2"
+      }
+    },
+    "node_modules/@types/react-dom": {
+      "version": "19.2.3",
+      "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-19.2.3.tgz",
+      "integrity": "sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ==",
+      "devOptional": true,
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "^19.2.0"
+      }
+    },
+    "node_modules/@types/use-sync-external-store": {
+      "version": "0.0.6",
+      "resolved": "https://registry.npmjs.org/@types/use-sync-external-store/-/use-sync-external-store-0.0.6.tgz",
+      "integrity": "sha512-zFDAD+tlpf2r4asuHEj0XH6pY6i0g5NeAHPn+15wk3BV6JA69eERFXC1gyGThDkVa1zCyKr5jox1+2LbV/AMLg==",
+      "license": "MIT"
+    },
+    "node_modules/@vitejs/plugin-react": {
+      "version": "4.7.0",
+      "resolved": "https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-4.7.0.tgz",
+      "integrity": "sha512-gUu9hwfWvvEDBBmgtAowQCojwZmJ5mcLn3aufeCsitijs3+f2NsrPtlAWIR6OPiqljl96GVCUbLe0HyqIpVaoA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/core": "^7.28.0",
+        "@babel/plugin-transform-react-jsx-self": "^7.27.1",
+        "@babel/plugin-transform-react-jsx-source": "^7.27.1",
+        "@rolldown/pluginutils": "1.0.0-beta.27",
+        "@types/babel__core": "^7.20.5",
+        "react-refresh": "^0.17.0"
+      },
+      "engines": {
+        "node": "^14.18.0 || >=16.0.0"
+      },
+      "peerDependencies": {
+        "vite": "^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0"
+      }
+    },
+    "node_modules/aria-hidden": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/aria-hidden/-/aria-hidden-1.2.6.tgz",
+      "integrity": "sha512-ik3ZgC9dY/lYVVM++OISsaYDeg1tb0VtP5uL3ouh1koGOaUMDPpbFIei4JkFimWUFPn90sbMNMXQAIVOlnYKJA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/baseline-browser-mapping": {
+      "version": "2.10.40",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.40.tgz",
+      "integrity": "sha512-BSSLZ9/Cjjv7Gtj5B68ZzXcXUg8iOf3fme+FCuh8rC/Go+Kmh8cox7M3A8dolou16s64QjLPOSdngh7GxXvkSw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "baseline-browser-mapping": "dist/cli.cjs"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/browserslist": {
+      "version": "4.28.4",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.4.tgz",
+      "integrity": "sha512-MTc8i/x9jBQd1iMw2CFGS+rwMa07eYjLR0CCTLDACl9xhxy+nIs3KeML/biicXtk9JrZ6dnnTatmc7ErPXIxqw==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/browserslist"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "baseline-browser-mapping": "^2.10.38",
+        "caniuse-lite": "^1.0.30001799",
+        "electron-to-chromium": "^1.5.376",
+        "node-releases": "^2.0.48",
+        "update-browserslist-db": "^1.2.3"
+      },
+      "bin": {
+        "browserslist": "cli.js"
+      },
+      "engines": {
+        "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7"
+      }
+    },
+    "node_modules/caniuse-lite": {
+      "version": "1.0.30001799",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001799.tgz",
+      "integrity": "sha512-hG1bReV+OUU+MOqK4t/ZWI0tZOyz3rqS9XuhOUz1cIcbwBKjOyJEJuw9ER5JuNyqxNk8u/JUVbGibBOL1yrjFw==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/caniuse-lite"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "CC-BY-4.0"
+    },
+    "node_modules/class-variance-authority": {
+      "version": "0.7.1",
+      "resolved": "https://registry.npmjs.org/class-variance-authority/-/class-variance-authority-0.7.1.tgz",
+      "integrity": "sha512-Ka+9Trutv7G8M6WT6SeiRWz792K5qEqIGEGzXKhAE6xOWAY6pPH8U+9IY3oCMv6kqTmLsv7Xh/2w2RigkePMsg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "clsx": "^2.1.1"
+      },
+      "funding": {
+        "url": "https://polar.sh/cva"
+      }
+    },
+    "node_modules/clsx": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/clsx/-/clsx-2.1.1.tgz",
+      "integrity": "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/cmdk": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/cmdk/-/cmdk-1.1.1.tgz",
+      "integrity": "sha512-Vsv7kFaXm+ptHDMZ7izaRsP70GgrW9NBNGswt9OZaVBLlE0SNpDq8eu/VGXyF9r7M0azK3Wy7OlYXsuyYLFzHg==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-compose-refs": "^1.1.1",
+        "@radix-ui/react-dialog": "^1.1.6",
+        "@radix-ui/react-id": "^1.1.0",
+        "@radix-ui/react-primitive": "^2.0.2"
+      },
+      "peerDependencies": {
+        "react": "^18 || ^19 || ^19.0.0-rc",
+        "react-dom": "^18 || ^19 || ^19.0.0-rc"
+      }
+    },
+    "node_modules/convert-source-map": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
+      "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/csstype": {
+      "version": "3.2.3",
+      "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz",
+      "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
+      "devOptional": true,
+      "license": "MIT"
+    },
+    "node_modules/d3-array": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/d3-array/-/d3-array-3.2.4.tgz",
+      "integrity": "sha512-tdQAmyA18i4J7wprpYq8ClcxZy3SC31QMeByyCFyRt7BVHdREQZ5lpzoe5mFEYZUWe+oq8HBvk9JjpibyEV4Jg==",
+      "license": "ISC",
+      "dependencies": {
+        "internmap": "1 - 2"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-color": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-color/-/d3-color-3.1.0.tgz",
+      "integrity": "sha512-zg/chbXyeBtMQ1LbD/WSoW2DpC3I0mpmPdW+ynRTj/x2DAWYrIY7qeZIHidozwV24m4iavr15lNwIwLxRmOxhA==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-ease": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/d3-ease/-/d3-ease-3.0.1.tgz",
+      "integrity": "sha512-wR/XK3D3XcLIZwpbvQwQ5fK+8Ykds1ip7A2Txe0yxncXSdq1L9skcG7blcedkOX+ZcgxGAmLX1FrRGbADwzi0w==",
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-format": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/d3-format/-/d3-format-3.1.2.tgz",
+      "integrity": "sha512-AJDdYOdnyRDV5b6ArilzCPPwc1ejkHcoyFarqlPqT7zRYjhavcT3uSrqcMvsgh2CgoPbK3RCwyHaVyxYcP2Arg==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-interpolate": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/d3-interpolate/-/d3-interpolate-3.0.1.tgz",
+      "integrity": "sha512-3bYs1rOD33uo8aqJfKP3JWPAibgw8Zm2+L9vBKEHJ2Rg+viTR7o5Mmv5mZcieN+FRYaAOWX5SJATX6k1PWz72g==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-color": "1 - 3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-path": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-path/-/d3-path-3.1.0.tgz",
+      "integrity": "sha512-p3KP5HCf/bvjBSSKuXid6Zqijx7wIfNW+J/maPs+iwR35at5JCbLUT0LzF1cnjbCHWhqzQTIN2Jpe8pRebIEFQ==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-scale": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/d3-scale/-/d3-scale-4.0.2.tgz",
+      "integrity": "sha512-GZW464g1SH7ag3Y7hXjf8RoUuAFIqklOAq3MRl4OaWabTFJY9PN/E1YklhXLh+OQ3fM9yS2nOkCoS+WLZ6kvxQ==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-array": "2.10.0 - 3",
+        "d3-format": "1 - 3",
+        "d3-interpolate": "1.2.0 - 3",
+        "d3-time": "2.1.1 - 3",
+        "d3-time-format": "2 - 4"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-shape": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/d3-shape/-/d3-shape-3.2.0.tgz",
+      "integrity": "sha512-SaLBuwGm3MOViRq2ABk3eLoxwZELpH6zhl3FbAoJ7Vm1gofKx6El1Ib5z23NUEhF9AsGl7y+dzLe5Cw2AArGTA==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-path": "^3.1.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-time": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-time/-/d3-time-3.1.0.tgz",
+      "integrity": "sha512-VqKjzBLejbSMT4IgbmVgDjpkYrNWUYJnbCGo874u7MMKIWsILRX+OpX/gTk8MqjpT1A/c6HY2dCA77ZN0lkQ2Q==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-array": "2 - 3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-time-format": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/d3-time-format/-/d3-time-format-4.1.0.tgz",
+      "integrity": "sha512-dJxPBlzC7NugB2PDLwo9Q8JiTR3M3e4/XANkreKSUxF8vvXKqm1Yfq4Q5dl8budlunRVlUUaDUgFt7eA8D6NLg==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-time": "1 - 3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-timer": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/d3-timer/-/d3-timer-3.0.1.tgz",
+      "integrity": "sha512-ndfJ/JxxMd3nw31uyKoY2naivF+r29V+Lc0svZxe1JvvIRmi8hUsrMvdOwgS1o6uBHmiz91geQ0ylPP0aj1VUA==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/date-fns": {
+      "version": "4.4.0",
+      "resolved": "https://registry.npmjs.org/date-fns/-/date-fns-4.4.0.tgz",
+      "integrity": "sha512-+1UMbeh68lH1SegH83CGWwpb6OHHbpSgr3+s5Eww5M4CAgswBpoWS0AjTOfEJ33HiYKz1hdj/KTFprzXHmq/6w==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/kossnocorp"
+      }
+    },
+    "node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/decimal.js-light": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/decimal.js-light/-/decimal.js-light-2.5.1.tgz",
+      "integrity": "sha512-qIMFpTMZmny+MMIitAB6D7iVPEorVw6YQRWkvarTkT4tBeSLLiHzcwj6q0MmYSFCiVpiqPJTJEYIrpcPzVEIvg==",
+      "license": "MIT"
+    },
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/detect-node-es": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/detect-node-es/-/detect-node-es-1.1.0.tgz",
+      "integrity": "sha512-ypdmJU/TbBby2Dxibuv7ZLW3Bs1QEmM7nHjEANfohJLvE0XVujisn1qPJcZxg+qDucsr+bP6fLD1rPS3AhJ7EQ==",
+      "license": "MIT"
+    },
+    "node_modules/electron-to-chromium": {
+      "version": "1.5.379",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.379.tgz",
+      "integrity": "sha512-v/qV5aV5EUA2pGilzUCq5/eyOloZAqDZBu9UMBIzgPpLlprjSR6zswsWBTv0KpqxLGUAZEwhO95ZCt7srymNVA==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/embla-carousel": {
+      "version": "8.6.0",
+      "resolved": "https://registry.npmjs.org/embla-carousel/-/embla-carousel-8.6.0.tgz",
+      "integrity": "sha512-SjWyZBHJPbqxHOzckOfo8lHisEaJWmwd23XppYFYVh10bU66/Pn5tkVkbkCMZVdbUE5eTCI2nD8OyIP4Z+uwkA==",
+      "license": "MIT"
+    },
+    "node_modules/embla-carousel-react": {
+      "version": "8.6.0",
+      "resolved": "https://registry.npmjs.org/embla-carousel-react/-/embla-carousel-react-8.6.0.tgz",
+      "integrity": "sha512-0/PjqU7geVmo6F734pmPqpyHqiM99olvyecY7zdweCw+6tKEXnrE90pBiBbMMU8s5tICemzpQ3hi5EpxzGW+JA==",
+      "license": "MIT",
+      "dependencies": {
+        "embla-carousel": "8.6.0",
+        "embla-carousel-reactive-utils": "8.6.0"
+      },
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17.0.1 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc"
+      }
+    },
+    "node_modules/embla-carousel-reactive-utils": {
+      "version": "8.6.0",
+      "resolved": "https://registry.npmjs.org/embla-carousel-reactive-utils/-/embla-carousel-reactive-utils-8.6.0.tgz",
+      "integrity": "sha512-fMVUDUEx0/uIEDM0Mz3dHznDhfX+znCCDCeIophYb1QGVM7YThSWX+wz11zlYwWFOr74b4QLGg0hrGPJeG2s4A==",
+      "license": "MIT",
+      "peerDependencies": {
+        "embla-carousel": "8.6.0"
+      }
+    },
+    "node_modules/enhanced-resolve": {
+      "version": "5.21.6",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.21.6.tgz",
+      "integrity": "sha512-aNnGCvbJ/RIyWo1IuhNdVjnNF+EjH9wpzpNHt+ci/m9He9LJvUN8wrCcXjp9cWsGNAuvSpVFTx/vraAFQ8qGjQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "graceful-fs": "^4.2.4",
+        "tapable": "^2.3.3"
+      },
+      "engines": {
+        "node": ">=10.13.0"
+      }
+    },
+    "node_modules/es-toolkit": {
+      "version": "1.49.0",
+      "resolved": "https://registry.npmjs.org/es-toolkit/-/es-toolkit-1.49.0.tgz",
+      "integrity": "sha512-G5iZ6Pc/FNRY/soKZHC+TxGDD83rHUDXxzaWhGCX44vAv/tMs56WMusnm/KMNK+luUPsgA9U28cGr4RDlSzL2g==",
+      "license": "MIT",
+      "workspaces": [
+        "docs",
+        "benchmarks"
+      ]
+    },
+    "node_modules/esbuild": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz",
+      "integrity": "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.25.12",
+        "@esbuild/android-arm": "0.25.12",
+        "@esbuild/android-arm64": "0.25.12",
+        "@esbuild/android-x64": "0.25.12",
+        "@esbuild/darwin-arm64": "0.25.12",
+        "@esbuild/darwin-x64": "0.25.12",
+        "@esbuild/freebsd-arm64": "0.25.12",
+        "@esbuild/freebsd-x64": "0.25.12",
+        "@esbuild/linux-arm": "0.25.12",
+        "@esbuild/linux-arm64": "0.25.12",
+        "@esbuild/linux-ia32": "0.25.12",
+        "@esbuild/linux-loong64": "0.25.12",
+        "@esbuild/linux-mips64el": "0.25.12",
+        "@esbuild/linux-ppc64": "0.25.12",
+        "@esbuild/linux-riscv64": "0.25.12",
+        "@esbuild/linux-s390x": "0.25.12",
+        "@esbuild/linux-x64": "0.25.12",
+        "@esbuild/netbsd-arm64": "0.25.12",
+        "@esbuild/netbsd-x64": "0.25.12",
+        "@esbuild/openbsd-arm64": "0.25.12",
+        "@esbuild/openbsd-x64": "0.25.12",
+        "@esbuild/openharmony-arm64": "0.25.12",
+        "@esbuild/sunos-x64": "0.25.12",
+        "@esbuild/win32-arm64": "0.25.12",
+        "@esbuild/win32-ia32": "0.25.12",
+        "@esbuild/win32-x64": "0.25.12"
+      }
+    },
+    "node_modules/escalade": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
+      "integrity": "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/eventemitter3": {
+      "version": "5.0.4",
+      "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-5.0.4.tgz",
+      "integrity": "sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw==",
+      "license": "MIT"
+    },
+    "node_modules/fdir": {
+      "version": "6.5.0",
+      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
+      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "peerDependencies": {
+        "picomatch": "^3 || ^4"
+      },
+      "peerDependenciesMeta": {
+        "picomatch": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/gensync": {
+      "version": "1.0.0-beta.2",
+      "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz",
+      "integrity": "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/get-nonce": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-nonce/-/get-nonce-1.0.1.tgz",
+      "integrity": "sha512-FJhYRoDaiatfEkUK8HKlicmu/3SGFD51q3itKDGoSTysQJBnfOcxU5GxnhE1E6soB76MbT0MBtnKJuXyAx+96Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/graceful-fs": {
+      "version": "4.2.11",
+      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
+      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/immer": {
+      "version": "10.2.0",
+      "resolved": "https://registry.npmjs.org/immer/-/immer-10.2.0.tgz",
+      "integrity": "sha512-d/+XTN3zfODyjr89gM3mPq1WNX2B8pYsu7eORitdwyA2sBubnTl3laYlBk4sXY5FUa5qTZGBDPJICVbvqzjlbw==",
+      "license": "MIT",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/immer"
+      }
+    },
+    "node_modules/input-otp": {
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/input-otp/-/input-otp-1.4.2.tgz",
+      "integrity": "sha512-l3jWwYNvrEa6NTCt7BECfCm48GvwuZzkoeG3gBL2w4CHeOXW3eKFmf9UNYkNfYc3mxMrthMnxjIE07MT0zLBQA==",
+      "license": "MIT",
+      "peerDependencies": {
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0.0 || ^19.0.0-rc"
+      }
+    },
+    "node_modules/internmap": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/internmap/-/internmap-2.0.3.tgz",
+      "integrity": "sha512-5Hh7Y1wQbvY5ooGgPbDaL5iYLAPzMTUrjMulskHLH6wnv/A+1q5rgEaiuqEjB+oxGXIVZs1FF+R/KPN3ZSQYYg==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/jiti": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.7.0.tgz",
+      "integrity": "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "jiti": "lib/jiti-cli.mjs"
+      }
+    },
+    "node_modules/js-tokens": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
+      "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/jsesc": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz",
+      "integrity": "sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "jsesc": "bin/jsesc"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/json5": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "json5": "lib/cli.js"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/lightningcss": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.32.0.tgz",
+      "integrity": "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==",
+      "dev": true,
+      "license": "MPL-2.0",
+      "dependencies": {
+        "detect-libc": "^2.0.3"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      },
+      "optionalDependencies": {
+        "lightningcss-android-arm64": "1.32.0",
+        "lightningcss-darwin-arm64": "1.32.0",
+        "lightningcss-darwin-x64": "1.32.0",
+        "lightningcss-freebsd-x64": "1.32.0",
+        "lightningcss-linux-arm-gnueabihf": "1.32.0",
+        "lightningcss-linux-arm64-gnu": "1.32.0",
+        "lightningcss-linux-arm64-musl": "1.32.0",
+        "lightningcss-linux-x64-gnu": "1.32.0",
+        "lightningcss-linux-x64-musl": "1.32.0",
+        "lightningcss-win32-arm64-msvc": "1.32.0",
+        "lightningcss-win32-x64-msvc": "1.32.0"
+      }
+    },
+    "node_modules/lightningcss-android-arm64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.32.0.tgz",
+      "integrity": "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-darwin-arm64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.32.0.tgz",
+      "integrity": "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-darwin-x64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.32.0.tgz",
+      "integrity": "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-freebsd-x64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.32.0.tgz",
+      "integrity": "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm-gnueabihf": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.32.0.tgz",
+      "integrity": "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-gnu": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.32.0.tgz",
+      "integrity": "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-musl": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.32.0.tgz",
+      "integrity": "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-gnu": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.32.0.tgz",
+      "integrity": "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-musl": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.32.0.tgz",
+      "integrity": "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-arm64-msvc": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.32.0.tgz",
+      "integrity": "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-x64-msvc": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.32.0.tgz",
+      "integrity": "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lru-cache": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz",
+      "integrity": "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "yallist": "^3.0.2"
+      }
+    },
+    "node_modules/lucide-react": {
+      "version": "1.21.0",
+      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-1.21.0.tgz",
+      "integrity": "sha512-reEZMXq8Qdd5jg5XYkQ5TR1fB/GiQ7ih4vcrthYDtgjSDwh0i6/YLiGjsWsIwgN49gpAnd4J2elSNzncMEEUUQ==",
+      "license": "ISC",
+      "peerDependencies": {
+        "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+      }
+    },
+    "node_modules/magic-string": {
+      "version": "0.30.21",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
+      "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.5"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/nanoid": {
+      "version": "3.3.15",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.15.tgz",
+      "integrity": "sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "bin": {
+        "nanoid": "bin/nanoid.cjs"
+      },
+      "engines": {
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+      }
+    },
+    "node_modules/next-themes": {
+      "version": "0.4.6",
+      "resolved": "https://registry.npmjs.org/next-themes/-/next-themes-0.4.6.tgz",
+      "integrity": "sha512-pZvgD5L0IEvX5/9GWyHMf3m8BKiVQwsCMHfoFosXtXBMnaS0ZnIJ9ST4b4NqLVKDEm8QBxoNNGNaBv2JNF6XNA==",
+      "license": "MIT",
+      "peerDependencies": {
+        "react": "^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc"
+      }
+    },
+    "node_modules/node-releases": {
+      "version": "2.0.50",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.50.tgz",
+      "integrity": "sha512-J6l92tKHX6w8Jy5nO1Vuc01NoIiRGi/d6qBKVxh+IQ8Cr3b6HbVNfKiF8ZpFKufTwpwxMmce2W3iQZ861ZRyTg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/picocolors": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
+      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/picomatch": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/postcss": {
+      "version": "8.5.15",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
+      "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/postcss"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "nanoid": "^3.3.12",
+        "picocolors": "^1.1.1",
+        "source-map-js": "^1.2.1"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14"
+      }
+    },
+    "node_modules/radix-ui": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/radix-ui/-/radix-ui-1.6.0.tgz",
+      "integrity": "sha512-EUEC70O03EgxWMP5aoqfBZ6iLC5bczFagGy7zhSYRt8o5DP7IWNiP3ywetse3L9b8843ExB0OGWZvgbYVJuNeg==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-accessible-icon": "1.1.10",
+        "@radix-ui/react-accordion": "1.2.14",
+        "@radix-ui/react-alert-dialog": "1.1.17",
+        "@radix-ui/react-arrow": "1.1.10",
+        "@radix-ui/react-aspect-ratio": "1.1.10",
+        "@radix-ui/react-avatar": "1.2.0",
+        "@radix-ui/react-checkbox": "1.3.5",
+        "@radix-ui/react-collapsible": "1.1.14",
+        "@radix-ui/react-collection": "1.1.10",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-context-menu": "2.3.1",
+        "@radix-ui/react-dialog": "1.1.17",
+        "@radix-ui/react-direction": "1.1.2",
+        "@radix-ui/react-dismissable-layer": "1.1.13",
+        "@radix-ui/react-dropdown-menu": "2.1.18",
+        "@radix-ui/react-focus-guards": "1.1.4",
+        "@radix-ui/react-focus-scope": "1.1.10",
+        "@radix-ui/react-form": "0.1.10",
+        "@radix-ui/react-hover-card": "1.1.17",
+        "@radix-ui/react-label": "2.1.10",
+        "@radix-ui/react-menu": "2.1.18",
+        "@radix-ui/react-menubar": "1.1.18",
+        "@radix-ui/react-navigation-menu": "1.2.16",
+        "@radix-ui/react-one-time-password-field": "0.1.10",
+        "@radix-ui/react-password-toggle-field": "0.1.5",
+        "@radix-ui/react-popover": "1.1.17",
+        "@radix-ui/react-popper": "1.3.1",
+        "@radix-ui/react-portal": "1.1.12",
+        "@radix-ui/react-presence": "1.1.6",
+        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-progress": "1.1.10",
+        "@radix-ui/react-radio-group": "1.4.1",
+        "@radix-ui/react-roving-focus": "1.1.13",
+        "@radix-ui/react-scroll-area": "1.2.12",
+        "@radix-ui/react-select": "2.3.1",
+        "@radix-ui/react-separator": "1.1.10",
+        "@radix-ui/react-slider": "1.4.1",
+        "@radix-ui/react-slot": "1.3.0",
+        "@radix-ui/react-switch": "1.3.1",
+        "@radix-ui/react-tabs": "1.1.15",
+        "@radix-ui/react-toast": "1.2.17",
+        "@radix-ui/react-toggle": "1.1.12",
+        "@radix-ui/react-toggle-group": "1.1.13",
+        "@radix-ui/react-toolbar": "1.1.13",
+        "@radix-ui/react-tooltip": "1.2.10",
+        "@radix-ui/react-use-callback-ref": "1.1.2",
+        "@radix-ui/react-use-controllable-state": "1.2.3",
+        "@radix-ui/react-use-effect-event": "0.0.3",
+        "@radix-ui/react-use-escape-keydown": "1.1.2",
+        "@radix-ui/react-use-is-hydrated": "0.1.1",
+        "@radix-ui/react-use-layout-effect": "1.1.2",
+        "@radix-ui/react-use-size": "1.1.2",
+        "@radix-ui/react-visually-hidden": "1.2.6"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/react": {
+      "version": "19.2.7",
+      "resolved": "https://registry.npmjs.org/react/-/react-19.2.7.tgz",
+      "integrity": "sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/react-day-picker": {
+      "version": "10.0.1",
+      "resolved": "https://registry.npmjs.org/react-day-picker/-/react-day-picker-10.0.1.tgz",
+      "integrity": "sha512-eNh6BlwcYInWaJtRv18mXQ06Ys/H6rdTZAnTaSdOYJuTpwP1JMCHNd1FDRadA+gbeinq+psdULN5Xnowy9mV8w==",
+      "license": "MIT",
+      "dependencies": {
+        "@date-fns/tz": "^1.4.1",
+        "date-fns": "^4.1.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "individual",
+        "url": "https://github.com/sponsors/gpbl"
+      },
+      "peerDependencies": {
+        "@types/react": ">=16.8.0",
+        "react": ">=16.8.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/react-dom": {
+      "version": "19.2.7",
+      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.7.tgz",
+      "integrity": "sha512-t0BRVXvbiE/o20Hfw669rLbMCDWtYZLvmJigy2f0MxsXF+71pxhR3xOkspmsO8h3ZlNzyibAmtCa3l4lYKk6gQ==",
+      "license": "MIT",
+      "dependencies": {
+        "scheduler": "^0.27.0"
+      },
+      "peerDependencies": {
+        "react": "^19.2.7"
+      }
+    },
+    "node_modules/react-hook-form": {
+      "version": "7.80.0",
+      "resolved": "https://registry.npmjs.org/react-hook-form/-/react-hook-form-7.80.0.tgz",
+      "integrity": "sha512-4P+fk6oXsxY+6xSj7Euhc2sumQD8zQqCuVHoJwoyp9EchP+IUW9OESB7uHFJOKsIBQ4MQqYE84INJFqUCYNoOg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/react-hook-form"
+      },
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17 || ^18 || ^19"
+      }
+    },
+    "node_modules/react-is": {
+      "version": "19.2.7",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-19.2.7.tgz",
+      "integrity": "sha512-kZFnouyVv7eP/Phmrlo9FK+zcAdriZJvzxXHF1Sl1P377WSGe2G/JxVolhTrB/jeV47lKImhNUsijjHAAbcl/A==",
+      "license": "MIT",
+      "peer": true
+    },
+    "node_modules/react-redux": {
+      "version": "9.3.0",
+      "resolved": "https://registry.npmjs.org/react-redux/-/react-redux-9.3.0.tgz",
+      "integrity": "sha512-KQopgqFo/p/fgmAs5qz6p5RWaNAzq40WAu7fJIXnQpYxFPbJYtsJPWvGeF2rOBaY/kEuV77AVsX8TsQzKm+A/g==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/use-sync-external-store": "^0.0.6",
+        "use-sync-external-store": "^1.4.0"
+      },
+      "peerDependencies": {
+        "@types/react": "^18.2.25 || ^19",
+        "react": "^18.0 || ^19",
+        "redux": "^5.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "redux": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/react-refresh": {
+      "version": "0.17.0",
+      "resolved": "https://registry.npmjs.org/react-refresh/-/react-refresh-0.17.0.tgz",
+      "integrity": "sha512-z6F7K9bV85EfseRCp2bzrpyQ0Gkw1uLoCel9XBVWPg/TjRj94SkJzUTGfOa4bs7iJvBWtQG0Wq7wnI0syw3EBQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/react-remove-scroll": {
+      "version": "2.7.2",
+      "resolved": "https://registry.npmjs.org/react-remove-scroll/-/react-remove-scroll-2.7.2.tgz",
+      "integrity": "sha512-Iqb9NjCCTt6Hf+vOdNIZGdTiH1QSqr27H/Ek9sv/a97gfueI/5h1s3yRi1nngzMUaOOToin5dI1dXKdXiF+u0Q==",
+      "license": "MIT",
+      "dependencies": {
+        "react-remove-scroll-bar": "^2.3.7",
+        "react-style-singleton": "^2.2.3",
+        "tslib": "^2.1.0",
+        "use-callback-ref": "^1.3.3",
+        "use-sidecar": "^1.1.3"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/react-remove-scroll-bar": {
+      "version": "2.3.8",
+      "resolved": "https://registry.npmjs.org/react-remove-scroll-bar/-/react-remove-scroll-bar-2.3.8.tgz",
+      "integrity": "sha512-9r+yi9+mgU33AKcj6IbT9oRCO78WriSj6t/cF8DWBZJ9aOGPOTEDvdUDz1FwKim7QXWwmHqtdHnRJfhAxEG46Q==",
+      "license": "MIT",
+      "dependencies": {
+        "react-style-singleton": "^2.2.2",
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/react-resizable-panels": {
+      "version": "4.11.2",
+      "resolved": "https://registry.npmjs.org/react-resizable-panels/-/react-resizable-panels-4.11.2.tgz",
+      "integrity": "sha512-+kfFbDZ8mygc7g0vxOcDzCVGuwiIUOnILqPoUHo6/uP+Mmyx6HzZU+kj1aOPDlktXuobYbr6BtQekvJwHRX4Eg==",
+      "license": "MIT",
+      "peerDependencies": {
+        "react": "^18.0.0 || ^19.0.0",
+        "react-dom": "^18.0.0 || ^19.0.0"
+      }
+    },
+    "node_modules/react-style-singleton": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/react-style-singleton/-/react-style-singleton-2.2.3.tgz",
+      "integrity": "sha512-b6jSvxvVnyptAiLjbkWLE/lOnR4lfTtDAl+eUC7RZy+QQWc6wRzIV2CE6xBuMmDxc2qIihtDCZD5NPOFl7fRBQ==",
+      "license": "MIT",
+      "dependencies": {
+        "get-nonce": "^1.0.0",
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/recharts": {
+      "version": "3.9.0",
+      "resolved": "https://registry.npmjs.org/recharts/-/recharts-3.9.0.tgz",
+      "integrity": "sha512-dCEcE9y20c8H2tkVeByrAXhhnBJk6/QLbxKmn+dJUptOfc5NMjwRh1jo0vZPRLD+5dMrHrP+hPEsfbGBMfnf5Q==",
+      "license": "MIT",
+      "workspaces": [
+        "www"
+      ],
+      "dependencies": {
+        "@reduxjs/toolkit": "^1.9.0 || 2.x.x",
+        "clsx": "^2.1.1",
+        "decimal.js-light": "^2.5.1",
+        "es-toolkit": "^1.39.3",
+        "eventemitter3": "^5.0.1",
+        "immer": "^10.1.1",
+        "react-redux": "8.x.x || 9.x.x",
+        "reselect": "5.2.0",
+        "tiny-invariant": "^1.3.3",
+        "use-sync-external-store": "^1.2.2",
+        "victory-vendor": "^37.0.2"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
+        "react-dom": "^16.0.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
+        "react-is": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+      }
+    },
+    "node_modules/redux": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/redux/-/redux-5.0.1.tgz",
+      "integrity": "sha512-M9/ELqF6fy8FwmkpnF0S3YKOqMyoWJ4+CS5Efg2ct3oY9daQvd/Pc71FpGZsVsbl3Cpb+IIcjBDUnnyBdQbq4w==",
+      "license": "MIT"
+    },
+    "node_modules/redux-thunk": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/redux-thunk/-/redux-thunk-3.1.0.tgz",
+      "integrity": "sha512-NW2r5T6ksUKXCabzhL9z+h206HQw/NJkcLm1GPImRQ8IzfXwRGqjVhKJGauHirT0DAuyy6hjdnMZaRoAcy0Klw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "redux": "^5.0.0"
+      }
+    },
+    "node_modules/reselect": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/reselect/-/reselect-5.2.0.tgz",
+      "integrity": "sha512-AgZ3UOZm3YndfrJ4OYjgrT7bmCm/1iqkjvEfH/oYjzh6PD2qw4QuT3jjnXIrpdt4MTpMXclMT3lXbmRY+XRakw==",
+      "license": "MIT"
+    },
+    "node_modules/rollup": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.62.2.tgz",
+      "integrity": "sha512-RFnrW4lhXA3s3eqHDZvN654g8OTjzRfqpIRJYczCGB6HzphckVAi/Qh4tbPUbRuDi7s1Llv8g/NspLkttY3gTA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "1.0.9"
+      },
+      "bin": {
+        "rollup": "dist/bin/rollup"
+      },
+      "engines": {
+        "node": ">=18.0.0",
+        "npm": ">=8.0.0"
+      },
+      "optionalDependencies": {
+        "@rollup/rollup-android-arm-eabi": "4.62.2",
+        "@rollup/rollup-android-arm64": "4.62.2",
+        "@rollup/rollup-darwin-arm64": "4.62.2",
+        "@rollup/rollup-darwin-x64": "4.62.2",
+        "@rollup/rollup-freebsd-arm64": "4.62.2",
+        "@rollup/rollup-freebsd-x64": "4.62.2",
+        "@rollup/rollup-linux-arm-gnueabihf": "4.62.2",
+        "@rollup/rollup-linux-arm-musleabihf": "4.62.2",
+        "@rollup/rollup-linux-arm64-gnu": "4.62.2",
+        "@rollup/rollup-linux-arm64-musl": "4.62.2",
+        "@rollup/rollup-linux-loong64-gnu": "4.62.2",
+        "@rollup/rollup-linux-loong64-musl": "4.62.2",
+        "@rollup/rollup-linux-ppc64-gnu": "4.62.2",
+        "@rollup/rollup-linux-ppc64-musl": "4.62.2",
+        "@rollup/rollup-linux-riscv64-gnu": "4.62.2",
+        "@rollup/rollup-linux-riscv64-musl": "4.62.2",
+        "@rollup/rollup-linux-s390x-gnu": "4.62.2",
+        "@rollup/rollup-linux-x64-gnu": "4.62.2",
+        "@rollup/rollup-linux-x64-musl": "4.62.2",
+        "@rollup/rollup-openbsd-x64": "4.62.2",
+        "@rollup/rollup-openharmony-arm64": "4.62.2",
+        "@rollup/rollup-win32-arm64-msvc": "4.62.2",
+        "@rollup/rollup-win32-ia32-msvc": "4.62.2",
+        "@rollup/rollup-win32-x64-gnu": "4.62.2",
+        "@rollup/rollup-win32-x64-msvc": "4.62.2",
+        "fsevents": "~2.3.2"
+      }
+    },
+    "node_modules/scheduler": {
+      "version": "0.27.0",
+      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz",
+      "integrity": "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==",
+      "license": "MIT"
+    },
+    "node_modules/semver": {
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      }
+    },
+    "node_modules/sonner": {
+      "version": "1.7.4",
+      "resolved": "https://registry.npmjs.org/sonner/-/sonner-1.7.4.tgz",
+      "integrity": "sha512-DIS8z4PfJRbIyfVFDVnK9rO3eYDtse4Omcm6bt0oEr5/jtLgysmjuBl1frJ9E/EQZrFmKx2A8m/s5s9CRXIzhw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "react": "^18.0.0 || ^19.0.0 || ^19.0.0-rc",
+        "react-dom": "^18.0.0 || ^19.0.0 || ^19.0.0-rc"
+      }
+    },
+    "node_modules/source-map-js": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
+      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/tailwind-merge": {
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/tailwind-merge/-/tailwind-merge-3.6.0.tgz",
+      "integrity": "sha512-uxL7qAVQriqRQPAyK3pj66VqskWqoZ37PW94jwOTwNfq/z9oyu1V+eqrZqtR2+fCiXdYOZe/Modt8GtvqNzu+w==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/dcastil"
+      }
+    },
+    "node_modules/tailwindcss": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.3.1.tgz",
+      "integrity": "sha512-hk+TB1m+K8CYNrP6rjQaq/Y+4Zylwpa87mLYBKCunwnnQ9p+fHb7kmSfGqyEJoxF/O6CDyABWVFEafNSYKll+Q==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tapable": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.3.tgz",
+      "integrity": "sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      }
+    },
+    "node_modules/tiny-invariant": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/tiny-invariant/-/tiny-invariant-1.3.3.tgz",
+      "integrity": "sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg==",
+      "license": "MIT"
+    },
+    "node_modules/tinyglobby": {
+      "version": "0.2.17",
+      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
+      "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fdir": "^6.5.0",
+        "picomatch": "^4.0.4"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/SuperchupuDev"
+      }
+    },
+    "node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
+    "node_modules/typescript": {
+      "version": "5.9.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
+      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "6.21.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
+      "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/update-browserslist-db": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
+      "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/browserslist"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "escalade": "^3.2.0",
+        "picocolors": "^1.1.1"
+      },
+      "bin": {
+        "update-browserslist-db": "cli.js"
+      },
+      "peerDependencies": {
+        "browserslist": ">= 4.21.0"
+      }
+    },
+    "node_modules/use-callback-ref": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/use-callback-ref/-/use-callback-ref-1.3.3.tgz",
+      "integrity": "sha512-jQL3lRnocaFtu3V00JToYz/4QkNWswxijDaCVNZRiRTO3HQDLsdu1ZtmIUvV4yPp+rvWm5j0y0TG/S61cuijTg==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/use-sidecar": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/use-sidecar/-/use-sidecar-1.1.3.tgz",
+      "integrity": "sha512-Fedw0aZvkhynoPYlA5WXrMCAMm+nSWdZt6lzJQ7Ok8S6Q+VsHmHpRWndVRJ8Be0ZbkfPc5LRYH+5XrzXcEeLRQ==",
+      "license": "MIT",
+      "dependencies": {
+        "detect-node-es": "^1.1.0",
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/use-sync-external-store": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/use-sync-external-store/-/use-sync-external-store-1.6.0.tgz",
+      "integrity": "sha512-Pp6GSwGP/NrPIrxVFAIkOQeyw8lFenOHijQWkUTrDvrF4ALqylP2C/KCkeS9dpUM3KvYRQhna5vt7IL95+ZQ9w==",
+      "license": "MIT",
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+      }
+    },
+    "node_modules/vaul": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/vaul/-/vaul-1.1.2.tgz",
+      "integrity": "sha512-ZFkClGpWyI2WUQjdLJ/BaGuV6AVQiJ3uELGk3OYtP+B6yCO7Cmn9vPFXVJkRaGkOJu3m8bQMgtyzNHixULceQA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-dialog": "^1.1.1"
+      },
+      "peerDependencies": {
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0.0 || ^19.0.0-rc"
+      }
+    },
+    "node_modules/victory-vendor": {
+      "version": "37.3.6",
+      "resolved": "https://registry.npmjs.org/victory-vendor/-/victory-vendor-37.3.6.tgz",
+      "integrity": "sha512-SbPDPdDBYp+5MJHhBCAyI7wKM3d5ivekigc2Dk2s7pgbZ9wIgIBYGVw4zGHBml/qTFbexrofXW6Gu4noGxrOwQ==",
+      "license": "MIT AND ISC",
+      "dependencies": {
+        "@types/d3-array": "^3.0.3",
+        "@types/d3-ease": "^3.0.0",
+        "@types/d3-interpolate": "^3.0.1",
+        "@types/d3-scale": "^4.0.2",
+        "@types/d3-shape": "^3.1.0",
+        "@types/d3-time": "^3.0.0",
+        "@types/d3-timer": "^3.0.0",
+        "d3-array": "^3.1.6",
+        "d3-ease": "^3.0.1",
+        "d3-interpolate": "^3.0.1",
+        "d3-scale": "^4.0.2",
+        "d3-shape": "^3.1.0",
+        "d3-time": "^3.0.0",
+        "d3-timer": "^3.0.1"
+      }
+    },
+    "node_modules/vite": {
+      "version": "6.4.3",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-6.4.3.tgz",
+      "integrity": "sha512-NTKlcQjlAK7MlQoyb6LgaqHc8sso/pVyUJYWMws3jg21uTJw/LddqIFPcPqP6PzpgbIcZyKI85sFE4HBrQDA8A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "esbuild": "^0.25.0",
+        "fdir": "^6.4.4",
+        "picomatch": "^4.0.2",
+        "postcss": "^8.5.3",
+        "rollup": "^4.34.9",
+        "tinyglobby": "^0.2.13"
+      },
+      "bin": {
+        "vite": "bin/vite.js"
+      },
+      "engines": {
+        "node": "^18.0.0 || ^20.0.0 || >=22.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/vitejs/vite?sponsor=1"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      },
+      "peerDependencies": {
+        "@types/node": "^18.0.0 || ^20.0.0 || >=22.0.0",
+        "jiti": ">=1.21.0",
+        "less": "*",
+        "lightningcss": "^1.21.0",
+        "sass": "*",
+        "sass-embedded": "*",
+        "stylus": "*",
+        "sugarss": "*",
+        "terser": "^5.16.0",
+        "tsx": "^4.8.1",
+        "yaml": "^2.4.2"
+      },
+      "peerDependenciesMeta": {
+        "@types/node": {
+          "optional": true
+        },
+        "jiti": {
+          "optional": true
+        },
+        "less": {
+          "optional": true
+        },
+        "lightningcss": {
+          "optional": true
+        },
+        "sass": {
+          "optional": true
+        },
+        "sass-embedded": {
+          "optional": true
+        },
+        "stylus": {
+          "optional": true
+        },
+        "sugarss": {
+          "optional": true
+        },
+        "terser": {
+          "optional": true
+        },
+        "tsx": {
+          "optional": true
+        },
+        "yaml": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/yallist": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
+      "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/zod": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
+      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
+    }
+  }
+}
diff --git a/packages/agents/preview-template/package.json b/packages/agents/preview-template/package.json
new file mode 100644
index 00000000..7bcf36fc
--- /dev/null
+++ b/packages/agents/preview-template/package.json
@@ -0,0 +1,46 @@
+{
+  "name": "@foreman/preview-template",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "vite build",
+    "preview": "vite preview",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@base-ui/react": "^1.4.1",
+    "@hookform/resolvers": "^5.2.2",
+    "@tanstack/react-table": "^8.21.3",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "cmdk": "^1.1.1",
+    "date-fns": "^4.1.0",
+    "embla-carousel-react": "^8.6.0",
+    "input-otp": "^1.4.2",
+    "lucide-react": "^1.11.0",
+    "next-themes": "^0.4.6",
+    "radix-ui": "^1.4.3",
+    "react": "^19.2.0",
+    "react-day-picker": "^10.0.0",
+    "react-dom": "^19.2.0",
+    "react-hook-form": "^7.64.0",
+    "react-resizable-panels": "^4.11.0",
+    "recharts": "^3.8.0",
+    "sonner": "^1.7.4",
+    "tailwind-merge": "^3.5.0",
+    "vaul": "^1.1.2",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@tailwindcss/vite": "^4.1.13",
+    "@types/node": "^22.8.6",
+    "@types/react": "^19",
+    "@types/react-dom": "^19",
+    "@vitejs/plugin-react": "^4.3.4",
+    "tailwindcss": "^4.1.13",
+    "typescript": "^5.6.3",
+    "vite": "^6.0.0"
+  }
+}
diff --git a/packages/agents/preview-template/src/App.tsx b/packages/agents/preview-template/src/App.tsx
new file mode 100644
index 00000000..3a9f5a35
--- /dev/null
+++ b/packages/agents/preview-template/src/App.tsx
@@ -0,0 +1,57 @@
+import { Component, type ErrorInfo, type ReactNode } from "react";
+
+import Generated from "./generated";
+
+type ErrorBoundaryProps = {
+  children: ReactNode;
+};
+
+type ErrorBoundaryState = {
+  error: Error | null;
+};
+
+/**
+ * Catches render-time errors thrown by the agent-generated component so a broken
+ * `generated.tsx` shows a readable message instead of a blank white screen.
+ */
+class ErrorBoundary extends Component<ErrorBoundaryProps, ErrorBoundaryState> {
+  state: ErrorBoundaryState = { error: null };
+
+  static getDerivedStateFromError(error: Error): ErrorBoundaryState {
+    return { error };
+  }
+
+  componentDidCatch(error: Error, info: ErrorInfo): void {
+    // Surface the real stack in the dev console too.
+    console.error("Generated component crashed:", error, info.componentStack);
+  }
+
+  render(): ReactNode {
+    const { error } = this.state;
+    if (error) {
+      return (
+        <div className="mx-auto max-w-2xl rounded-2xl border border-destructive/30 bg-destructive/10 p-6 text-destructive">
+          <h2 className="text-base font-semibold">Generated component failed to render</h2>
+          <p className="mt-2 text-sm opacity-80">{error.message}</p>
+          {error.stack ? (
+            <pre className="mt-4 overflow-x-auto rounded-lg bg-background/60 p-3 text-xs whitespace-pre-wrap">
+              {error.stack}
+            </pre>
+          ) : null}
+        </div>
+      );
+    }
+
+    return this.props.children;
+  }
+}
+
+export default function App() {
+  return (
+    <main className="min-h-screen w-full bg-background p-6 md:p-8">
+      <ErrorBoundary>
+        <Generated />
+      </ErrorBoundary>
+    </main>
+  );
+}
diff --git a/packages/agents/preview-template/src/components/ui/accordion.tsx b/packages/agents/preview-template/src/components/ui/accordion.tsx
new file mode 100644
index 00000000..10777ee2
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/accordion.tsx
@@ -0,0 +1,83 @@
+"use client";
+
+import { ChevronDownIcon, ChevronUpIcon } from "lucide-react";
+import { Accordion as AccordionPrimitive } from "radix-ui";
+import type * as React from "react";
+import { cn } from "@/lib/utils";
+
+function Accordion({ className, ...props }: React.ComponentProps<typeof AccordionPrimitive.Root>) {
+  return (
+    <AccordionPrimitive.Root
+      data-slot="accordion"
+      className={cn("flex w-full flex-col overflow-hidden rounded-2xl border", className)}
+      {...props}
+    />
+  );
+}
+
+function AccordionItem({
+  className,
+  ...props
+}: React.ComponentProps<typeof AccordionPrimitive.Item>) {
+  return (
+    <AccordionPrimitive.Item
+      data-slot="accordion-item"
+      className={cn("not-last:border-b data-open:bg-muted/50", className)}
+      {...props}
+    />
+  );
+}
+
+function AccordionTrigger({
+  className,
+  children,
+  ...props
+}: React.ComponentProps<typeof AccordionPrimitive.Trigger>) {
+  return (
+    <AccordionPrimitive.Header className="flex">
+      <AccordionPrimitive.Trigger
+        data-slot="accordion-trigger"
+        className={cn(
+          "group/accordion-trigger relative flex flex-1 items-start justify-between gap-6 border border-transparent p-4 text-left text-sm font-medium transition-all outline-none hover:underline disabled:pointer-events-none disabled:opacity-50 **:data-[slot=accordion-trigger-icon]:ml-auto **:data-[slot=accordion-trigger-icon]:size-4 **:data-[slot=accordion-trigger-icon]:text-muted-foreground",
+          className,
+        )}
+        {...props}
+      >
+        {children}
+        <ChevronDownIcon
+          data-slot="accordion-trigger-icon"
+          className="pointer-events-none shrink-0 group-aria-expanded/accordion-trigger:hidden"
+        />
+        <ChevronUpIcon
+          data-slot="accordion-trigger-icon"
+          className="pointer-events-none hidden shrink-0 group-aria-expanded/accordion-trigger:inline"
+        />
+      </AccordionPrimitive.Trigger>
+    </AccordionPrimitive.Header>
+  );
+}
+
+function AccordionContent({
+  className,
+  children,
+  ...props
+}: React.ComponentProps<typeof AccordionPrimitive.Content>) {
+  return (
+    <AccordionPrimitive.Content
+      data-slot="accordion-content"
+      className="overflow-hidden px-4 text-sm data-open:animate-accordion-down data-closed:animate-accordion-up"
+      {...props}
+    >
+      <div
+        className={cn(
+          "h-(--radix-accordion-content-height) pt-0 pb-4 [&_a]:underline [&_a]:underline-offset-3 [&_a]:hover:text-foreground [&_p:not(:last-child)]:mb-4",
+          className,
+        )}
+      >
+        {children}
+      </div>
+    </AccordionPrimitive.Content>
+  );
+}
+
+export { Accordion, AccordionContent, AccordionItem, AccordionTrigger };
diff --git a/packages/agents/preview-template/src/components/ui/alert-dialog.tsx b/packages/agents/preview-template/src/components/ui/alert-dialog.tsx
new file mode 100644
index 00000000..2d0acdff
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/alert-dialog.tsx
@@ -0,0 +1,181 @@
+"use client";
+
+import { AlertDialog as AlertDialogPrimitive } from "radix-ui";
+import type * as React from "react";
+import { Button } from "@/components/ui/button";
+import { cn } from "@/lib/utils";
+
+function AlertDialog({ ...props }: React.ComponentProps<typeof AlertDialogPrimitive.Root>) {
+  return <AlertDialogPrimitive.Root data-slot="alert-dialog" {...props} />;
+}
+
+function AlertDialogTrigger({
+  ...props
+}: React.ComponentProps<typeof AlertDialogPrimitive.Trigger>) {
+  return <AlertDialogPrimitive.Trigger data-slot="alert-dialog-trigger" {...props} />;
+}
+
+function AlertDialogPortal({ ...props }: React.ComponentProps<typeof AlertDialogPrimitive.Portal>) {
+  return <AlertDialogPrimitive.Portal data-slot="alert-dialog-portal" {...props} />;
+}
+
+function AlertDialogOverlay({
+  className,
+  ...props
+}: React.ComponentProps<typeof AlertDialogPrimitive.Overlay>) {
+  return (
+    <AlertDialogPrimitive.Overlay
+      data-slot="alert-dialog-overlay"
+      className={cn(
+        "fixed inset-0 z-50 bg-black/80 duration-100 supports-backdrop-filter:backdrop-blur-xs data-open:animate-in data-open:fade-in-0 data-closed:animate-out data-closed:fade-out-0",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function AlertDialogContent({
+  className,
+  size = "default",
+  ...props
+}: React.ComponentProps<typeof AlertDialogPrimitive.Content> & {
+  size?: "default" | "sm";
+}) {
+  return (
+    <AlertDialogPortal>
+      <AlertDialogOverlay />
+      <AlertDialogPrimitive.Content
+        data-slot="alert-dialog-content"
+        data-size={size}
+        className={cn(
+          "group/alert-dialog-content fixed top-1/2 left-1/2 z-50 grid w-full -translate-x-1/2 -translate-y-1/2 gap-6 rounded-4xl bg-popover p-6 text-popover-foreground ring-1 ring-foreground/5 duration-100 outline-none data-[size=default]:max-w-xs data-[size=sm]:max-w-xs data-[size=default]:sm:max-w-md data-open:animate-in data-open:fade-in-0 data-open:zoom-in-95 data-closed:animate-out data-closed:fade-out-0 data-closed:zoom-out-95",
+          className,
+        )}
+        {...props}
+      />
+    </AlertDialogPortal>
+  );
+}
+
+function AlertDialogHeader({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="alert-dialog-header"
+      className={cn(
+        "grid grid-rows-[auto_1fr] place-items-center gap-1.5 text-center has-data-[slot=alert-dialog-media]:grid-rows-[auto_auto_1fr] has-data-[slot=alert-dialog-media]:gap-x-6 sm:group-data-[size=default]/alert-dialog-content:place-items-start sm:group-data-[size=default]/alert-dialog-content:text-left sm:group-data-[size=default]/alert-dialog-content:has-data-[slot=alert-dialog-media]:grid-rows-[auto_1fr]",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function AlertDialogFooter({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="alert-dialog-footer"
+      className={cn(
+        "flex flex-col-reverse gap-2 group-data-[size=sm]/alert-dialog-content:grid group-data-[size=sm]/alert-dialog-content:grid-cols-2 sm:flex-row sm:justify-end",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function AlertDialogMedia({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="alert-dialog-media"
+      className={cn(
+        "mb-2 inline-flex size-16 items-center justify-center rounded-full bg-muted sm:group-data-[size=default]/alert-dialog-content:row-span-2 *:[svg:not([class*='size-'])]:size-8",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function AlertDialogTitle({
+  className,
+  ...props
+}: React.ComponentProps<typeof AlertDialogPrimitive.Title>) {
+  return (
+    <AlertDialogPrimitive.Title
+      data-slot="alert-dialog-title"
+      className={cn(
+        "text-lg font-medium sm:group-data-[size=default]/alert-dialog-content:group-has-data-[slot=alert-dialog-media]/alert-dialog-content:col-start-2",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function AlertDialogDescription({
+  className,
+  ...props
+}: React.ComponentProps<typeof AlertDialogPrimitive.Description>) {
+  return (
+    <AlertDialogPrimitive.Description
+      data-slot="alert-dialog-description"
+      className={cn(
+        "text-sm text-balance text-muted-foreground md:text-pretty *:[a]:underline *:[a]:underline-offset-3 *:[a]:hover:text-foreground",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function AlertDialogAction({
+  className,
+  variant = "default",
+  size = "default",
+  ...props
+}: React.ComponentProps<typeof AlertDialogPrimitive.Action> &
+  Pick<React.ComponentProps<typeof Button>, "variant" | "size">) {
+  return (
+    <Button variant={variant} size={size} asChild>
+      <AlertDialogPrimitive.Action
+        data-slot="alert-dialog-action"
+        className={cn(className)}
+        {...props}
+      />
+    </Button>
+  );
+}
+
+function AlertDialogCancel({
+  className,
+  variant = "outline",
+  size = "default",
+  ...props
+}: React.ComponentProps<typeof AlertDialogPrimitive.Cancel> &
+  Pick<React.ComponentProps<typeof Button>, "variant" | "size">) {
+  return (
+    <Button variant={variant} size={size} asChild>
+      <AlertDialogPrimitive.Cancel
+        data-slot="alert-dialog-cancel"
+        className={cn(className)}
+        {...props}
+      />
+    </Button>
+  );
+}
+
+export {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogMedia,
+  AlertDialogOverlay,
+  AlertDialogPortal,
+  AlertDialogTitle,
+  AlertDialogTrigger,
+};
diff --git a/packages/agents/preview-template/src/components/ui/alert.tsx b/packages/agents/preview-template/src/components/ui/alert.tsx
new file mode 100644
index 00000000..ff40e633
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/alert.tsx
@@ -0,0 +1,73 @@
+import { cva, type VariantProps } from "class-variance-authority";
+import type * as React from "react";
+
+import { cn } from "@/lib/utils";
+
+const alertVariants = cva(
+  "group/alert relative grid w-full gap-0.5 rounded-lg border px-4 py-3 text-left text-sm has-data-[slot=alert-action]:relative has-data-[slot=alert-action]:pr-18 has-[>svg]:grid-cols-[auto_1fr] has-[>svg]:gap-x-2.5 *:[svg]:row-span-2 *:[svg]:translate-y-0.5 *:[svg]:text-current *:[svg:not([class*='size-'])]:size-4",
+  {
+    variants: {
+      variant: {
+        default: "bg-card text-card-foreground",
+        destructive:
+          "bg-card text-destructive *:data-[slot=alert-description]:text-destructive/90 *:[svg]:text-current",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+    },
+  },
+);
+
+function Alert({
+  className,
+  variant,
+  ...props
+}: React.ComponentProps<"div"> & VariantProps<typeof alertVariants>) {
+  return (
+    <div
+      data-slot="alert"
+      role="alert"
+      className={cn(alertVariants({ variant }), className)}
+      {...props}
+    />
+  );
+}
+
+function AlertTitle({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="alert-title"
+      className={cn(
+        "font-medium group-has-[>svg]/alert:col-start-2 [&_a]:underline [&_a]:underline-offset-3 [&_a]:hover:text-foreground",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function AlertDescription({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="alert-description"
+      className={cn(
+        "text-sm text-balance text-muted-foreground md:text-pretty [&_a]:underline [&_a]:underline-offset-3 [&_a]:hover:text-foreground [&_p:not(:last-child)]:mb-4",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function AlertAction({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="alert-action"
+      className={cn("absolute top-2.5 right-3", className)}
+      {...props}
+    />
+  );
+}
+
+export { Alert, AlertAction, AlertDescription, AlertTitle };
diff --git a/packages/agents/preview-template/src/components/ui/aspect-ratio.tsx b/packages/agents/preview-template/src/components/ui/aspect-ratio.tsx
new file mode 100644
index 00000000..b5993d1e
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/aspect-ratio.tsx
@@ -0,0 +1,9 @@
+"use client";
+
+import { AspectRatio as AspectRatioPrimitive } from "radix-ui";
+
+function AspectRatio({ ...props }: React.ComponentProps<typeof AspectRatioPrimitive.Root>) {
+  return <AspectRatioPrimitive.Root data-slot="aspect-ratio" {...props} />;
+}
+
+export { AspectRatio };
diff --git a/packages/agents/preview-template/src/components/ui/avatar.tsx b/packages/agents/preview-template/src/components/ui/avatar.tsx
new file mode 100644
index 00000000..3a7fcf69
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/avatar.tsx
@@ -0,0 +1,96 @@
+"use client";
+
+import { Avatar as AvatarPrimitive } from "radix-ui";
+import type * as React from "react";
+
+import { cn } from "@/lib/utils";
+
+function Avatar({
+  className,
+  size = "default",
+  ...props
+}: React.ComponentProps<typeof AvatarPrimitive.Root> & {
+  size?: "default" | "sm" | "lg";
+}) {
+  return (
+    <AvatarPrimitive.Root
+      data-slot="avatar"
+      data-size={size}
+      className={cn(
+        "group/avatar relative flex size-8 shrink-0 rounded-full select-none after:absolute after:inset-0 after:rounded-full after:border after:border-border after:mix-blend-darken data-[size=lg]:size-10 data-[size=sm]:size-6 dark:after:mix-blend-lighten",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function AvatarImage({ className, ...props }: React.ComponentProps<typeof AvatarPrimitive.Image>) {
+  return (
+    <AvatarPrimitive.Image
+      data-slot="avatar-image"
+      className={cn("aspect-square size-full rounded-full object-cover", className)}
+      {...props}
+    />
+  );
+}
+
+function AvatarFallback({
+  className,
+  ...props
+}: React.ComponentProps<typeof AvatarPrimitive.Fallback>) {
+  return (
+    <AvatarPrimitive.Fallback
+      data-slot="avatar-fallback"
+      className={cn(
+        "flex size-full items-center justify-center rounded-full bg-muted text-sm text-muted-foreground group-data-[size=sm]/avatar:text-xs",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function AvatarBadge({ className, ...props }: React.ComponentProps<"span">) {
+  return (
+    <span
+      data-slot="avatar-badge"
+      className={cn(
+        "absolute right-0 bottom-0 z-10 inline-flex items-center justify-center rounded-full bg-primary text-primary-foreground bg-blend-color ring-2 ring-background select-none",
+        "group-data-[size=sm]/avatar:size-2 group-data-[size=sm]/avatar:[&>svg]:hidden",
+        "group-data-[size=default]/avatar:size-2.5 group-data-[size=default]/avatar:[&>svg]:size-2",
+        "group-data-[size=lg]/avatar:size-3 group-data-[size=lg]/avatar:[&>svg]:size-2",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function AvatarGroup({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="avatar-group"
+      className={cn(
+        "group/avatar-group flex -space-x-2 *:data-[slot=avatar]:ring-2 *:data-[slot=avatar]:ring-background",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function AvatarGroupCount({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="avatar-group-count"
+      className={cn(
+        "relative flex size-8 shrink-0 items-center justify-center rounded-full bg-muted text-sm text-muted-foreground ring-2 ring-background group-has-data-[size=lg]/avatar-group:size-10 group-has-data-[size=sm]/avatar-group:size-6 [&>svg]:size-4 group-has-data-[size=lg]/avatar-group:[&>svg]:size-5 group-has-data-[size=sm]/avatar-group:[&>svg]:size-3",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+export { Avatar, AvatarBadge, AvatarFallback, AvatarGroup, AvatarGroupCount, AvatarImage };
diff --git a/packages/agents/preview-template/src/components/ui/badge.tsx b/packages/agents/preview-template/src/components/ui/badge.tsx
new file mode 100644
index 00000000..197c95ea
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/badge.tsx
@@ -0,0 +1,47 @@
+import { cva, type VariantProps } from "class-variance-authority";
+import { Slot } from "radix-ui";
+import type * as React from "react";
+
+import { cn } from "@/lib/utils";
+
+const badgeVariants = cva(
+  "group/badge inline-flex h-5 w-fit shrink-0 items-center justify-center gap-1 overflow-hidden rounded-4xl border border-transparent px-2 py-0.5 text-xs font-medium whitespace-nowrap transition-all focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 has-data-[icon=inline-end]:pr-1.5 has-data-[icon=inline-start]:pl-1.5 aria-invalid:border-destructive aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 [&>svg]:pointer-events-none [&>svg]:size-3!",
+  {
+    variants: {
+      variant: {
+        default: "bg-primary text-primary-foreground [a]:hover:bg-primary/80",
+        secondary: "bg-secondary text-secondary-foreground [a]:hover:bg-secondary/80",
+        destructive:
+          "bg-destructive/10 text-destructive focus-visible:ring-destructive/20 dark:bg-destructive/20 dark:focus-visible:ring-destructive/40 [a]:hover:bg-destructive/20",
+        outline:
+          "border-border bg-input/30 text-foreground [a]:hover:bg-muted [a]:hover:text-muted-foreground",
+        ghost: "hover:bg-muted hover:text-muted-foreground dark:hover:bg-muted/50",
+        link: "text-primary underline-offset-4 hover:underline",
+        accent: "bg-accent text-accent-foreground [a]:hover:bg-accent/80",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+    },
+  },
+);
+
+function Badge({
+  className,
+  variant = "default",
+  asChild = false,
+  ...props
+}: React.ComponentProps<"span"> & VariantProps<typeof badgeVariants> & { asChild?: boolean }) {
+  const Comp = asChild ? Slot.Root : "span";
+
+  return (
+    <Comp
+      data-slot="badge"
+      data-variant={variant}
+      className={cn(badgeVariants({ variant }), className)}
+      {...props}
+    />
+  );
+}
+
+export { Badge, badgeVariants };
diff --git a/packages/agents/preview-template/src/components/ui/breadcrumb.tsx b/packages/agents/preview-template/src/components/ui/breadcrumb.tsx
new file mode 100644
index 00000000..0bf61bb0
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/breadcrumb.tsx
@@ -0,0 +1,103 @@
+import { ChevronRightIcon, MoreHorizontalIcon } from "lucide-react";
+import { Slot } from "radix-ui";
+import type * as React from "react";
+import { cn } from "@/lib/utils";
+
+function Breadcrumb({ className, ...props }: React.ComponentProps<"nav">) {
+  return (
+    <nav aria-label="breadcrumb" data-slot="breadcrumb" className={cn(className)} {...props} />
+  );
+}
+
+function BreadcrumbList({ className, ...props }: React.ComponentProps<"ol">) {
+  return (
+    <ol
+      data-slot="breadcrumb-list"
+      className={cn(
+        "flex flex-wrap items-center gap-1.5 text-sm wrap-break-word text-muted-foreground sm:gap-2.5",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function BreadcrumbItem({ className, ...props }: React.ComponentProps<"li">) {
+  return (
+    <li
+      data-slot="breadcrumb-item"
+      className={cn("inline-flex items-center gap-1.5", className)}
+      {...props}
+    />
+  );
+}
+
+function BreadcrumbLink({
+  asChild,
+  className,
+  ...props
+}: React.ComponentProps<"a"> & {
+  asChild?: boolean;
+}) {
+  const Comp = asChild ? Slot.Root : "a";
+
+  return (
+    <Comp
+      data-slot="breadcrumb-link"
+      className={cn("transition-colors hover:text-foreground", className)}
+      {...props}
+    />
+  );
+}
+
+function BreadcrumbPage({ className, ...props }: React.ComponentProps<"span">) {
+  return (
+    <span
+      data-slot="breadcrumb-page"
+      role="link"
+      aria-disabled="true"
+      aria-current="page"
+      className={cn("font-normal text-foreground", className)}
+      {...props}
+    />
+  );
+}
+
+function BreadcrumbSeparator({ children, className, ...props }: React.ComponentProps<"li">) {
+  return (
+    <li
+      data-slot="breadcrumb-separator"
+      role="presentation"
+      aria-hidden="true"
+      className={cn("[&>svg]:size-3.5", className)}
+      {...props}
+    >
+      {children ?? <ChevronRightIcon />}
+    </li>
+  );
+}
+
+function BreadcrumbEllipsis({ className, ...props }: React.ComponentProps<"span">) {
+  return (
+    <span
+      data-slot="breadcrumb-ellipsis"
+      role="presentation"
+      aria-hidden="true"
+      className={cn("flex size-5 items-center justify-center [&>svg]:size-4", className)}
+      {...props}
+    >
+      <MoreHorizontalIcon />
+      <span className="sr-only">More</span>
+    </span>
+  );
+}
+
+export {
+  Breadcrumb,
+  BreadcrumbEllipsis,
+  BreadcrumbItem,
+  BreadcrumbLink,
+  BreadcrumbList,
+  BreadcrumbPage,
+  BreadcrumbSeparator,
+};
diff --git a/packages/agents/preview-template/src/components/ui/button-group.tsx b/packages/agents/preview-template/src/components/ui/button-group.tsx
new file mode 100644
index 00000000..27ee6cf3
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/button-group.tsx
@@ -0,0 +1,77 @@
+import { cva, type VariantProps } from "class-variance-authority";
+import { Slot } from "radix-ui";
+import { Separator } from "@/components/ui/separator";
+import { cn } from "@/lib/utils";
+
+const buttonGroupVariants = cva(
+  "group/button-group flex w-fit items-stretch *:focus-visible:relative *:focus-visible:z-10 has-[>[data-slot=button-group]]:gap-2 has-[select[aria-hidden=true]:last-child]:[&>[data-slot=select-trigger]:last-of-type]:rounded-r-4xl [&>[data-slot=select-trigger]:not([class*='w-'])]:w-fit [&>input]:flex-1",
+  {
+    variants: {
+      orientation: {
+        horizontal:
+          "[&>*:not(:first-child)]:rounded-l-none [&>*:not(:first-child)]:border-l-0 [&>*:not(:last-child)]:rounded-r-none [&>[data-slot]:not(:has(~[data-slot]))]:rounded-r-4xl!",
+        vertical:
+          "flex-col [&>*:not(:first-child)]:rounded-t-none [&>*:not(:first-child)]:border-t-0 [&>*:not(:last-child)]:rounded-b-none [&>[data-slot]:not(:has(~[data-slot]))]:rounded-b-4xl!",
+      },
+    },
+    defaultVariants: {
+      orientation: "horizontal",
+    },
+  },
+);
+
+function ButtonGroup({
+  className,
+  orientation,
+  ...props
+}: React.ComponentProps<"div"> & VariantProps<typeof buttonGroupVariants>) {
+  return (
+    <div
+      role="group"
+      data-slot="button-group"
+      data-orientation={orientation}
+      className={cn(buttonGroupVariants({ orientation }), className)}
+      {...props}
+    />
+  );
+}
+
+function ButtonGroupText({
+  className,
+  asChild = false,
+  ...props
+}: React.ComponentProps<"div"> & {
+  asChild?: boolean;
+}) {
+  const Comp = asChild ? Slot.Root : "div";
+
+  return (
+    <Comp
+      className={cn(
+        "flex items-center gap-2 rounded-4xl border bg-muted px-2.5 text-sm font-medium [&_svg]:pointer-events-none [&_svg:not([class*='size-'])]:size-4",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function ButtonGroupSeparator({
+  className,
+  orientation = "vertical",
+  ...props
+}: React.ComponentProps<typeof Separator>) {
+  return (
+    <Separator
+      data-slot="button-group-separator"
+      orientation={orientation}
+      className={cn(
+        "relative self-stretch bg-input data-horizontal:mx-px data-horizontal:w-auto data-vertical:my-px data-vertical:h-auto",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+export { ButtonGroup, ButtonGroupSeparator, ButtonGroupText, buttonGroupVariants };
diff --git a/packages/agents/preview-template/src/components/ui/button.tsx b/packages/agents/preview-template/src/components/ui/button.tsx
new file mode 100644
index 00000000..f0b52c89
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/button.tsx
@@ -0,0 +1,66 @@
+import { cva, type VariantProps } from "class-variance-authority";
+import { Slot } from "radix-ui";
+import type * as React from "react";
+
+import { cn } from "@/lib/utils";
+
+const buttonVariants = cva(
+  "group/button inline-flex shrink-0 items-center justify-center rounded-4xl border border-transparent bg-clip-padding text-sm font-medium whitespace-nowrap transition-all outline-none select-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 active:not-aria-[haspopup]:translate-y-px disabled:pointer-events-none disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-[3px] aria-invalid:ring-destructive/20 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+  {
+    variants: {
+      variant: {
+        default: "bg-primary text-primary-foreground hover:bg-primary/80",
+        outline:
+          "border-border bg-input/30 hover:bg-input/50 hover:text-foreground aria-expanded:bg-muted aria-expanded:text-foreground",
+        secondary:
+          "bg-secondary text-secondary-foreground hover:bg-secondary/80 aria-expanded:bg-secondary aria-expanded:text-secondary-foreground",
+        ghost:
+          "hover:bg-muted hover:text-foreground aria-expanded:bg-muted aria-expanded:text-foreground dark:hover:bg-muted/50",
+        destructive:
+          "bg-destructive/10 text-destructive hover:bg-destructive/20 focus-visible:border-destructive/40 focus-visible:ring-destructive/20 dark:bg-destructive/20 dark:hover:bg-destructive/30 dark:focus-visible:ring-destructive/40",
+        link: "text-primary underline-offset-4 hover:underline",
+        accent: "bg-accent text-accent-foreground hover:bg-accent/80",
+      },
+      size: {
+        default:
+          "h-9 gap-1.5 px-3 has-data-[icon=inline-end]:pr-2.5 has-data-[icon=inline-start]:pl-2.5",
+        xs: "h-6 gap-1 px-2.5 text-xs has-data-[icon=inline-end]:pr-2 has-data-[icon=inline-start]:pl-2 [&_svg:not([class*='size-'])]:size-3",
+        sm: "h-8 gap-1 px-3 has-data-[icon=inline-end]:pr-2 has-data-[icon=inline-start]:pl-2",
+        lg: "h-10 gap-1.5 px-4 has-data-[icon=inline-end]:pr-3 has-data-[icon=inline-start]:pl-3",
+        icon: "size-9",
+        "icon-xs": "size-6 [&_svg:not([class*='size-'])]:size-3",
+        "icon-sm": "size-8",
+        "icon-lg": "size-10",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+      size: "default",
+    },
+  },
+);
+
+function Button({
+  className,
+  variant = "default",
+  size = "default",
+  asChild = false,
+  ...props
+}: React.ComponentProps<"button"> &
+  VariantProps<typeof buttonVariants> & {
+    asChild?: boolean;
+  }) {
+  const Comp = asChild ? Slot.Root : "button";
+
+  return (
+    <Comp
+      data-slot="button"
+      data-variant={variant}
+      data-size={size}
+      className={cn(buttonVariants({ variant, size, className }))}
+      {...props}
+    />
+  );
+}
+
+export { Button, buttonVariants };
diff --git a/packages/agents/preview-template/src/components/ui/calendar.tsx b/packages/agents/preview-template/src/components/ui/calendar.tsx
new file mode 100644
index 00000000..13872a6d
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/calendar.tsx
@@ -0,0 +1,186 @@
+"use client";
+
+import { ChevronDownIcon, ChevronLeftIcon, ChevronRightIcon } from "lucide-react";
+import * as React from "react";
+import { type DayButton, DayPicker, getDefaultClassNames, type Locale } from "react-day-picker";
+import { Button, buttonVariants } from "@/components/ui/button";
+import { cn } from "@/lib/utils";
+
+function Calendar({
+  className,
+  classNames,
+  showOutsideDays = true,
+  captionLayout = "label",
+  buttonVariant = "ghost",
+  locale,
+  formatters,
+  components,
+  ...props
+}: React.ComponentProps<typeof DayPicker> & {
+  buttonVariant?: React.ComponentProps<typeof Button>["variant"];
+}) {
+  const defaultClassNames = getDefaultClassNames();
+
+  return (
+    <DayPicker
+      showOutsideDays={showOutsideDays}
+      className={cn(
+        "group/calendar bg-background p-3 [--cell-radius:var(--radius-4xl)] [--cell-size:--spacing(8)] in-data-[slot=card-content]:bg-transparent in-data-[slot=popover-content]:bg-transparent",
+        String.raw`rtl:**:[.rdp-button\_next>svg]:rotate-180`,
+        String.raw`rtl:**:[.rdp-button\_previous>svg]:rotate-180`,
+        className,
+      )}
+      captionLayout={captionLayout}
+      locale={locale}
+      formatters={{
+        formatMonthDropdown: (date) => date.toLocaleString(locale?.code, { month: "short" }),
+        ...formatters,
+      }}
+      classNames={{
+        // shadcn's bundled calendar was written against react-day-picker v8/v9 ClassNames.
+        // v10 dropped some keys like `table`. Cast loosens the type until shadcn ships v10 calendar.
+        root: cn("w-fit", defaultClassNames.root),
+        months: cn("relative flex flex-col gap-4 md:flex-row", defaultClassNames.months),
+        month: cn("flex w-full flex-col gap-4", defaultClassNames.month),
+        nav: cn(
+          "absolute inset-x-0 top-0 flex w-full items-center justify-between gap-1",
+          defaultClassNames.nav,
+        ),
+        button_previous: cn(
+          buttonVariants({ variant: buttonVariant }),
+          "size-(--cell-size) p-0 select-none aria-disabled:opacity-50",
+          defaultClassNames.button_previous,
+        ),
+        button_next: cn(
+          buttonVariants({ variant: buttonVariant }),
+          "size-(--cell-size) p-0 select-none aria-disabled:opacity-50",
+          defaultClassNames.button_next,
+        ),
+        month_caption: cn(
+          "flex h-(--cell-size) w-full items-center justify-center px-(--cell-size)",
+          defaultClassNames.month_caption,
+        ),
+        dropdowns: cn(
+          "flex h-(--cell-size) w-full items-center justify-center gap-1.5 text-sm font-medium",
+          defaultClassNames.dropdowns,
+        ),
+        dropdown_root: cn("relative rounded-(--cell-radius)", defaultClassNames.dropdown_root),
+        dropdown: cn("absolute inset-0 bg-popover opacity-0", defaultClassNames.dropdown),
+        caption_label: cn(
+          "font-medium select-none",
+          captionLayout === "label"
+            ? "text-sm"
+            : "flex items-center gap-1 rounded-(--cell-radius) text-sm [&>svg]:size-3.5 [&>svg]:text-muted-foreground",
+          defaultClassNames.caption_label,
+        ),
+        weekdays: cn("flex", defaultClassNames.weekdays),
+        weekday: cn(
+          "flex-1 rounded-(--cell-radius) text-[0.8rem] font-normal text-muted-foreground select-none",
+          defaultClassNames.weekday,
+        ),
+        week: cn("mt-2 flex w-full", defaultClassNames.week),
+        week_number_header: cn("w-(--cell-size) select-none", defaultClassNames.week_number_header),
+        week_number: cn(
+          "text-[0.8rem] text-muted-foreground select-none",
+          defaultClassNames.week_number,
+        ),
+        day: cn(
+          "group/day relative aspect-square h-full w-full rounded-(--cell-radius) p-0 text-center select-none [&:last-child[data-selected=true]_button]:rounded-r-(--cell-radius)",
+          props.showWeekNumber
+            ? "[&:nth-child(2)[data-selected=true]_button]:rounded-l-(--cell-radius)"
+            : "[&:first-child[data-selected=true]_button]:rounded-l-(--cell-radius)",
+          defaultClassNames.day,
+        ),
+        range_start: cn(
+          "relative isolate z-0 rounded-l-(--cell-radius) bg-muted after:absolute after:inset-y-0 after:right-0 after:w-4 after:bg-muted",
+          defaultClassNames.range_start,
+        ),
+        range_middle: cn("rounded-none", defaultClassNames.range_middle),
+        range_end: cn(
+          "relative isolate z-0 rounded-r-(--cell-radius) bg-muted after:absolute after:inset-y-0 after:left-0 after:w-4 after:bg-muted",
+          defaultClassNames.range_end,
+        ),
+        today: cn(
+          "rounded-(--cell-radius) bg-muted text-foreground data-[selected=true]:rounded-none",
+          defaultClassNames.today,
+        ),
+        outside: cn(
+          "text-muted-foreground aria-selected:text-muted-foreground",
+          defaultClassNames.outside,
+        ),
+        disabled: cn("text-muted-foreground opacity-50", defaultClassNames.disabled),
+        hidden: cn("invisible", defaultClassNames.hidden),
+        ...classNames,
+      }}
+      components={{
+        Root: ({ className, rootRef, ...props }) => {
+          return <div data-slot="calendar" ref={rootRef} className={cn(className)} {...props} />;
+        },
+        Chevron: ({ className, orientation, ...props }) => {
+          if (orientation === "left") {
+            return <ChevronLeftIcon className={cn("size-4", className)} {...props} />;
+          }
+
+          if (orientation === "right") {
+            return <ChevronRightIcon className={cn("size-4", className)} {...props} />;
+          }
+
+          return <ChevronDownIcon className={cn("size-4", className)} {...props} />;
+        },
+        DayButton: ({ ...props }) => <CalendarDayButton locale={locale} {...props} />,
+        WeekNumber: ({ children, ...props }) => {
+          return (
+            <td {...props}>
+              <div className="flex size-(--cell-size) items-center justify-center text-center">
+                {children}
+              </div>
+            </td>
+          );
+        },
+        ...components,
+      }}
+      {...props}
+    />
+  );
+}
+
+function CalendarDayButton({
+  className,
+  day,
+  modifiers,
+  locale,
+  ...props
+}: React.ComponentProps<typeof DayButton> & { locale?: Partial<Locale> }) {
+  const defaultClassNames = getDefaultClassNames();
+
+  const ref = React.useRef<HTMLButtonElement>(null);
+  React.useEffect(() => {
+    if (modifiers.focused) ref.current?.focus();
+  }, [modifiers.focused]);
+
+  return (
+    <Button
+      ref={ref}
+      variant="ghost"
+      size="icon"
+      data-day={day.date.toLocaleDateString(locale?.code)}
+      data-selected-single={
+        modifiers.selected &&
+        !modifiers.range_start &&
+        !modifiers.range_end &&
+        !modifiers.range_middle
+      }
+      data-range-start={modifiers.range_start}
+      data-range-end={modifiers.range_end}
+      data-range-middle={modifiers.range_middle}
+      className={cn(
+        "relative isolate z-10 flex aspect-square size-auto w-full min-w-(--cell-size) flex-col gap-1 border-0 leading-none font-normal group-data-[focused=true]/day:relative group-data-[focused=true]/day:z-10 group-data-[focused=true]/day:border-ring group-data-[focused=true]/day:ring-[3px] group-data-[focused=true]/day:ring-ring/50 data-[range-end=true]:rounded-(--cell-radius) data-[range-end=true]:rounded-r-(--cell-radius) data-[range-end=true]:bg-primary data-[range-end=true]:text-primary-foreground data-[range-middle=true]:rounded-none data-[range-middle=true]:bg-muted data-[range-middle=true]:text-foreground data-[range-start=true]:rounded-(--cell-radius) data-[range-start=true]:rounded-l-(--cell-radius) data-[range-start=true]:bg-primary data-[range-start=true]:text-primary-foreground data-[selected-single=true]:bg-primary data-[selected-single=true]:text-primary-foreground dark:hover:text-foreground [&>span]:text-xs [&>span]:opacity-70",
+        defaultClassNames.day,
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+export { Calendar, CalendarDayButton };
diff --git a/packages/agents/preview-template/src/components/ui/card.tsx b/packages/agents/preview-template/src/components/ui/card.tsx
new file mode 100644
index 00000000..daba45e3
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/card.tsx
@@ -0,0 +1,85 @@
+import type * as React from "react";
+
+import { cn } from "@/lib/utils";
+
+function Card({
+  className,
+  size = "default",
+  ...props
+}: React.ComponentProps<"div"> & { size?: "default" | "sm" }) {
+  return (
+    <div
+      data-slot="card"
+      data-size={size}
+      className={cn(
+        "group/card flex flex-col gap-6 overflow-hidden rounded-2xl bg-card py-6 text-sm text-card-foreground ring-1 ring-foreground/10 has-[>img:first-child]:pt-0 data-[size=sm]:gap-4 data-[size=sm]:py-4 *:[img:first-child]:rounded-t-xl *:[img:last-child]:rounded-b-xl",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function CardHeader({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="card-header"
+      className={cn(
+        "group/card-header @container/card-header grid auto-rows-min items-start gap-2 rounded-t-xl px-6 group-data-[size=sm]/card:px-4 has-data-[slot=card-action]:grid-cols-[1fr_auto] has-data-[slot=card-description]:grid-rows-[auto_auto] [.border-b]:pb-6 group-data-[size=sm]/card:[.border-b]:pb-4",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function CardTitle({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div data-slot="card-title" className={cn("text-base font-medium", className)} {...props} />
+  );
+}
+
+function CardDescription({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="card-description"
+      className={cn("text-sm text-muted-foreground", className)}
+      {...props}
+    />
+  );
+}
+
+function CardAction({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="card-action"
+      className={cn("col-start-2 row-span-2 row-start-1 self-start justify-self-end", className)}
+      {...props}
+    />
+  );
+}
+
+function CardContent({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="card-content"
+      className={cn("px-6 group-data-[size=sm]/card:px-4", className)}
+      {...props}
+    />
+  );
+}
+
+function CardFooter({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="card-footer"
+      className={cn(
+        "flex items-center rounded-b-xl px-6 group-data-[size=sm]/card:px-4 [.border-t]:pt-6 group-data-[size=sm]/card:[.border-t]:pt-4",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+export { Card, CardAction, CardContent, CardDescription, CardFooter, CardHeader, CardTitle };
diff --git a/packages/agents/preview-template/src/components/ui/carousel.tsx b/packages/agents/preview-template/src/components/ui/carousel.tsx
new file mode 100644
index 00000000..405319e2
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/carousel.tsx
@@ -0,0 +1,230 @@
+"use client";
+
+import useEmblaCarousel, { type UseEmblaCarouselType } from "embla-carousel-react";
+import { ChevronLeftIcon, ChevronRightIcon } from "lucide-react";
+import * as React from "react";
+import { Button } from "@/components/ui/button";
+import { cn } from "@/lib/utils";
+
+type CarouselApi = UseEmblaCarouselType[1];
+type UseCarouselParameters = Parameters<typeof useEmblaCarousel>;
+type CarouselOptions = UseCarouselParameters[0];
+type CarouselPlugin = UseCarouselParameters[1];
+
+type CarouselProps = {
+  opts?: CarouselOptions;
+  plugins?: CarouselPlugin;
+  orientation?: "horizontal" | "vertical";
+  setApi?: (api: CarouselApi) => void;
+};
+
+type CarouselContextProps = {
+  carouselRef: ReturnType<typeof useEmblaCarousel>[0];
+  api: ReturnType<typeof useEmblaCarousel>[1];
+  scrollPrev: () => void;
+  scrollNext: () => void;
+  canScrollPrev: boolean;
+  canScrollNext: boolean;
+} & CarouselProps;
+
+const CarouselContext = React.createContext<CarouselContextProps | null>(null);
+
+function useCarousel() {
+  const context = React.useContext(CarouselContext);
+
+  if (!context) {
+    throw new Error("useCarousel must be used within a <Carousel />");
+  }
+
+  return context;
+}
+
+function Carousel({
+  orientation = "horizontal",
+  opts,
+  setApi,
+  plugins,
+  className,
+  children,
+  ...props
+}: React.ComponentProps<"div"> & CarouselProps) {
+  const [carouselRef, api] = useEmblaCarousel(
+    {
+      ...opts,
+      axis: orientation === "horizontal" ? "x" : "y",
+    },
+    plugins,
+  );
+  const [canScrollPrev, setCanScrollPrev] = React.useState(false);
+  const [canScrollNext, setCanScrollNext] = React.useState(false);
+
+  const onSelect = React.useCallback((api: CarouselApi) => {
+    if (!api) return;
+    setCanScrollPrev(api.canScrollPrev());
+    setCanScrollNext(api.canScrollNext());
+  }, []);
+
+  const scrollPrev = React.useCallback(() => {
+    api?.scrollPrev();
+  }, [api]);
+
+  const scrollNext = React.useCallback(() => {
+    api?.scrollNext();
+  }, [api]);
+
+  const handleKeyDown = React.useCallback(
+    (event: React.KeyboardEvent<HTMLDivElement>) => {
+      if (event.key === "ArrowLeft") {
+        event.preventDefault();
+        scrollPrev();
+      } else if (event.key === "ArrowRight") {
+        event.preventDefault();
+        scrollNext();
+      }
+    },
+    [scrollPrev, scrollNext],
+  );
+
+  React.useEffect(() => {
+    if (!api || !setApi) return;
+    setApi(api);
+  }, [api, setApi]);
+
+  React.useEffect(() => {
+    if (!api) return;
+    onSelect(api);
+    api.on("reInit", onSelect);
+    api.on("select", onSelect);
+
+    return () => {
+      api?.off("select", onSelect);
+    };
+  }, [api, onSelect]);
+
+  return (
+    <CarouselContext.Provider
+      value={{
+        carouselRef,
+        api: api,
+        opts,
+        orientation: orientation || (opts?.axis === "y" ? "vertical" : "horizontal"),
+        scrollPrev,
+        scrollNext,
+        canScrollPrev,
+        canScrollNext,
+      }}
+    >
+      <div
+        onKeyDownCapture={handleKeyDown}
+        className={cn("relative", className)}
+        role="region"
+        aria-roledescription="carousel"
+        data-slot="carousel"
+        {...props}
+      >
+        {children}
+      </div>
+    </CarouselContext.Provider>
+  );
+}
+
+function CarouselContent({ className, ...props }: React.ComponentProps<"div">) {
+  const { carouselRef, orientation } = useCarousel();
+
+  return (
+    <div ref={carouselRef} className="overflow-hidden" data-slot="carousel-content">
+      <div
+        className={cn("flex", orientation === "horizontal" ? "-ml-4" : "-mt-4 flex-col", className)}
+        {...props}
+      />
+    </div>
+  );
+}
+
+function CarouselItem({ className, ...props }: React.ComponentProps<"div">) {
+  const { orientation } = useCarousel();
+
+  return (
+    <div
+      role="group"
+      aria-roledescription="slide"
+      data-slot="carousel-item"
+      className={cn(
+        "min-w-0 shrink-0 grow-0 basis-full",
+        orientation === "horizontal" ? "pl-4" : "pt-4",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function CarouselPrevious({
+  className,
+  variant = "outline",
+  size = "icon-sm",
+  ...props
+}: React.ComponentProps<typeof Button>) {
+  const { orientation, scrollPrev, canScrollPrev } = useCarousel();
+
+  return (
+    <Button
+      data-slot="carousel-previous"
+      variant={variant}
+      size={size}
+      className={cn(
+        "absolute touch-manipulation rounded-full",
+        orientation === "horizontal"
+          ? "top-1/2 -left-12 -translate-y-1/2"
+          : "-top-12 left-1/2 -translate-x-1/2 rotate-90",
+        className,
+      )}
+      disabled={!canScrollPrev}
+      onClick={scrollPrev}
+      {...props}
+    >
+      <ChevronLeftIcon />
+      <span className="sr-only">Previous slide</span>
+    </Button>
+  );
+}
+
+function CarouselNext({
+  className,
+  variant = "outline",
+  size = "icon-sm",
+  ...props
+}: React.ComponentProps<typeof Button>) {
+  const { orientation, scrollNext, canScrollNext } = useCarousel();
+
+  return (
+    <Button
+      data-slot="carousel-next"
+      variant={variant}
+      size={size}
+      className={cn(
+        "absolute touch-manipulation rounded-full",
+        orientation === "horizontal"
+          ? "top-1/2 -right-12 -translate-y-1/2"
+          : "-bottom-12 left-1/2 -translate-x-1/2 rotate-90",
+        className,
+      )}
+      disabled={!canScrollNext}
+      onClick={scrollNext}
+      {...props}
+    >
+      <ChevronRightIcon />
+      <span className="sr-only">Next slide</span>
+    </Button>
+  );
+}
+
+export {
+  Carousel,
+  type CarouselApi,
+  CarouselContent,
+  CarouselItem,
+  CarouselNext,
+  CarouselPrevious,
+  useCarousel,
+};
diff --git a/packages/agents/preview-template/src/components/ui/chart.tsx b/packages/agents/preview-template/src/components/ui/chart.tsx
new file mode 100644
index 00000000..eb073a4f
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/chart.tsx
@@ -0,0 +1,339 @@
+"use client";
+
+import * as React from "react";
+import type { TooltipValueType } from "recharts";
+import * as RechartsPrimitive from "recharts";
+
+import { cn } from "@/lib/utils";
+
+// Format: { THEME_NAME: CSS_SELECTOR }
+const THEMES = { light: "", dark: ".dark" } as const;
+
+const INITIAL_DIMENSION = { width: 320, height: 200 } as const;
+type TooltipNameType = number | string;
+
+export type ChartConfig = Record<
+  string,
+  {
+    label?: React.ReactNode;
+    icon?: React.ComponentType;
+  } & (
+    | { color?: string; theme?: never }
+    | { color?: never; theme: Record<keyof typeof THEMES, string> }
+  )
+>;
+
+type ChartContextProps = {
+  config: ChartConfig;
+};
+
+const ChartContext = React.createContext<ChartContextProps | null>(null);
+
+function useChart() {
+  const context = React.useContext(ChartContext);
+
+  if (!context) {
+    throw new Error("useChart must be used within a <ChartContainer />");
+  }
+
+  return context;
+}
+
+function ChartContainer({
+  id,
+  className,
+  children,
+  config,
+  initialDimension = INITIAL_DIMENSION,
+  ...props
+}: React.ComponentProps<"div"> & {
+  config: ChartConfig;
+  children: React.ComponentProps<typeof RechartsPrimitive.ResponsiveContainer>["children"];
+  initialDimension?: {
+    width: number;
+    height: number;
+  };
+}) {
+  const uniqueId = React.useId();
+  const chartId = `chart-${id ?? uniqueId.replace(/:/g, "")}`;
+
+  return (
+    <ChartContext.Provider value={{ config }}>
+      <div
+        data-slot="chart"
+        data-chart={chartId}
+        className={cn(
+          "flex aspect-video justify-center text-xs [&_.recharts-cartesian-axis-tick_text]:fill-muted-foreground [&_.recharts-cartesian-grid_line[stroke='#ccc']]:stroke-border/50 [&_.recharts-curve.recharts-tooltip-cursor]:stroke-border [&_.recharts-dot[stroke='#fff']]:stroke-transparent [&_.recharts-layer]:outline-hidden [&_.recharts-polar-grid_[stroke='#ccc']]:stroke-border [&_.recharts-radial-bar-background-sector]:fill-muted [&_.recharts-rectangle.recharts-tooltip-cursor]:fill-muted [&_.recharts-reference-line_[stroke='#ccc']]:stroke-border [&_.recharts-sector]:outline-hidden [&_.recharts-sector[stroke='#fff']]:stroke-transparent [&_.recharts-surface]:outline-hidden",
+          className,
+        )}
+        {...props}
+      >
+        <ChartStyle id={chartId} config={config} />
+        <RechartsPrimitive.ResponsiveContainer initialDimension={initialDimension}>
+          {children}
+        </RechartsPrimitive.ResponsiveContainer>
+      </div>
+    </ChartContext.Provider>
+  );
+}
+
+const ChartStyle = ({ id, config }: { id: string; config: ChartConfig }) => {
+  const colorConfig = Object.entries(config).filter(([, config]) => config.theme ?? config.color);
+
+  if (!colorConfig.length) {
+    return null;
+  }
+
+  return (
+    <style
+      dangerouslySetInnerHTML={{
+        __html: Object.entries(THEMES)
+          .map(
+            ([theme, prefix]) => `
+${prefix} [data-chart=${id}] {
+${colorConfig
+  .map(([key, itemConfig]) => {
+    const color = itemConfig.theme?.[theme as keyof typeof itemConfig.theme] ?? itemConfig.color;
+    return color ? `  --color-${key}: ${color};` : null;
+  })
+  .join("\n")}
+}
+`,
+          )
+          .join("\n"),
+      }}
+    />
+  );
+};
+
+const ChartTooltip = RechartsPrimitive.Tooltip;
+
+function ChartTooltipContent({
+  active,
+  payload,
+  className,
+  indicator = "dot",
+  hideLabel = false,
+  hideIndicator = false,
+  label,
+  labelFormatter,
+  labelClassName,
+  formatter,
+  color,
+  nameKey,
+  labelKey,
+}: React.ComponentProps<typeof RechartsPrimitive.Tooltip> &
+  React.ComponentProps<"div"> & {
+    hideLabel?: boolean;
+    hideIndicator?: boolean;
+    indicator?: "line" | "dot" | "dashed";
+    nameKey?: string;
+    labelKey?: string;
+  } & Omit<
+    RechartsPrimitive.DefaultTooltipContentProps<TooltipValueType, TooltipNameType>,
+    "accessibilityLayer"
+  >) {
+  const { config } = useChart();
+
+  const tooltipLabel = React.useMemo(() => {
+    if (hideLabel || !payload?.length) {
+      return null;
+    }
+
+    const [item] = payload;
+    const key = `${labelKey ?? item?.dataKey ?? item?.name ?? "value"}`;
+    const itemConfig = getPayloadConfigFromPayload(config, item, key);
+    const value =
+      !labelKey && typeof label === "string" ? (config[label]?.label ?? label) : itemConfig?.label;
+
+    if (labelFormatter) {
+      return (
+        <div className={cn("font-medium", labelClassName)}>{labelFormatter(value, payload)}</div>
+      );
+    }
+
+    if (!value) {
+      return null;
+    }
+
+    return <div className={cn("font-medium", labelClassName)}>{value}</div>;
+  }, [label, labelFormatter, payload, hideLabel, labelClassName, config, labelKey]);
+
+  if (!active || !payload?.length) {
+    return null;
+  }
+
+  const nestLabel = payload.length === 1 && indicator !== "dot";
+
+  return (
+    <div
+      className={cn(
+        "grid min-w-32 items-start gap-1.5 rounded-lg border border-border/50 bg-background px-2.5 py-1.5 text-xs shadow-xl",
+        className,
+      )}
+    >
+      {!nestLabel ? tooltipLabel : null}
+      <div className="grid gap-1.5">
+        {payload
+          .filter((item) => item.type !== "none")
+          .map((item, index) => {
+            const key = `${nameKey ?? item.name ?? item.dataKey ?? "value"}`;
+            const itemConfig = getPayloadConfigFromPayload(config, item, key);
+            const indicatorColor = color ?? item.payload?.fill ?? item.color;
+
+            return (
+              <div
+                key={index}
+                className={cn(
+                  "flex w-full flex-wrap items-stretch gap-2 [&>svg]:h-2.5 [&>svg]:w-2.5 [&>svg]:text-muted-foreground",
+                  indicator === "dot" && "items-center",
+                )}
+              >
+                {formatter && item?.value !== undefined && item.name ? (
+                  formatter(item.value, item.name, item, index, item.payload)
+                ) : (
+                  <>
+                    {itemConfig?.icon ? (
+                      <itemConfig.icon />
+                    ) : (
+                      !hideIndicator && (
+                        <div
+                          className={cn(
+                            "shrink-0 rounded-[2px] border-(--color-border) bg-(--color-bg)",
+                            {
+                              "h-2.5 w-2.5": indicator === "dot",
+                              "w-1": indicator === "line",
+                              "w-0 border-[1.5px] border-dashed bg-transparent":
+                                indicator === "dashed",
+                              "my-0.5": nestLabel && indicator === "dashed",
+                            },
+                          )}
+                          style={
+                            {
+                              "--color-bg": indicatorColor,
+                              "--color-border": indicatorColor,
+                            } as React.CSSProperties
+                          }
+                        />
+                      )
+                    )}
+                    <div
+                      className={cn(
+                        "flex flex-1 justify-between leading-none",
+                        nestLabel ? "items-end" : "items-center",
+                      )}
+                    >
+                      <div className="grid gap-1.5">
+                        {nestLabel ? tooltipLabel : null}
+                        <span className="text-muted-foreground">
+                          {itemConfig?.label ?? item.name}
+                        </span>
+                      </div>
+                      {item.value != null && (
+                        <span className="font-mono font-medium text-foreground tabular-nums">
+                          {typeof item.value === "number"
+                            ? item.value.toLocaleString()
+                            : String(item.value)}
+                        </span>
+                      )}
+                    </div>
+                  </>
+                )}
+              </div>
+            );
+          })}
+      </div>
+    </div>
+  );
+}
+
+const ChartLegend = RechartsPrimitive.Legend;
+
+function ChartLegendContent({
+  className,
+  hideIcon = false,
+  payload,
+  verticalAlign = "bottom",
+  nameKey,
+}: React.ComponentProps<"div"> & {
+  hideIcon?: boolean;
+  nameKey?: string;
+} & RechartsPrimitive.DefaultLegendContentProps) {
+  const { config } = useChart();
+
+  if (!payload?.length) {
+    return null;
+  }
+
+  return (
+    <div
+      className={cn(
+        "flex items-center justify-center gap-4",
+        verticalAlign === "top" ? "pb-3" : "pt-3",
+        className,
+      )}
+    >
+      {payload
+        .filter((item) => item.type !== "none")
+        .map((item, index) => {
+          const key = `${nameKey ?? item.dataKey ?? "value"}`;
+          const itemConfig = getPayloadConfigFromPayload(config, item, key);
+
+          return (
+            <div
+              key={index}
+              className={cn(
+                "flex items-center gap-1.5 [&>svg]:h-3 [&>svg]:w-3 [&>svg]:text-muted-foreground",
+              )}
+            >
+              {itemConfig?.icon && !hideIcon ? (
+                <itemConfig.icon />
+              ) : (
+                <div
+                  className="h-2 w-2 shrink-0 rounded-[2px]"
+                  style={{
+                    backgroundColor: item.color,
+                  }}
+                />
+              )}
+              {itemConfig?.label}
+            </div>
+          );
+        })}
+    </div>
+  );
+}
+
+function getPayloadConfigFromPayload(config: ChartConfig, payload: unknown, key: string) {
+  if (typeof payload !== "object" || payload === null) {
+    return undefined;
+  }
+
+  const payloadPayload =
+    "payload" in payload && typeof payload.payload === "object" && payload.payload !== null
+      ? payload.payload
+      : undefined;
+
+  let configLabelKey: string = key;
+
+  if (key in payload && typeof payload[key as keyof typeof payload] === "string") {
+    configLabelKey = payload[key as keyof typeof payload] as string;
+  } else if (
+    payloadPayload &&
+    key in payloadPayload &&
+    typeof payloadPayload[key as keyof typeof payloadPayload] === "string"
+  ) {
+    configLabelKey = payloadPayload[key as keyof typeof payloadPayload] as string;
+  }
+
+  return configLabelKey in config ? config[configLabelKey] : config[key];
+}
+
+export {
+  ChartContainer,
+  ChartLegend,
+  ChartLegendContent,
+  ChartStyle,
+  ChartTooltip,
+  ChartTooltipContent,
+};
diff --git a/packages/agents/preview-template/src/components/ui/checkbox.tsx b/packages/agents/preview-template/src/components/ui/checkbox.tsx
new file mode 100644
index 00000000..cc1857bd
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/checkbox.tsx
@@ -0,0 +1,28 @@
+"use client";
+
+import { CheckIcon } from "lucide-react";
+import { Checkbox as CheckboxPrimitive } from "radix-ui";
+import type * as React from "react";
+import { cn } from "@/lib/utils";
+
+function Checkbox({ className, ...props }: React.ComponentProps<typeof CheckboxPrimitive.Root>) {
+  return (
+    <CheckboxPrimitive.Root
+      data-slot="checkbox"
+      className={cn(
+        "peer relative flex size-4 shrink-0 items-center justify-center rounded-[6px] border border-input transition-shadow outline-none group-has-disabled/field:opacity-50 after:absolute after:-inset-x-3 after:-inset-y-2 focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-[3px] aria-invalid:ring-destructive/20 aria-invalid:aria-checked:border-primary dark:bg-input/30 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40 data-checked:border-primary data-checked:bg-primary data-checked:text-primary-foreground dark:data-checked:bg-primary",
+        className,
+      )}
+      {...props}
+    >
+      <CheckboxPrimitive.Indicator
+        data-slot="checkbox-indicator"
+        className="grid place-content-center text-current transition-none [&>svg]:size-3.5"
+      >
+        <CheckIcon />
+      </CheckboxPrimitive.Indicator>
+    </CheckboxPrimitive.Root>
+  );
+}
+
+export { Checkbox };
diff --git a/packages/agents/preview-template/src/components/ui/collapsible.tsx b/packages/agents/preview-template/src/components/ui/collapsible.tsx
new file mode 100644
index 00000000..31fd504e
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/collapsible.tsx
@@ -0,0 +1,21 @@
+"use client";
+
+import { Collapsible as CollapsiblePrimitive } from "radix-ui";
+
+function Collapsible({ ...props }: React.ComponentProps<typeof CollapsiblePrimitive.Root>) {
+  return <CollapsiblePrimitive.Root data-slot="collapsible" {...props} />;
+}
+
+function CollapsibleTrigger({
+  ...props
+}: React.ComponentProps<typeof CollapsiblePrimitive.CollapsibleTrigger>) {
+  return <CollapsiblePrimitive.CollapsibleTrigger data-slot="collapsible-trigger" {...props} />;
+}
+
+function CollapsibleContent({
+  ...props
+}: React.ComponentProps<typeof CollapsiblePrimitive.CollapsibleContent>) {
+  return <CollapsiblePrimitive.CollapsibleContent data-slot="collapsible-content" {...props} />;
+}
+
+export { Collapsible, CollapsibleContent, CollapsibleTrigger };
diff --git a/packages/agents/preview-template/src/components/ui/combobox.tsx b/packages/agents/preview-template/src/components/ui/combobox.tsx
new file mode 100644
index 00000000..6f58ea22
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/combobox.tsx
@@ -0,0 +1,274 @@
+"use client";
+
+import { Combobox as ComboboxPrimitive } from "@base-ui/react";
+import { CheckIcon, ChevronDownIcon, XIcon } from "lucide-react";
+import * as React from "react";
+import { Button } from "@/components/ui/button";
+import {
+  InputGroup,
+  InputGroupAddon,
+  InputGroupButton,
+  InputGroupInput,
+} from "@/components/ui/input-group";
+import { cn } from "@/lib/utils";
+
+const Combobox = ComboboxPrimitive.Root;
+
+function ComboboxValue({ ...props }: ComboboxPrimitive.Value.Props) {
+  return <ComboboxPrimitive.Value data-slot="combobox-value" {...props} />;
+}
+
+function ComboboxTrigger({ className, children, ...props }: ComboboxPrimitive.Trigger.Props) {
+  return (
+    <ComboboxPrimitive.Trigger
+      data-slot="combobox-trigger"
+      className={cn("[&_svg:not([class*='size-'])]:size-4", className)}
+      {...props}
+    >
+      {children}
+      <ChevronDownIcon className="pointer-events-none size-4 text-muted-foreground" />
+    </ComboboxPrimitive.Trigger>
+  );
+}
+
+function ComboboxClear({ className, ...props }: ComboboxPrimitive.Clear.Props) {
+  return (
+    <ComboboxPrimitive.Clear
+      data-slot="combobox-clear"
+      render={<InputGroupButton variant="ghost" size="icon-xs" />}
+      className={cn(className)}
+      {...props}
+    >
+      <XIcon className="pointer-events-none" />
+    </ComboboxPrimitive.Clear>
+  );
+}
+
+function ComboboxInput({
+  className,
+  children,
+  disabled = false,
+  showTrigger = true,
+  showClear = false,
+  ...props
+}: ComboboxPrimitive.Input.Props & {
+  showTrigger?: boolean;
+  showClear?: boolean;
+}) {
+  return (
+    <InputGroup className={cn("w-auto", className)}>
+      <ComboboxPrimitive.Input render={<InputGroupInput disabled={disabled} />} {...props} />
+      <InputGroupAddon align="inline-end">
+        {showTrigger && (
+          <InputGroupButton
+            size="icon-xs"
+            variant="ghost"
+            asChild
+            data-slot="input-group-button"
+            className="group-has-data-[slot=combobox-clear]/input-group:hidden data-pressed:bg-transparent"
+            disabled={disabled}
+          >
+            <ComboboxTrigger />
+          </InputGroupButton>
+        )}
+        {showClear && <ComboboxClear disabled={disabled} />}
+      </InputGroupAddon>
+      {children}
+    </InputGroup>
+  );
+}
+
+function ComboboxContent({
+  className,
+  side = "bottom",
+  sideOffset = 6,
+  align = "start",
+  alignOffset = 0,
+  anchor,
+  ...props
+}: ComboboxPrimitive.Popup.Props &
+  Pick<
+    ComboboxPrimitive.Positioner.Props,
+    "side" | "align" | "sideOffset" | "alignOffset" | "anchor"
+  >) {
+  return (
+    <ComboboxPrimitive.Portal>
+      <ComboboxPrimitive.Positioner
+        side={side}
+        sideOffset={sideOffset}
+        align={align}
+        alignOffset={alignOffset}
+        anchor={anchor}
+        className="isolate z-50"
+      >
+        <ComboboxPrimitive.Popup
+          data-slot="combobox-content"
+          data-chips={!!anchor}
+          className={cn(
+            "group/combobox-content relative max-h-(--available-height) w-(--anchor-width) max-w-(--available-width) min-w-[calc(var(--anchor-width)+--spacing(7))] origin-(--transform-origin) overflow-hidden rounded-2xl bg-popover text-popover-foreground shadow-2xl ring-1 ring-foreground/5 duration-100 data-[chips=true]:min-w-(--anchor-width) data-[side=bottom]:slide-in-from-top-2 data-[side=inline-end]:slide-in-from-left-2 data-[side=inline-start]:slide-in-from-right-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 *:data-[slot=input-group]:m-1 *:data-[slot=input-group]:mb-0 *:data-[slot=input-group]:h-9 *:data-[slot=input-group]:border-none *:data-[slot=input-group]:bg-input/30 *:data-[slot=input-group]:shadow-none data-open:animate-in data-open:fade-in-0 data-open:zoom-in-95 data-closed:animate-out data-closed:fade-out-0 data-closed:zoom-out-95",
+            className,
+          )}
+          {...props}
+        />
+      </ComboboxPrimitive.Positioner>
+    </ComboboxPrimitive.Portal>
+  );
+}
+
+function ComboboxList({ className, ...props }: ComboboxPrimitive.List.Props) {
+  return (
+    <ComboboxPrimitive.List
+      data-slot="combobox-list"
+      className={cn(
+        "no-scrollbar max-h-[min(calc(--spacing(72)---spacing(9)),calc(var(--available-height)---spacing(9)))] scroll-py-1 overflow-y-auto overscroll-contain p-1 data-empty:p-0",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function ComboboxItem({ className, children, ...props }: ComboboxPrimitive.Item.Props) {
+  return (
+    <ComboboxPrimitive.Item
+      data-slot="combobox-item"
+      className={cn(
+        "relative flex w-full cursor-default items-center gap-2.5 rounded-xl py-2 pr-8 pl-3 text-sm outline-hidden select-none data-highlighted:bg-accent data-highlighted:text-accent-foreground not-data-[variant=destructive]:data-highlighted:**:text-accent-foreground data-disabled:pointer-events-none data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+        className,
+      )}
+      {...props}
+    >
+      {children}
+      <ComboboxPrimitive.ItemIndicator
+        render={
+          <span className="pointer-events-none absolute right-2 flex size-4 items-center justify-center" />
+        }
+      >
+        <CheckIcon className="pointer-events-none" />
+      </ComboboxPrimitive.ItemIndicator>
+    </ComboboxPrimitive.Item>
+  );
+}
+
+function ComboboxGroup({ className, ...props }: ComboboxPrimitive.Group.Props) {
+  return (
+    <ComboboxPrimitive.Group data-slot="combobox-group" className={cn(className)} {...props} />
+  );
+}
+
+function ComboboxLabel({ className, ...props }: ComboboxPrimitive.GroupLabel.Props) {
+  return (
+    <ComboboxPrimitive.GroupLabel
+      data-slot="combobox-label"
+      className={cn("px-3.5 py-2.5 text-xs text-muted-foreground", className)}
+      {...props}
+    />
+  );
+}
+
+function ComboboxCollection({ ...props }: ComboboxPrimitive.Collection.Props) {
+  return <ComboboxPrimitive.Collection data-slot="combobox-collection" {...props} />;
+}
+
+function ComboboxEmpty({ className, ...props }: ComboboxPrimitive.Empty.Props) {
+  return (
+    <ComboboxPrimitive.Empty
+      data-slot="combobox-empty"
+      className={cn(
+        "hidden w-full justify-center py-2 text-center text-sm text-muted-foreground group-data-empty/combobox-content:flex",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function ComboboxSeparator({ className, ...props }: ComboboxPrimitive.Separator.Props) {
+  return (
+    <ComboboxPrimitive.Separator
+      data-slot="combobox-separator"
+      className={cn("-mx-1 my-1 h-px bg-border/50", className)}
+      {...props}
+    />
+  );
+}
+
+function ComboboxChips({
+  className,
+  ...props
+}: React.ComponentPropsWithRef<typeof ComboboxPrimitive.Chips> & ComboboxPrimitive.Chips.Props) {
+  return (
+    <ComboboxPrimitive.Chips
+      data-slot="combobox-chips"
+      className={cn(
+        "flex min-h-9 flex-wrap items-center gap-1.5 rounded-4xl border border-input bg-input/30 bg-clip-padding px-2.5 py-1.5 text-sm transition-colors focus-within:border-ring focus-within:ring-[3px] focus-within:ring-ring/50 has-aria-invalid:border-destructive has-aria-invalid:ring-[3px] has-aria-invalid:ring-destructive/20 has-data-[slot=combobox-chip]:px-1.5 dark:has-aria-invalid:border-destructive/50 dark:has-aria-invalid:ring-destructive/40",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function ComboboxChip({
+  className,
+  children,
+  showRemove = true,
+  ...props
+}: ComboboxPrimitive.Chip.Props & {
+  showRemove?: boolean;
+}) {
+  return (
+    <ComboboxPrimitive.Chip
+      data-slot="combobox-chip"
+      className={cn(
+        "flex h-[calc(--spacing(5.5))] w-fit items-center justify-center gap-1 rounded-4xl bg-muted-foreground/10 px-2 text-xs font-medium whitespace-nowrap text-foreground has-disabled:pointer-events-none has-disabled:cursor-not-allowed has-disabled:opacity-50 has-data-[slot=combobox-chip-remove]:pr-0",
+        className,
+      )}
+      {...props}
+    >
+      {children}
+      {showRemove && (
+        <ComboboxPrimitive.ChipRemove
+          render={<Button variant="ghost" size="icon-xs" />}
+          className="-ml-1 opacity-50 hover:opacity-100"
+          data-slot="combobox-chip-remove"
+        >
+          <XIcon className="pointer-events-none" />
+        </ComboboxPrimitive.ChipRemove>
+      )}
+    </ComboboxPrimitive.Chip>
+  );
+}
+
+function ComboboxChipsInput({ className, ...props }: ComboboxPrimitive.Input.Props) {
+  return (
+    <ComboboxPrimitive.Input
+      data-slot="combobox-chip-input"
+      className={cn("min-w-16 flex-1 outline-none", className)}
+      {...props}
+    />
+  );
+}
+
+function useComboboxAnchor() {
+  return React.useRef<HTMLDivElement | null>(null);
+}
+
+export {
+  Combobox,
+  ComboboxChip,
+  ComboboxChips,
+  ComboboxChipsInput,
+  ComboboxCollection,
+  ComboboxContent,
+  ComboboxEmpty,
+  ComboboxGroup,
+  ComboboxInput,
+  ComboboxItem,
+  ComboboxLabel,
+  ComboboxList,
+  ComboboxSeparator,
+  ComboboxTrigger,
+  ComboboxValue,
+  useComboboxAnchor,
+};
diff --git a/packages/agents/preview-template/src/components/ui/command.tsx b/packages/agents/preview-template/src/components/ui/command.tsx
new file mode 100644
index 00000000..90497dc4
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/command.tsx
@@ -0,0 +1,179 @@
+"use client";
+
+import { Command as CommandPrimitive } from "cmdk";
+import { CheckIcon, SearchIcon } from "lucide-react";
+import type * as React from "react";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import { InputGroup, InputGroupAddon } from "@/components/ui/input-group";
+import { cn } from "@/lib/utils";
+
+function Command({ className, ...props }: React.ComponentProps<typeof CommandPrimitive>) {
+  return (
+    <CommandPrimitive
+      data-slot="command"
+      className={cn(
+        "flex size-full flex-col overflow-hidden rounded-4xl bg-popover p-1 text-popover-foreground",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function CommandDialog({
+  title = "Command Palette",
+  description = "Search for a command to run...",
+  children,
+  className,
+  showCloseButton = false,
+  ...props
+}: React.ComponentProps<typeof Dialog> & {
+  title?: string;
+  description?: string;
+  className?: string;
+  showCloseButton?: boolean;
+}) {
+  return (
+    <Dialog {...props}>
+      <DialogHeader className="sr-only">
+        <DialogTitle>{title}</DialogTitle>
+        <DialogDescription>{description}</DialogDescription>
+      </DialogHeader>
+      <DialogContent
+        className={cn("top-1/3 translate-y-0 overflow-hidden rounded-4xl! p-0", className)}
+        showCloseButton={showCloseButton}
+      >
+        {children}
+      </DialogContent>
+    </Dialog>
+  );
+}
+
+function CommandInput({
+  className,
+  ...props
+}: React.ComponentProps<typeof CommandPrimitive.Input>) {
+  return (
+    <div data-slot="command-input-wrapper" className="p-1 pb-0">
+      <InputGroup className="h-9 bg-input/30">
+        <CommandPrimitive.Input
+          data-slot="command-input"
+          className={cn(
+            "w-full text-sm outline-hidden disabled:cursor-not-allowed disabled:opacity-50",
+            className,
+          )}
+          {...props}
+        />
+        <InputGroupAddon>
+          <SearchIcon className="size-4 shrink-0 opacity-50" />
+        </InputGroupAddon>
+      </InputGroup>
+    </div>
+  );
+}
+
+function CommandList({ className, ...props }: React.ComponentProps<typeof CommandPrimitive.List>) {
+  return (
+    <CommandPrimitive.List
+      data-slot="command-list"
+      className={cn(
+        "no-scrollbar max-h-72 scroll-py-1 overflow-x-hidden overflow-y-auto outline-none",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function CommandEmpty({
+  className,
+  ...props
+}: React.ComponentProps<typeof CommandPrimitive.Empty>) {
+  return (
+    <CommandPrimitive.Empty
+      data-slot="command-empty"
+      className={cn("py-6 text-center text-sm", className)}
+      {...props}
+    />
+  );
+}
+
+function CommandGroup({
+  className,
+  ...props
+}: React.ComponentProps<typeof CommandPrimitive.Group>) {
+  return (
+    <CommandPrimitive.Group
+      data-slot="command-group"
+      className={cn(
+        "overflow-hidden p-1 text-foreground **:[[cmdk-group-heading]]:px-3 **:[[cmdk-group-heading]]:py-2 **:[[cmdk-group-heading]]:text-xs **:[[cmdk-group-heading]]:font-medium **:[[cmdk-group-heading]]:text-muted-foreground",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function CommandSeparator({
+  className,
+  ...props
+}: React.ComponentProps<typeof CommandPrimitive.Separator>) {
+  return (
+    <CommandPrimitive.Separator
+      data-slot="command-separator"
+      className={cn("my-1 h-px bg-border/50", className)}
+      {...props}
+    />
+  );
+}
+
+function CommandItem({
+  className,
+  children,
+  ...props
+}: React.ComponentProps<typeof CommandPrimitive.Item>) {
+  return (
+    <CommandPrimitive.Item
+      data-slot="command-item"
+      className={cn(
+        "group/command-item relative flex cursor-default items-center gap-2 rounded-lg px-3 py-2 text-sm outline-hidden select-none in-data-[slot=dialog-content]:rounded-2xl data-[disabled=true]:pointer-events-none data-[disabled=true]:opacity-50 data-selected:bg-muted data-selected:text-foreground [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 data-selected:*:[svg]:text-foreground",
+        className,
+      )}
+      {...props}
+    >
+      {children}
+      <CheckIcon className="ml-auto opacity-0 group-has-data-[slot=command-shortcut]/command-item:hidden group-data-[checked=true]/command-item:opacity-100" />
+    </CommandPrimitive.Item>
+  );
+}
+
+function CommandShortcut({ className, ...props }: React.ComponentProps<"span">) {
+  return (
+    <span
+      data-slot="command-shortcut"
+      className={cn(
+        "ml-auto text-xs tracking-widest text-muted-foreground group-data-selected/command-item:text-foreground",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+export {
+  Command,
+  CommandDialog,
+  CommandEmpty,
+  CommandGroup,
+  CommandInput,
+  CommandItem,
+  CommandList,
+  CommandSeparator,
+  CommandShortcut,
+};
diff --git a/packages/agents/preview-template/src/components/ui/context-menu.tsx b/packages/agents/preview-template/src/components/ui/context-menu.tsx
new file mode 100644
index 00000000..f9761db6
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/context-menu.tsx
@@ -0,0 +1,243 @@
+"use client";
+
+import { CheckIcon, ChevronRightIcon } from "lucide-react";
+import { ContextMenu as ContextMenuPrimitive } from "radix-ui";
+import type * as React from "react";
+import { cn } from "@/lib/utils";
+
+function ContextMenu({ ...props }: React.ComponentProps<typeof ContextMenuPrimitive.Root>) {
+  return <ContextMenuPrimitive.Root data-slot="context-menu" {...props} />;
+}
+
+function ContextMenuTrigger({
+  className,
+  ...props
+}: React.ComponentProps<typeof ContextMenuPrimitive.Trigger>) {
+  return (
+    <ContextMenuPrimitive.Trigger
+      data-slot="context-menu-trigger"
+      className={cn("select-none", className)}
+      {...props}
+    />
+  );
+}
+
+function ContextMenuGroup({ ...props }: React.ComponentProps<typeof ContextMenuPrimitive.Group>) {
+  return <ContextMenuPrimitive.Group data-slot="context-menu-group" {...props} />;
+}
+
+function ContextMenuPortal({ ...props }: React.ComponentProps<typeof ContextMenuPrimitive.Portal>) {
+  return <ContextMenuPrimitive.Portal data-slot="context-menu-portal" {...props} />;
+}
+
+function ContextMenuSub({ ...props }: React.ComponentProps<typeof ContextMenuPrimitive.Sub>) {
+  return <ContextMenuPrimitive.Sub data-slot="context-menu-sub" {...props} />;
+}
+
+function ContextMenuRadioGroup({
+  ...props
+}: React.ComponentProps<typeof ContextMenuPrimitive.RadioGroup>) {
+  return <ContextMenuPrimitive.RadioGroup data-slot="context-menu-radio-group" {...props} />;
+}
+
+function ContextMenuContent({
+  className,
+  ...props
+}: React.ComponentProps<typeof ContextMenuPrimitive.Content> & {
+  side?: "top" | "right" | "bottom" | "left";
+}) {
+  return (
+    <ContextMenuPrimitive.Portal>
+      <ContextMenuPrimitive.Content
+        data-slot="context-menu-content"
+        className={cn(
+          "z-50 max-h-(--radix-context-menu-content-available-height) min-w-48 origin-(--radix-context-menu-content-transform-origin) overflow-x-hidden overflow-y-auto rounded-2xl bg-popover p-1 text-popover-foreground shadow-2xl ring-1 ring-foreground/5 duration-100 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 data-open:animate-in data-open:fade-in-0 data-open:zoom-in-95 data-closed:animate-out data-closed:fade-out-0 data-closed:zoom-out-95",
+          className,
+        )}
+        {...props}
+      />
+    </ContextMenuPrimitive.Portal>
+  );
+}
+
+function ContextMenuItem({
+  className,
+  inset,
+  variant = "default",
+  ...props
+}: React.ComponentProps<typeof ContextMenuPrimitive.Item> & {
+  inset?: boolean;
+  variant?: "default" | "destructive";
+}) {
+  return (
+    <ContextMenuPrimitive.Item
+      data-slot="context-menu-item"
+      data-inset={inset}
+      data-variant={variant}
+      className={cn(
+        "group/context-menu-item relative flex cursor-default items-center gap-2.5 rounded-xl px-3 py-2 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground data-inset:pl-9.5 data-[variant=destructive]:text-destructive data-[variant=destructive]:focus:bg-destructive/10 data-[variant=destructive]:focus:text-destructive dark:data-[variant=destructive]:focus:bg-destructive/20 data-disabled:pointer-events-none data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 focus:*:[svg]:text-accent-foreground data-[variant=destructive]:*:[svg]:text-destructive",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function ContextMenuSubTrigger({
+  className,
+  inset,
+  children,
+  ...props
+}: React.ComponentProps<typeof ContextMenuPrimitive.SubTrigger> & {
+  inset?: boolean;
+}) {
+  return (
+    <ContextMenuPrimitive.SubTrigger
+      data-slot="context-menu-sub-trigger"
+      data-inset={inset}
+      className={cn(
+        "flex cursor-default items-center rounded-xl px-3 py-2 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground data-inset:pl-9.5 data-open:bg-accent data-open:text-accent-foreground [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+        className,
+      )}
+      {...props}
+    >
+      {children}
+      <ChevronRightIcon className="ml-auto" />
+    </ContextMenuPrimitive.SubTrigger>
+  );
+}
+
+function ContextMenuSubContent({
+  className,
+  ...props
+}: React.ComponentProps<typeof ContextMenuPrimitive.SubContent>) {
+  return (
+    <ContextMenuPrimitive.SubContent
+      data-slot="context-menu-sub-content"
+      className={cn(
+        "z-50 min-w-32 origin-(--radix-context-menu-content-transform-origin) overflow-hidden rounded-2xl border bg-popover p-1 text-popover-foreground shadow-lg duration-100 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 data-open:animate-in data-open:fade-in-0 data-open:zoom-in-95 data-closed:animate-out data-closed:fade-out-0 data-closed:zoom-out-95",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function ContextMenuCheckboxItem({
+  className,
+  children,
+  checked,
+  inset,
+  ...props
+}: React.ComponentProps<typeof ContextMenuPrimitive.CheckboxItem> & {
+  inset?: boolean;
+}) {
+  return (
+    <ContextMenuPrimitive.CheckboxItem
+      data-slot="context-menu-checkbox-item"
+      data-inset={inset}
+      className={cn(
+        "relative flex cursor-default items-center gap-2 rounded-xl py-2 pr-8 pl-3 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground data-inset:pl-9.5 data-disabled:pointer-events-none data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+        className,
+      )}
+      checked={checked}
+      {...props}
+    >
+      <span className="pointer-events-none absolute right-2">
+        <ContextMenuPrimitive.ItemIndicator>
+          <CheckIcon />
+        </ContextMenuPrimitive.ItemIndicator>
+      </span>
+      {children}
+    </ContextMenuPrimitive.CheckboxItem>
+  );
+}
+
+function ContextMenuRadioItem({
+  className,
+  children,
+  inset,
+  ...props
+}: React.ComponentProps<typeof ContextMenuPrimitive.RadioItem> & {
+  inset?: boolean;
+}) {
+  return (
+    <ContextMenuPrimitive.RadioItem
+      data-slot="context-menu-radio-item"
+      data-inset={inset}
+      className={cn(
+        "relative flex cursor-default items-center gap-2 rounded-xl py-2 pr-8 pl-3 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground data-inset:pl-9.5 data-disabled:pointer-events-none data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+        className,
+      )}
+      {...props}
+    >
+      <span className="pointer-events-none absolute right-2">
+        <ContextMenuPrimitive.ItemIndicator>
+          <CheckIcon />
+        </ContextMenuPrimitive.ItemIndicator>
+      </span>
+      {children}
+    </ContextMenuPrimitive.RadioItem>
+  );
+}
+
+function ContextMenuLabel({
+  className,
+  inset,
+  ...props
+}: React.ComponentProps<typeof ContextMenuPrimitive.Label> & {
+  inset?: boolean;
+}) {
+  return (
+    <ContextMenuPrimitive.Label
+      data-slot="context-menu-label"
+      data-inset={inset}
+      className={cn("px-3 py-2.5 text-xs text-muted-foreground data-inset:pl-9.5", className)}
+      {...props}
+    />
+  );
+}
+
+function ContextMenuSeparator({
+  className,
+  ...props
+}: React.ComponentProps<typeof ContextMenuPrimitive.Separator>) {
+  return (
+    <ContextMenuPrimitive.Separator
+      data-slot="context-menu-separator"
+      className={cn("-mx-1 my-1 h-px bg-border/50", className)}
+      {...props}
+    />
+  );
+}
+
+function ContextMenuShortcut({ className, ...props }: React.ComponentProps<"span">) {
+  return (
+    <span
+      data-slot="context-menu-shortcut"
+      className={cn(
+        "ml-auto text-xs tracking-widest text-muted-foreground group-focus/context-menu-item:text-accent-foreground",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+export {
+  ContextMenu,
+  ContextMenuCheckboxItem,
+  ContextMenuContent,
+  ContextMenuGroup,
+  ContextMenuItem,
+  ContextMenuLabel,
+  ContextMenuPortal,
+  ContextMenuRadioGroup,
+  ContextMenuRadioItem,
+  ContextMenuSeparator,
+  ContextMenuShortcut,
+  ContextMenuSub,
+  ContextMenuSubContent,
+  ContextMenuSubTrigger,
+  ContextMenuTrigger,
+};
diff --git a/packages/agents/preview-template/src/components/ui/data-table.tsx b/packages/agents/preview-template/src/components/ui/data-table.tsx
new file mode 100644
index 00000000..389c96dd
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/data-table.tsx
@@ -0,0 +1,166 @@
+"use client";
+
+import {
+  type ColumnDef,
+  type ColumnFiltersState,
+  flexRender,
+  getCoreRowModel,
+  getFilteredRowModel,
+  getPaginationRowModel,
+  getSortedRowModel,
+  type SortingState,
+  useReactTable,
+} from "@tanstack/react-table";
+import { ArrowUpDownIcon } from "lucide-react";
+import * as React from "react";
+
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from "@/components/ui/table";
+import { cn } from "@/lib/utils";
+
+interface DataTableProps<TData, TValue> {
+  columns: ColumnDef<TData, TValue>[];
+  data: TData[];
+  /** Column id to expose a text filter for (renders a search input). */
+  filterColumn?: string;
+  filterPlaceholder?: string;
+  /** Rows per page. Pagination controls only render when data exceeds this. */
+  pageSize?: number;
+  className?: string;
+}
+
+/**
+ * Sortable + filterable table built on @tanstack/react-table and the shadcn
+ * Table primitives. Pass column defs (use `DataTableColumnHeader` for sortable
+ * headers) and a row array.
+ */
+function DataTable<TData, TValue>({
+  columns,
+  data,
+  filterColumn,
+  filterPlaceholder = "Filter…",
+  pageSize = 10,
+  className,
+}: DataTableProps<TData, TValue>) {
+  const [sorting, setSorting] = React.useState<SortingState>([]);
+  const [columnFilters, setColumnFilters] = React.useState<ColumnFiltersState>([]);
+
+  const table = useReactTable({
+    data,
+    columns,
+    getCoreRowModel: getCoreRowModel(),
+    getSortedRowModel: getSortedRowModel(),
+    getFilteredRowModel: getFilteredRowModel(),
+    getPaginationRowModel: getPaginationRowModel(),
+    onSortingChange: setSorting,
+    onColumnFiltersChange: setColumnFilters,
+    initialState: { pagination: { pageSize } },
+    state: { sorting, columnFilters },
+  });
+
+  const showPagination = data.length > pageSize;
+
+  return (
+    <div className={cn("space-y-3", className)}>
+      {filterColumn ? (
+        <Input
+          placeholder={filterPlaceholder}
+          value={(table.getColumn(filterColumn)?.getFilterValue() as string) ?? ""}
+          onChange={(event) => table.getColumn(filterColumn)?.setFilterValue(event.target.value)}
+          className="max-w-sm"
+        />
+      ) : null}
+      <div className="rounded-md border">
+        <Table>
+          <TableHeader>
+            {table.getHeaderGroups().map((headerGroup) => (
+              <TableRow key={headerGroup.id}>
+                {headerGroup.headers.map((header) => (
+                  <TableHead key={header.id}>
+                    {header.isPlaceholder
+                      ? null
+                      : flexRender(header.column.columnDef.header, header.getContext())}
+                  </TableHead>
+                ))}
+              </TableRow>
+            ))}
+          </TableHeader>
+          <TableBody>
+            {table.getRowModel().rows.length ? (
+              table.getRowModel().rows.map((row) => (
+                <TableRow key={row.id} data-state={row.getIsSelected() && "selected"}>
+                  {row.getVisibleCells().map((cell) => (
+                    <TableCell key={cell.id}>
+                      {flexRender(cell.column.columnDef.cell, cell.getContext())}
+                    </TableCell>
+                  ))}
+                </TableRow>
+              ))
+            ) : (
+              <TableRow>
+                <TableCell colSpan={columns.length} className="h-24 text-center">
+                  No results.
+                </TableCell>
+              </TableRow>
+            )}
+          </TableBody>
+        </Table>
+      </div>
+      {showPagination ? (
+        <div className="flex items-center justify-end gap-2">
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={() => table.previousPage()}
+            disabled={!table.getCanPreviousPage()}
+          >
+            Previous
+          </Button>
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={() => table.nextPage()}
+            disabled={!table.getCanNextPage()}
+          >
+            Next
+          </Button>
+        </div>
+      ) : null}
+    </div>
+  );
+}
+
+interface DataTableColumnHeaderProps extends React.ComponentProps<typeof Button> {
+  title: string;
+  onSort?: () => void;
+  sorted?: false | "asc" | "desc";
+}
+
+/**
+ * Clickable sortable column header. In a column def `header`, render:
+ * `({ column }) => <DataTableColumnHeader title="Name" onSort={() => column.toggleSorting(column.getIsSorted() === "asc")} />`
+ */
+function DataTableColumnHeader({ title, onSort, className, ...props }: DataTableColumnHeaderProps) {
+  return (
+    <Button
+      variant="ghost"
+      size="sm"
+      onClick={onSort}
+      className={cn("-ml-3 h-8 data-[disabled]:cursor-default", className)}
+      {...props}
+    >
+      {title}
+      <ArrowUpDownIcon className="ml-2 size-4" />
+    </Button>
+  );
+}
+
+export { DataTable, DataTableColumnHeader };
diff --git a/packages/agents/preview-template/src/components/ui/dialog.tsx b/packages/agents/preview-template/src/components/ui/dialog.tsx
new file mode 100644
index 00000000..19045423
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/dialog.tsx
@@ -0,0 +1,141 @@
+"use client";
+
+import { XIcon } from "lucide-react";
+import { Dialog as DialogPrimitive } from "radix-ui";
+import type * as React from "react";
+import { Button } from "@/components/ui/button";
+import { cn } from "@/lib/utils";
+
+function Dialog({ ...props }: React.ComponentProps<typeof DialogPrimitive.Root>) {
+  return <DialogPrimitive.Root data-slot="dialog" {...props} />;
+}
+
+function DialogTrigger({ ...props }: React.ComponentProps<typeof DialogPrimitive.Trigger>) {
+  return <DialogPrimitive.Trigger data-slot="dialog-trigger" {...props} />;
+}
+
+function DialogPortal({ ...props }: React.ComponentProps<typeof DialogPrimitive.Portal>) {
+  return <DialogPrimitive.Portal data-slot="dialog-portal" {...props} />;
+}
+
+function DialogClose({ ...props }: React.ComponentProps<typeof DialogPrimitive.Close>) {
+  return <DialogPrimitive.Close data-slot="dialog-close" {...props} />;
+}
+
+function DialogOverlay({
+  className,
+  ...props
+}: React.ComponentProps<typeof DialogPrimitive.Overlay>) {
+  return (
+    <DialogPrimitive.Overlay
+      data-slot="dialog-overlay"
+      className={cn(
+        "fixed inset-0 isolate z-50 bg-black/80 duration-100 supports-backdrop-filter:backdrop-blur-xs data-open:animate-in data-open:fade-in-0 data-closed:animate-out data-closed:fade-out-0",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function DialogContent({
+  className,
+  children,
+  showCloseButton = true,
+  ...props
+}: React.ComponentProps<typeof DialogPrimitive.Content> & {
+  showCloseButton?: boolean;
+}) {
+  return (
+    <DialogPortal>
+      <DialogOverlay />
+      <DialogPrimitive.Content
+        data-slot="dialog-content"
+        className={cn(
+          "fixed top-1/2 left-1/2 z-50 grid w-full max-w-[calc(100%-2rem)] -translate-x-1/2 -translate-y-1/2 gap-6 rounded-4xl bg-popover p-6 text-sm text-popover-foreground ring-1 ring-foreground/5 duration-100 outline-none sm:max-w-md data-open:animate-in data-open:fade-in-0 data-open:zoom-in-95 data-closed:animate-out data-closed:fade-out-0 data-closed:zoom-out-95",
+          className,
+        )}
+        {...props}
+      >
+        {children}
+        {showCloseButton && (
+          <DialogPrimitive.Close data-slot="dialog-close" asChild>
+            <Button variant="ghost" className="absolute top-4 right-4" size="icon-sm">
+              <XIcon />
+              <span className="sr-only">Close</span>
+            </Button>
+          </DialogPrimitive.Close>
+        )}
+      </DialogPrimitive.Content>
+    </DialogPortal>
+  );
+}
+
+function DialogHeader({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div data-slot="dialog-header" className={cn("flex flex-col gap-2", className)} {...props} />
+  );
+}
+
+function DialogFooter({
+  className,
+  showCloseButton = false,
+  children,
+  ...props
+}: React.ComponentProps<"div"> & {
+  showCloseButton?: boolean;
+}) {
+  return (
+    <div
+      data-slot="dialog-footer"
+      className={cn("flex flex-col-reverse gap-2 sm:flex-row sm:justify-end", className)}
+      {...props}
+    >
+      {children}
+      {showCloseButton && (
+        <DialogPrimitive.Close asChild>
+          <Button variant="outline">Close</Button>
+        </DialogPrimitive.Close>
+      )}
+    </div>
+  );
+}
+
+function DialogTitle({ className, ...props }: React.ComponentProps<typeof DialogPrimitive.Title>) {
+  return (
+    <DialogPrimitive.Title
+      data-slot="dialog-title"
+      className={cn("text-base leading-none font-medium", className)}
+      {...props}
+    />
+  );
+}
+
+function DialogDescription({
+  className,
+  ...props
+}: React.ComponentProps<typeof DialogPrimitive.Description>) {
+  return (
+    <DialogPrimitive.Description
+      data-slot="dialog-description"
+      className={cn(
+        "text-sm text-muted-foreground *:[a]:underline *:[a]:underline-offset-3 *:[a]:hover:text-foreground",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+export {
+  Dialog,
+  DialogClose,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogOverlay,
+  DialogPortal,
+  DialogTitle,
+  DialogTrigger,
+};
diff --git a/packages/agents/preview-template/src/components/ui/direction.tsx b/packages/agents/preview-template/src/components/ui/direction.tsx
new file mode 100644
index 00000000..97266f20
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/direction.tsx
@@ -0,0 +1,20 @@
+"use client";
+
+import { Direction } from "radix-ui";
+import type * as React from "react";
+
+function DirectionProvider({
+  dir,
+  direction,
+  children,
+}: React.ComponentProps<typeof Direction.DirectionProvider> & {
+  direction?: React.ComponentProps<typeof Direction.DirectionProvider>["dir"];
+}) {
+  return (
+    <Direction.DirectionProvider dir={direction ?? dir}>{children}</Direction.DirectionProvider>
+  );
+}
+
+const useDirection = Direction.useDirection;
+
+export { DirectionProvider, useDirection };
diff --git a/packages/agents/preview-template/src/components/ui/drawer.tsx b/packages/agents/preview-template/src/components/ui/drawer.tsx
new file mode 100644
index 00000000..32c48949
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/drawer.tsx
@@ -0,0 +1,120 @@
+"use client";
+
+import type * as React from "react";
+import { Drawer as DrawerPrimitive } from "vaul";
+
+import { cn } from "@/lib/utils";
+
+function Drawer({ ...props }: React.ComponentProps<typeof DrawerPrimitive.Root>) {
+  return <DrawerPrimitive.Root data-slot="drawer" {...props} />;
+}
+
+function DrawerTrigger({ ...props }: React.ComponentProps<typeof DrawerPrimitive.Trigger>) {
+  return <DrawerPrimitive.Trigger data-slot="drawer-trigger" {...props} />;
+}
+
+function DrawerPortal({ ...props }: React.ComponentProps<typeof DrawerPrimitive.Portal>) {
+  return <DrawerPrimitive.Portal data-slot="drawer-portal" {...props} />;
+}
+
+function DrawerClose({ ...props }: React.ComponentProps<typeof DrawerPrimitive.Close>) {
+  return <DrawerPrimitive.Close data-slot="drawer-close" {...props} />;
+}
+
+function DrawerOverlay({
+  className,
+  ...props
+}: React.ComponentProps<typeof DrawerPrimitive.Overlay>) {
+  return (
+    <DrawerPrimitive.Overlay
+      data-slot="drawer-overlay"
+      className={cn(
+        "fixed inset-0 z-50 bg-black/80 supports-backdrop-filter:backdrop-blur-xs data-open:animate-in data-open:fade-in-0 data-closed:animate-out data-closed:fade-out-0",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function DrawerContent({
+  className,
+  children,
+  ...props
+}: React.ComponentProps<typeof DrawerPrimitive.Content>) {
+  return (
+    <DrawerPortal data-slot="drawer-portal">
+      <DrawerOverlay />
+      <DrawerPrimitive.Content
+        data-slot="drawer-content"
+        className={cn(
+          "group/drawer-content fixed z-50 flex h-auto flex-col bg-transparent p-4 text-sm text-popover-foreground before:absolute before:inset-2 before:-z-10 before:rounded-4xl before:border before:border-border before:bg-popover data-[vaul-drawer-direction=bottom]:inset-x-0 data-[vaul-drawer-direction=bottom]:bottom-0 data-[vaul-drawer-direction=bottom]:mt-24 data-[vaul-drawer-direction=bottom]:max-h-[80vh] data-[vaul-drawer-direction=left]:inset-y-0 data-[vaul-drawer-direction=left]:left-0 data-[vaul-drawer-direction=left]:w-3/4 data-[vaul-drawer-direction=right]:inset-y-0 data-[vaul-drawer-direction=right]:right-0 data-[vaul-drawer-direction=right]:w-3/4 data-[vaul-drawer-direction=top]:inset-x-0 data-[vaul-drawer-direction=top]:top-0 data-[vaul-drawer-direction=top]:mb-24 data-[vaul-drawer-direction=top]:max-h-[80vh] data-[vaul-drawer-direction=left]:sm:max-w-sm data-[vaul-drawer-direction=right]:sm:max-w-sm",
+          className,
+        )}
+        {...props}
+      >
+        <div className="mx-auto mt-4 hidden h-1.5 w-[100px] shrink-0 rounded-full bg-muted group-data-[vaul-drawer-direction=bottom]/drawer-content:block" />
+        {children}
+      </DrawerPrimitive.Content>
+    </DrawerPortal>
+  );
+}
+
+function DrawerHeader({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="drawer-header"
+      className={cn(
+        "flex flex-col gap-0.5 p-4 group-data-[vaul-drawer-direction=bottom]/drawer-content:text-center group-data-[vaul-drawer-direction=top]/drawer-content:text-center md:gap-1.5 md:text-left",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function DrawerFooter({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="drawer-footer"
+      className={cn("mt-auto flex flex-col gap-2 p-4", className)}
+      {...props}
+    />
+  );
+}
+
+function DrawerTitle({ className, ...props }: React.ComponentProps<typeof DrawerPrimitive.Title>) {
+  return (
+    <DrawerPrimitive.Title
+      data-slot="drawer-title"
+      className={cn("text-base font-medium text-foreground", className)}
+      {...props}
+    />
+  );
+}
+
+function DrawerDescription({
+  className,
+  ...props
+}: React.ComponentProps<typeof DrawerPrimitive.Description>) {
+  return (
+    <DrawerPrimitive.Description
+      data-slot="drawer-description"
+      className={cn("text-sm text-muted-foreground", className)}
+      {...props}
+    />
+  );
+}
+
+export {
+  Drawer,
+  DrawerClose,
+  DrawerContent,
+  DrawerDescription,
+  DrawerFooter,
+  DrawerHeader,
+  DrawerOverlay,
+  DrawerPortal,
+  DrawerTitle,
+  DrawerTrigger,
+};
diff --git a/packages/agents/preview-template/src/components/ui/dropdown-menu.tsx b/packages/agents/preview-template/src/components/ui/dropdown-menu.tsx
new file mode 100644
index 00000000..10fdb42a
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/dropdown-menu.tsx
@@ -0,0 +1,250 @@
+"use client";
+
+import { CheckIcon, ChevronRightIcon } from "lucide-react";
+import { DropdownMenu as DropdownMenuPrimitive } from "radix-ui";
+import type * as React from "react";
+import { cn } from "@/lib/utils";
+
+function DropdownMenu({ ...props }: React.ComponentProps<typeof DropdownMenuPrimitive.Root>) {
+  return <DropdownMenuPrimitive.Root data-slot="dropdown-menu" {...props} />;
+}
+
+function DropdownMenuPortal({
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Portal>) {
+  return <DropdownMenuPrimitive.Portal data-slot="dropdown-menu-portal" {...props} />;
+}
+
+function DropdownMenuTrigger({
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Trigger>) {
+  return <DropdownMenuPrimitive.Trigger data-slot="dropdown-menu-trigger" {...props} />;
+}
+
+function DropdownMenuContent({
+  className,
+  align = "start",
+  sideOffset = 4,
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Content>) {
+  return (
+    <DropdownMenuPrimitive.Portal>
+      <DropdownMenuPrimitive.Content
+        data-slot="dropdown-menu-content"
+        sideOffset={sideOffset}
+        align={align}
+        className={cn(
+          "z-50 max-h-(--radix-dropdown-menu-content-available-height) w-(--radix-dropdown-menu-trigger-width) min-w-48 origin-(--radix-dropdown-menu-content-transform-origin) overflow-x-hidden overflow-y-auto rounded-2xl bg-popover p-1 text-popover-foreground shadow-2xl ring-1 ring-foreground/5 duration-100 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 data-[state=closed]:overflow-hidden dark:ring-foreground/10 data-open:animate-in data-open:fade-in-0 data-open:zoom-in-95 data-closed:animate-out data-closed:fade-out-0 data-closed:zoom-out-95",
+          className,
+        )}
+        {...props}
+      />
+    </DropdownMenuPrimitive.Portal>
+  );
+}
+
+function DropdownMenuGroup({ ...props }: React.ComponentProps<typeof DropdownMenuPrimitive.Group>) {
+  return <DropdownMenuPrimitive.Group data-slot="dropdown-menu-group" {...props} />;
+}
+
+function DropdownMenuItem({
+  className,
+  inset,
+  variant = "default",
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Item> & {
+  inset?: boolean;
+  variant?: "default" | "destructive";
+}) {
+  return (
+    <DropdownMenuPrimitive.Item
+      data-slot="dropdown-menu-item"
+      data-inset={inset}
+      data-variant={variant}
+      className={cn(
+        "group/dropdown-menu-item relative flex cursor-default items-center gap-2.5 rounded-xl px-3 py-2 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground not-data-[variant=destructive]:focus:**:text-accent-foreground data-inset:pl-9.5 data-[variant=destructive]:text-destructive data-[variant=destructive]:focus:bg-destructive/10 data-[variant=destructive]:focus:text-destructive dark:data-[variant=destructive]:focus:bg-destructive/20 data-disabled:pointer-events-none data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 data-[variant=destructive]:*:[svg]:text-destructive",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function DropdownMenuCheckboxItem({
+  className,
+  children,
+  checked,
+  inset,
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.CheckboxItem> & {
+  inset?: boolean;
+}) {
+  return (
+    <DropdownMenuPrimitive.CheckboxItem
+      data-slot="dropdown-menu-checkbox-item"
+      data-inset={inset}
+      className={cn(
+        "relative flex cursor-default items-center gap-2.5 rounded-xl py-2 pr-8 pl-3 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground focus:**:text-accent-foreground data-inset:pl-9.5 data-disabled:pointer-events-none data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+        className,
+      )}
+      checked={checked}
+      {...props}
+    >
+      <span
+        className="pointer-events-none absolute right-2 flex items-center justify-center"
+        data-slot="dropdown-menu-checkbox-item-indicator"
+      >
+        <DropdownMenuPrimitive.ItemIndicator>
+          <CheckIcon />
+        </DropdownMenuPrimitive.ItemIndicator>
+      </span>
+      {children}
+    </DropdownMenuPrimitive.CheckboxItem>
+  );
+}
+
+function DropdownMenuRadioGroup({
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.RadioGroup>) {
+  return <DropdownMenuPrimitive.RadioGroup data-slot="dropdown-menu-radio-group" {...props} />;
+}
+
+function DropdownMenuRadioItem({
+  className,
+  children,
+  inset,
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.RadioItem> & {
+  inset?: boolean;
+}) {
+  return (
+    <DropdownMenuPrimitive.RadioItem
+      data-slot="dropdown-menu-radio-item"
+      data-inset={inset}
+      className={cn(
+        "relative flex cursor-default items-center gap-2.5 rounded-xl py-2 pr-8 pl-3 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground focus:**:text-accent-foreground data-inset:pl-9.5 data-disabled:pointer-events-none data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+        className,
+      )}
+      {...props}
+    >
+      <span
+        className="pointer-events-none absolute right-2 flex items-center justify-center"
+        data-slot="dropdown-menu-radio-item-indicator"
+      >
+        <DropdownMenuPrimitive.ItemIndicator>
+          <CheckIcon />
+        </DropdownMenuPrimitive.ItemIndicator>
+      </span>
+      {children}
+    </DropdownMenuPrimitive.RadioItem>
+  );
+}
+
+function DropdownMenuLabel({
+  className,
+  inset,
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Label> & {
+  inset?: boolean;
+}) {
+  return (
+    <DropdownMenuPrimitive.Label
+      data-slot="dropdown-menu-label"
+      data-inset={inset}
+      className={cn("px-3 py-2.5 text-xs text-muted-foreground data-inset:pl-9.5", className)}
+      {...props}
+    />
+  );
+}
+
+function DropdownMenuSeparator({
+  className,
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Separator>) {
+  return (
+    <DropdownMenuPrimitive.Separator
+      data-slot="dropdown-menu-separator"
+      className={cn("-mx-1 my-1 h-px bg-border/50", className)}
+      {...props}
+    />
+  );
+}
+
+function DropdownMenuShortcut({ className, ...props }: React.ComponentProps<"span">) {
+  return (
+    <span
+      data-slot="dropdown-menu-shortcut"
+      className={cn(
+        "ml-auto text-xs tracking-widest text-muted-foreground group-focus/dropdown-menu-item:text-accent-foreground",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function DropdownMenuSub({ ...props }: React.ComponentProps<typeof DropdownMenuPrimitive.Sub>) {
+  return <DropdownMenuPrimitive.Sub data-slot="dropdown-menu-sub" {...props} />;
+}
+
+function DropdownMenuSubTrigger({
+  className,
+  inset,
+  children,
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.SubTrigger> & {
+  inset?: boolean;
+}) {
+  return (
+    <DropdownMenuPrimitive.SubTrigger
+      data-slot="dropdown-menu-sub-trigger"
+      data-inset={inset}
+      className={cn(
+        "flex cursor-default items-center gap-2 rounded-xl px-3 py-2 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground not-data-[variant=destructive]:focus:**:text-accent-foreground data-inset:pl-9.5 data-open:bg-accent data-open:text-accent-foreground [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+        className,
+      )}
+      {...props}
+    >
+      {children}
+      <ChevronRightIcon className="ml-auto" />
+    </DropdownMenuPrimitive.SubTrigger>
+  );
+}
+
+function DropdownMenuSubContent({
+  className,
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.SubContent>) {
+  return (
+    // Portal the flyout to the body so it isn't clipped by the parent
+    // DropdownMenuContent's `overflow-*` (which otherwise hides the submenu).
+    <DropdownMenuPrimitive.Portal>
+      <DropdownMenuPrimitive.SubContent
+        data-slot="dropdown-menu-sub-content"
+        className={cn(
+          "z-50 min-w-36 origin-(--radix-dropdown-menu-content-transform-origin) overflow-hidden rounded-2xl bg-popover p-1 text-popover-foreground shadow-2xl ring-1 ring-foreground/5 duration-100 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 data-open:animate-in data-open:fade-in-0 data-open:zoom-in-95 data-closed:animate-out data-closed:fade-out-0 data-closed:zoom-out-95",
+          className,
+        )}
+        {...props}
+      />
+    </DropdownMenuPrimitive.Portal>
+  );
+}
+
+export {
+  DropdownMenu,
+  DropdownMenuCheckboxItem,
+  DropdownMenuContent,
+  DropdownMenuGroup,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuPortal,
+  DropdownMenuRadioGroup,
+  DropdownMenuRadioItem,
+  DropdownMenuSeparator,
+  DropdownMenuShortcut,
+  DropdownMenuSub,
+  DropdownMenuSubContent,
+  DropdownMenuSubTrigger,
+  DropdownMenuTrigger,
+};
diff --git a/packages/agents/preview-template/src/components/ui/empty.tsx b/packages/agents/preview-template/src/components/ui/empty.tsx
new file mode 100644
index 00000000..0f99506f
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/empty.tsx
@@ -0,0 +1,94 @@
+import { cva, type VariantProps } from "class-variance-authority";
+
+import { cn } from "@/lib/utils";
+
+function Empty({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="empty"
+      className={cn(
+        "flex w-full min-w-0 flex-1 flex-col items-center justify-center gap-4 rounded-lg border-dashed p-12 text-center text-balance",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function EmptyHeader({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="empty-header"
+      className={cn("flex max-w-sm flex-col items-center gap-2", className)}
+      {...props}
+    />
+  );
+}
+
+const emptyMediaVariants = cva(
+  "mb-2 flex shrink-0 items-center justify-center [&_svg]:pointer-events-none [&_svg]:shrink-0",
+  {
+    variants: {
+      variant: {
+        default: "bg-transparent",
+        icon: "flex size-10 shrink-0 items-center justify-center rounded-lg bg-muted text-foreground [&_svg:not([class*='size-'])]:size-6",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+    },
+  },
+);
+
+function EmptyMedia({
+  className,
+  variant = "default",
+  ...props
+}: React.ComponentProps<"div"> & VariantProps<typeof emptyMediaVariants>) {
+  return (
+    <div
+      data-slot="empty-icon"
+      data-variant={variant}
+      className={cn(emptyMediaVariants({ variant, className }))}
+      {...props}
+    />
+  );
+}
+
+function EmptyTitle({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="empty-title"
+      className={cn("text-lg font-medium tracking-tight", className)}
+      {...props}
+    />
+  );
+}
+
+function EmptyDescription({ className, ...props }: React.ComponentProps<"p">) {
+  return (
+    <div
+      data-slot="empty-description"
+      className={cn(
+        "text-sm/relaxed text-muted-foreground [&>a]:underline [&>a]:underline-offset-4 [&>a:hover]:text-primary",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function EmptyContent({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="empty-content"
+      className={cn(
+        "flex w-full max-w-sm min-w-0 flex-col items-center gap-4 text-sm text-balance",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+export { Empty, EmptyContent, EmptyDescription, EmptyHeader, EmptyMedia, EmptyTitle };
diff --git a/packages/agents/preview-template/src/components/ui/field.tsx b/packages/agents/preview-template/src/components/ui/field.tsx
new file mode 100644
index 00000000..60047819
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/field.tsx
@@ -0,0 +1,223 @@
+"use client";
+
+import { cva, type VariantProps } from "class-variance-authority";
+import { useMemo } from "react";
+import { Label } from "@/components/ui/label";
+import { Separator } from "@/components/ui/separator";
+import { cn } from "@/lib/utils";
+
+function FieldSet({ className, ...props }: React.ComponentProps<"fieldset">) {
+  return (
+    <fieldset
+      data-slot="field-set"
+      className={cn(
+        "flex flex-col gap-6 has-[>[data-slot=checkbox-group]]:gap-3 has-[>[data-slot=radio-group]]:gap-3",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function FieldLegend({
+  className,
+  variant = "legend",
+  ...props
+}: React.ComponentProps<"legend"> & { variant?: "legend" | "label" }) {
+  return (
+    <legend
+      data-slot="field-legend"
+      data-variant={variant}
+      className={cn(
+        "mb-3 font-medium data-[variant=label]:text-sm data-[variant=legend]:text-base",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function FieldGroup({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="field-group"
+      className={cn(
+        "group/field-group @container/field-group flex w-full flex-col gap-7 data-[slot=checkbox-group]:gap-3 *:data-[slot=field-group]:gap-4",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+const fieldVariants = cva("group/field flex w-full gap-3 data-[invalid=true]:text-destructive", {
+  variants: {
+    orientation: {
+      vertical: "flex-col *:w-full [&>.sr-only]:w-auto",
+      horizontal:
+        "flex-row items-center has-[>[data-slot=field-content]]:items-start *:data-[slot=field-label]:flex-auto has-[>[data-slot=field-content]]:[&>[role=checkbox],[role=radio]]:mt-px",
+      responsive:
+        "flex-col *:w-full @md/field-group:flex-row @md/field-group:items-center @md/field-group:*:w-auto @md/field-group:has-[>[data-slot=field-content]]:items-start @md/field-group:*:data-[slot=field-label]:flex-auto [&>.sr-only]:w-auto @md/field-group:has-[>[data-slot=field-content]]:[&>[role=checkbox],[role=radio]]:mt-px",
+    },
+  },
+  defaultVariants: {
+    orientation: "vertical",
+  },
+});
+
+function Field({
+  className,
+  orientation = "vertical",
+  ...props
+}: React.ComponentProps<"div"> & VariantProps<typeof fieldVariants>) {
+  return (
+    <div
+      role="group"
+      data-slot="field"
+      data-orientation={orientation}
+      className={cn(fieldVariants({ orientation }), className)}
+      {...props}
+    />
+  );
+}
+
+function FieldContent({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="field-content"
+      className={cn("group/field-content flex flex-1 flex-col gap-1 leading-snug", className)}
+      {...props}
+    />
+  );
+}
+
+function FieldLabel({ className, ...props }: React.ComponentProps<typeof Label>) {
+  return (
+    <Label
+      data-slot="field-label"
+      className={cn(
+        "group/field-label peer/field-label flex w-fit gap-2 leading-snug group-data-[disabled=true]/field:opacity-50 has-data-checked:border-primary/30 has-data-checked:bg-primary/5 has-[>[data-slot=field]]:rounded-xl has-[>[data-slot=field]]:border *:data-[slot=field]:p-4 dark:has-data-checked:border-primary/20 dark:has-data-checked:bg-primary/10",
+        "has-[>[data-slot=field]]:w-full has-[>[data-slot=field]]:flex-col",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function FieldTitle({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="field-label"
+      className={cn(
+        "flex w-fit items-center gap-2 text-sm font-medium group-data-[disabled=true]/field:opacity-50",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function FieldDescription({ className, ...props }: React.ComponentProps<"p">) {
+  return (
+    <p
+      data-slot="field-description"
+      className={cn(
+        "text-left text-sm leading-normal font-normal text-muted-foreground group-has-data-horizontal/field:text-balance [[data-variant=legend]+&]:-mt-1.5",
+        "last:mt-0 nth-last-2:-mt-1",
+        "[&>a]:underline [&>a]:underline-offset-4 [&>a:hover]:text-primary",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function FieldSeparator({
+  children,
+  className,
+  ...props
+}: React.ComponentProps<"div"> & {
+  children?: React.ReactNode;
+}) {
+  return (
+    <div
+      data-slot="field-separator"
+      data-content={!!children}
+      className={cn(
+        "relative -my-2 h-5 text-sm group-data-[variant=outline]/field-group:-mb-2",
+        className,
+      )}
+      {...props}
+    >
+      <Separator className="absolute inset-0 top-1/2" />
+      {children && (
+        <span
+          className="relative mx-auto block w-fit bg-background px-2 text-muted-foreground"
+          data-slot="field-separator-content"
+        >
+          {children}
+        </span>
+      )}
+    </div>
+  );
+}
+
+function FieldError({
+  className,
+  children,
+  errors,
+  ...props
+}: React.ComponentProps<"div"> & {
+  errors?: Array<{ message?: string } | undefined>;
+}) {
+  const content = useMemo(() => {
+    if (children) {
+      return children;
+    }
+
+    if (!errors?.length) {
+      return null;
+    }
+
+    const uniqueErrors = [...new Map(errors.map((error) => [error?.message, error])).values()];
+
+    if (uniqueErrors?.length === 1) {
+      return uniqueErrors[0]?.message;
+    }
+
+    return (
+      <ul className="ml-4 flex list-disc flex-col gap-1">
+        {uniqueErrors.map((error, index) => error?.message && <li key={index}>{error.message}</li>)}
+      </ul>
+    );
+  }, [children, errors]);
+
+  if (!content) {
+    return null;
+  }
+
+  return (
+    <div
+      role="alert"
+      data-slot="field-error"
+      className={cn("text-sm font-normal text-destructive", className)}
+      {...props}
+    >
+      {content}
+    </div>
+  );
+}
+
+export {
+  Field,
+  FieldContent,
+  FieldDescription,
+  FieldError,
+  FieldGroup,
+  FieldLabel,
+  FieldLegend,
+  FieldSeparator,
+  FieldSet,
+  FieldTitle,
+};
diff --git a/packages/agents/preview-template/src/components/ui/hover-card.tsx b/packages/agents/preview-template/src/components/ui/hover-card.tsx
new file mode 100644
index 00000000..6a4284bf
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/hover-card.tsx
@@ -0,0 +1,38 @@
+"use client";
+
+import { HoverCard as HoverCardPrimitive } from "radix-ui";
+import type * as React from "react";
+
+import { cn } from "@/lib/utils";
+
+function HoverCard({ ...props }: React.ComponentProps<typeof HoverCardPrimitive.Root>) {
+  return <HoverCardPrimitive.Root data-slot="hover-card" {...props} />;
+}
+
+function HoverCardTrigger({ ...props }: React.ComponentProps<typeof HoverCardPrimitive.Trigger>) {
+  return <HoverCardPrimitive.Trigger data-slot="hover-card-trigger" {...props} />;
+}
+
+function HoverCardContent({
+  className,
+  align = "center",
+  sideOffset = 4,
+  ...props
+}: React.ComponentProps<typeof HoverCardPrimitive.Content>) {
+  return (
+    <HoverCardPrimitive.Portal data-slot="hover-card-portal">
+      <HoverCardPrimitive.Content
+        data-slot="hover-card-content"
+        align={align}
+        sideOffset={sideOffset}
+        className={cn(
+          "z-50 w-72 origin-(--radix-hover-card-content-transform-origin) rounded-2xl bg-popover p-4 text-sm text-popover-foreground shadow-2xl ring-1 ring-foreground/5 outline-hidden duration-100 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 data-open:animate-in data-open:fade-in-0 data-open:zoom-in-95 data-closed:animate-out data-closed:fade-out-0 data-closed:zoom-out-95",
+          className,
+        )}
+        {...props}
+      />
+    </HoverCardPrimitive.Portal>
+  );
+}
+
+export { HoverCard, HoverCardContent, HoverCardTrigger };
diff --git a/packages/agents/preview-template/src/components/ui/input-group.tsx b/packages/agents/preview-template/src/components/ui/input-group.tsx
new file mode 100644
index 00000000..cfc749a3
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/input-group.tsx
@@ -0,0 +1,143 @@
+"use client";
+
+import { cva, type VariantProps } from "class-variance-authority";
+import type * as React from "react";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Textarea } from "@/components/ui/textarea";
+import { cn } from "@/lib/utils";
+
+function InputGroup({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="input-group"
+      role="group"
+      className={cn(
+        "group/input-group relative flex h-9 w-full min-w-0 items-center rounded-4xl border border-input bg-input/30 transition-colors outline-none in-data-[slot=combobox-content]:focus-within:border-inherit in-data-[slot=combobox-content]:focus-within:ring-0 has-data-[align=block-end]:rounded-2xl has-data-[align=block-start]:rounded-2xl has-[[data-slot=input-group-control]:focus-visible]:border-ring has-[[data-slot=input-group-control]:focus-visible]:ring-[3px] has-[[data-slot=input-group-control]:focus-visible]:ring-ring/50 has-[[data-slot][aria-invalid=true]]:border-destructive has-[[data-slot][aria-invalid=true]]:ring-[3px] has-[[data-slot][aria-invalid=true]]:ring-destructive/20 has-[textarea]:rounded-xl has-[>[data-align=block-end]]:h-auto has-[>[data-align=block-end]]:flex-col has-[>[data-align=block-start]]:h-auto has-[>[data-align=block-start]]:flex-col has-[>textarea]:h-auto dark:has-[[data-slot][aria-invalid=true]]:ring-destructive/40 has-[>[data-align=block-end]]:[&>input]:pt-3 has-[>[data-align=block-start]]:[&>input]:pb-3 has-[>[data-align=inline-end]]:[&>input]:pr-1.5 has-[>[data-align=inline-start]]:[&>input]:pl-1.5",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+const inputGroupAddonVariants = cva(
+  "flex h-auto cursor-text items-center justify-center gap-2 py-2 text-sm font-medium text-muted-foreground select-none group-data-[disabled=true]/input-group:opacity-50 **:data-[slot=kbd]:rounded-4xl **:data-[slot=kbd]:bg-muted-foreground/10 **:data-[slot=kbd]:px-1.5 [&>svg:not([class*='size-'])]:size-4",
+  {
+    variants: {
+      align: {
+        "inline-start": "order-first pl-3 has-[>button]:-ml-1 has-[>kbd]:ml-[-0.15rem]",
+        "inline-end": "order-last pr-3 has-[>button]:-mr-1 has-[>kbd]:mr-[-0.15rem]",
+        "block-start":
+          "order-first w-full justify-start px-3 pt-3 group-has-[>input]/input-group:pt-3 [.border-b]:pb-3",
+        "block-end":
+          "order-last w-full justify-start px-3 pb-3 group-has-[>input]/input-group:pb-3 [.border-t]:pt-3",
+      },
+    },
+    defaultVariants: {
+      align: "inline-start",
+    },
+  },
+);
+
+function InputGroupAddon({
+  className,
+  align = "inline-start",
+  ...props
+}: React.ComponentProps<"div"> & VariantProps<typeof inputGroupAddonVariants>) {
+  return (
+    <div
+      role="group"
+      data-slot="input-group-addon"
+      data-align={align}
+      className={cn(inputGroupAddonVariants({ align }), className)}
+      onClick={(e) => {
+        if ((e.target as HTMLElement).closest("button")) {
+          return;
+        }
+        e.currentTarget.parentElement?.querySelector("input")?.focus();
+      }}
+      {...props}
+    />
+  );
+}
+
+const inputGroupButtonVariants = cva("flex items-center gap-2 rounded-4xl text-sm shadow-none", {
+  variants: {
+    size: {
+      xs: "h-6 gap-1 px-1.5 [&>svg:not([class*='size-'])]:size-3.5",
+      sm: "",
+      "icon-xs": "size-6 p-0 has-[>svg]:p-0",
+      "icon-sm": "size-8 p-0 has-[>svg]:p-0",
+    },
+  },
+  defaultVariants: {
+    size: "xs",
+  },
+});
+
+function InputGroupButton({
+  className,
+  type = "button",
+  variant = "ghost",
+  size = "xs",
+  ...props
+}: Omit<React.ComponentProps<typeof Button>, "size"> &
+  VariantProps<typeof inputGroupButtonVariants>) {
+  return (
+    <Button
+      type={type}
+      data-size={size}
+      variant={variant}
+      className={cn(inputGroupButtonVariants({ size }), className)}
+      {...props}
+    />
+  );
+}
+
+function InputGroupText({ className, ...props }: React.ComponentProps<"span">) {
+  return (
+    <span
+      className={cn(
+        "flex items-center gap-2 text-sm text-muted-foreground [&_svg]:pointer-events-none [&_svg:not([class*='size-'])]:size-4",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function InputGroupInput({ className, ...props }: React.ComponentProps<"input">) {
+  return (
+    <Input
+      data-slot="input-group-control"
+      className={cn(
+        "flex-1 rounded-none border-0 bg-transparent shadow-none ring-0 focus-visible:ring-0 aria-invalid:ring-0 dark:bg-transparent",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function InputGroupTextarea({ className, ...props }: React.ComponentProps<"textarea">) {
+  return (
+    <Textarea
+      data-slot="input-group-control"
+      className={cn(
+        "flex-1 resize-none rounded-none border-0 bg-transparent py-2 shadow-none ring-0 focus-visible:ring-0 aria-invalid:ring-0 dark:bg-transparent",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+export {
+  InputGroup,
+  InputGroupAddon,
+  InputGroupButton,
+  InputGroupInput,
+  InputGroupText,
+  InputGroupTextarea,
+};
diff --git a/packages/agents/preview-template/src/components/ui/input-otp.tsx b/packages/agents/preview-template/src/components/ui/input-otp.tsx
new file mode 100644
index 00000000..be6e1bf4
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/input-otp.tsx
@@ -0,0 +1,85 @@
+"use client";
+
+import { OTPInput, OTPInputContext } from "input-otp";
+import { MinusIcon } from "lucide-react";
+import * as React from "react";
+import { cn } from "@/lib/utils";
+
+function InputOTP({
+  className,
+  containerClassName,
+  ...props
+}: React.ComponentProps<typeof OTPInput> & {
+  containerClassName?: string;
+}) {
+  return (
+    <OTPInput
+      data-slot="input-otp"
+      containerClassName={cn(
+        "cn-input-otp flex items-center has-disabled:opacity-50",
+        containerClassName,
+      )}
+      spellCheck={false}
+      className={cn("disabled:cursor-not-allowed", className)}
+      {...props}
+    />
+  );
+}
+
+function InputOTPGroup({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="input-otp-group"
+      className={cn(
+        "flex items-center rounded-4xl has-aria-invalid:border-destructive has-aria-invalid:ring-[3px] has-aria-invalid:ring-destructive/20 dark:has-aria-invalid:ring-destructive/40",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function InputOTPSlot({
+  index,
+  className,
+  ...props
+}: React.ComponentProps<"div"> & {
+  index: number;
+}) {
+  const inputOTPContext = React.useContext(OTPInputContext);
+  const { char, hasFakeCaret, isActive } = inputOTPContext?.slots[index] ?? {};
+
+  return (
+    <div
+      data-slot="input-otp-slot"
+      data-active={isActive}
+      className={cn(
+        "relative flex size-9 items-center justify-center border-y border-r border-input bg-input/30 text-sm transition-all outline-none first:rounded-l-4xl first:border-l last:rounded-r-4xl aria-invalid:border-destructive data-[active=true]:z-10 data-[active=true]:border-ring data-[active=true]:ring-[3px] data-[active=true]:ring-ring/50 data-[active=true]:aria-invalid:border-destructive data-[active=true]:aria-invalid:ring-destructive/20 dark:data-[active=true]:aria-invalid:ring-destructive/40",
+        className,
+      )}
+      {...props}
+    >
+      {char}
+      {hasFakeCaret && (
+        <div className="pointer-events-none absolute inset-0 flex items-center justify-center">
+          <div className="h-4 w-px animate-caret-blink bg-foreground duration-1000" />
+        </div>
+      )}
+    </div>
+  );
+}
+
+function InputOTPSeparator({ ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="input-otp-separator"
+      className="flex items-center [&_svg:not([class*='size-'])]:size-4"
+      role="separator"
+      {...props}
+    >
+      <MinusIcon />
+    </div>
+  );
+}
+
+export { InputOTP, InputOTPGroup, InputOTPSeparator, InputOTPSlot };
diff --git a/packages/agents/preview-template/src/components/ui/input.tsx b/packages/agents/preview-template/src/components/ui/input.tsx
new file mode 100644
index 00000000..12335489
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/input.tsx
@@ -0,0 +1,19 @@
+import type * as React from "react";
+
+import { cn } from "@/lib/utils";
+
+function Input({ className, type, ...props }: React.ComponentProps<"input">) {
+  return (
+    <input
+      type={type}
+      data-slot="input"
+      className={cn(
+        "h-9 w-full min-w-0 rounded-4xl border border-input bg-input/30 px-3 py-1 text-base transition-colors outline-none file:inline-flex file:h-7 file:border-0 file:bg-transparent file:text-sm file:font-medium file:text-foreground placeholder:text-muted-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:pointer-events-none disabled:cursor-not-allowed disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-[3px] aria-invalid:ring-destructive/20 md:text-sm dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+export { Input };
diff --git a/packages/agents/preview-template/src/components/ui/item.tsx b/packages/agents/preview-template/src/components/ui/item.tsx
new file mode 100644
index 00000000..e6461686
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/item.tsx
@@ -0,0 +1,181 @@
+import { cva, type VariantProps } from "class-variance-authority";
+import { Slot } from "radix-ui";
+import type * as React from "react";
+import { Separator } from "@/components/ui/separator";
+import { cn } from "@/lib/utils";
+
+function ItemGroup({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      role="list"
+      data-slot="item-group"
+      className={cn(
+        "group/item-group flex w-full flex-col gap-4 has-data-[size=sm]:gap-2.5 has-data-[size=xs]:gap-2",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function ItemSeparator({ className, ...props }: React.ComponentProps<typeof Separator>) {
+  return (
+    <Separator
+      data-slot="item-separator"
+      orientation="horizontal"
+      className={cn("my-2", className)}
+      {...props}
+    />
+  );
+}
+
+const itemVariants = cva(
+  "group/item flex w-full flex-wrap items-center rounded-2xl border text-sm transition-colors duration-100 outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 [a]:transition-colors [a]:hover:bg-muted",
+  {
+    variants: {
+      variant: {
+        default: "border-transparent",
+        outline: "border-border",
+        muted: "border-transparent bg-muted/50",
+      },
+      size: {
+        default: "gap-3.5 px-4 py-3.5",
+        sm: "gap-3.5 px-3.5 py-3",
+        xs: "gap-2.5 px-3 py-2.5 in-data-[slot=dropdown-menu-content]:p-0",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+      size: "default",
+    },
+  },
+);
+
+function Item({
+  className,
+  variant = "default",
+  size = "default",
+  asChild = false,
+  ...props
+}: React.ComponentProps<"div"> & VariantProps<typeof itemVariants> & { asChild?: boolean }) {
+  const Comp = asChild ? Slot.Root : "div";
+  return (
+    <Comp
+      data-slot="item"
+      data-variant={variant}
+      data-size={size}
+      className={cn(itemVariants({ variant, size, className }))}
+      {...props}
+    />
+  );
+}
+
+const itemMediaVariants = cva(
+  "flex shrink-0 items-center justify-center gap-2 group-has-data-[slot=item-description]/item:translate-y-0.5 group-has-data-[slot=item-description]/item:self-start [&_svg]:pointer-events-none",
+  {
+    variants: {
+      variant: {
+        default: "bg-transparent",
+        icon: "[&_svg:not([class*='size-'])]:size-4",
+        image:
+          "size-10 overflow-hidden rounded-lg group-data-[size=sm]/item:size-8 group-data-[size=xs]/item:size-6 group-data-[size=xs]/item:rounded-md [&_img]:size-full [&_img]:object-cover",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+    },
+  },
+);
+
+function ItemMedia({
+  className,
+  variant = "default",
+  ...props
+}: React.ComponentProps<"div"> & VariantProps<typeof itemMediaVariants>) {
+  return (
+    <div
+      data-slot="item-media"
+      data-variant={variant}
+      className={cn(itemMediaVariants({ variant, className }))}
+      {...props}
+    />
+  );
+}
+
+function ItemContent({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="item-content"
+      className={cn(
+        "flex flex-1 flex-col gap-1 group-data-[size=xs]/item:gap-0.5 [&+[data-slot=item-content]]:flex-none",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function ItemTitle({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="item-title"
+      className={cn(
+        "line-clamp-1 flex w-fit items-center gap-2 text-sm leading-snug font-medium underline-offset-4",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function ItemDescription({ className, ...props }: React.ComponentProps<"p">) {
+  return (
+    <p
+      data-slot="item-description"
+      className={cn(
+        "line-clamp-2 text-left text-sm font-normal text-muted-foreground [&>a]:underline [&>a]:underline-offset-4 [&>a:hover]:text-primary",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function ItemActions({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div data-slot="item-actions" className={cn("flex items-center gap-2", className)} {...props} />
+  );
+}
+
+function ItemHeader({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="item-header"
+      className={cn("flex basis-full items-center justify-between gap-2", className)}
+      {...props}
+    />
+  );
+}
+
+function ItemFooter({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="item-footer"
+      className={cn("flex basis-full items-center justify-between gap-2", className)}
+      {...props}
+    />
+  );
+}
+
+export {
+  Item,
+  ItemActions,
+  ItemContent,
+  ItemDescription,
+  ItemFooter,
+  ItemGroup,
+  ItemHeader,
+  ItemMedia,
+  ItemSeparator,
+  ItemTitle,
+};
diff --git a/packages/agents/preview-template/src/components/ui/kbd.tsx b/packages/agents/preview-template/src/components/ui/kbd.tsx
new file mode 100644
index 00000000..44df6539
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/kbd.tsx
@@ -0,0 +1,26 @@
+import { cn } from "@/lib/utils";
+
+function Kbd({ className, ...props }: React.ComponentProps<"kbd">) {
+  return (
+    <kbd
+      data-slot="kbd"
+      className={cn(
+        "pointer-events-none inline-flex h-5 w-fit min-w-5 items-center justify-center gap-1 rounded-sm bg-muted px-1 font-sans text-xs font-medium text-muted-foreground select-none in-data-[slot=tooltip-content]:bg-background/20 in-data-[slot=tooltip-content]:text-background dark:in-data-[slot=tooltip-content]:bg-background/10 [&_svg:not([class*='size-'])]:size-3",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function KbdGroup({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <kbd
+      data-slot="kbd-group"
+      className={cn("inline-flex items-center gap-1", className)}
+      {...props}
+    />
+  );
+}
+
+export { Kbd, KbdGroup };
diff --git a/packages/agents/preview-template/src/components/ui/label.tsx b/packages/agents/preview-template/src/components/ui/label.tsx
new file mode 100644
index 00000000..ce80d7e1
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/label.tsx
@@ -0,0 +1,21 @@
+"use client";
+
+import { Label as LabelPrimitive } from "radix-ui";
+import type * as React from "react";
+
+import { cn } from "@/lib/utils";
+
+function Label({ className, ...props }: React.ComponentProps<typeof LabelPrimitive.Root>) {
+  return (
+    <LabelPrimitive.Root
+      data-slot="label"
+      className={cn(
+        "flex items-center gap-2 text-sm leading-none font-medium select-none group-data-[disabled=true]:pointer-events-none group-data-[disabled=true]:opacity-50 peer-disabled:cursor-not-allowed peer-disabled:opacity-50",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+export { Label };
diff --git a/packages/web/src/components/ui/menubar.tsx b/packages/agents/preview-template/src/components/ui/menubar.tsx
similarity index 100%
rename from packages/web/src/components/ui/menubar.tsx
rename to packages/agents/preview-template/src/components/ui/menubar.tsx
diff --git a/packages/web/src/components/ui/native-select.tsx b/packages/agents/preview-template/src/components/ui/native-select.tsx
similarity index 100%
rename from packages/web/src/components/ui/native-select.tsx
rename to packages/agents/preview-template/src/components/ui/native-select.tsx
diff --git a/packages/agents/preview-template/src/components/ui/navigation-menu.tsx b/packages/agents/preview-template/src/components/ui/navigation-menu.tsx
new file mode 100644
index 00000000..c4ff9e6f
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/navigation-menu.tsx
@@ -0,0 +1,159 @@
+import { cva } from "class-variance-authority";
+import { ChevronDownIcon } from "lucide-react";
+import { NavigationMenu as NavigationMenuPrimitive } from "radix-ui";
+import type * as React from "react";
+import { cn } from "@/lib/utils";
+
+function NavigationMenu({
+  className,
+  children,
+  viewport = true,
+  ...props
+}: React.ComponentProps<typeof NavigationMenuPrimitive.Root> & {
+  viewport?: boolean;
+}) {
+  return (
+    <NavigationMenuPrimitive.Root
+      data-slot="navigation-menu"
+      data-viewport={viewport}
+      className={cn(
+        "group/navigation-menu relative flex max-w-max flex-1 items-center justify-center",
+        className,
+      )}
+      {...props}
+    >
+      {children}
+      {viewport && <NavigationMenuViewport />}
+    </NavigationMenuPrimitive.Root>
+  );
+}
+
+function NavigationMenuList({
+  className,
+  ...props
+}: React.ComponentProps<typeof NavigationMenuPrimitive.List>) {
+  return (
+    <NavigationMenuPrimitive.List
+      data-slot="navigation-menu-list"
+      className={cn("group flex flex-1 list-none items-center justify-center gap-0", className)}
+      {...props}
+    />
+  );
+}
+
+function NavigationMenuItem({
+  className,
+  ...props
+}: React.ComponentProps<typeof NavigationMenuPrimitive.Item>) {
+  return (
+    <NavigationMenuPrimitive.Item
+      data-slot="navigation-menu-item"
+      className={cn("relative", className)}
+      {...props}
+    />
+  );
+}
+
+const navigationMenuTriggerStyle = cva(
+  "group/navigation-menu-trigger inline-flex h-9 w-max items-center justify-center rounded-2xl px-4.5 py-2.5 text-sm font-medium transition-all outline-none hover:bg-muted focus:bg-muted focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-1 disabled:pointer-events-none disabled:opacity-50 data-popup-open:bg-muted/50 data-popup-open:hover:bg-muted data-open:bg-muted/50 data-open:hover:bg-muted data-open:focus:bg-muted",
+);
+
+function NavigationMenuTrigger({
+  className,
+  children,
+  ...props
+}: React.ComponentProps<typeof NavigationMenuPrimitive.Trigger>) {
+  return (
+    <NavigationMenuPrimitive.Trigger
+      data-slot="navigation-menu-trigger"
+      className={cn(navigationMenuTriggerStyle(), "group", className)}
+      {...props}
+    >
+      {children}{" "}
+      <ChevronDownIcon
+        className="relative top-px ml-1 size-3 transition duration-300 group-data-popup-open/navigation-menu-trigger:rotate-180 group-data-open/navigation-menu-trigger:rotate-180"
+        aria-hidden="true"
+      />
+    </NavigationMenuPrimitive.Trigger>
+  );
+}
+
+function NavigationMenuContent({
+  className,
+  ...props
+}: React.ComponentProps<typeof NavigationMenuPrimitive.Content>) {
+  return (
+    <NavigationMenuPrimitive.Content
+      data-slot="navigation-menu-content"
+      className={cn(
+        "top-0 left-0 isolate z-50 w-full p-2.5 pr-3 ease-[cubic-bezier(0.22,1,0.36,1)] group-data-[viewport=false]/navigation-menu:top-full group-data-[viewport=false]/navigation-menu:mt-1.5 group-data-[viewport=false]/navigation-menu:overflow-hidden group-data-[viewport=false]/navigation-menu:rounded-2xl group-data-[viewport=false]/navigation-menu:bg-popover group-data-[viewport=false]/navigation-menu:text-popover-foreground group-data-[viewport=false]/navigation-menu:shadow-2xl group-data-[viewport=false]/navigation-menu:ring-1 group-data-[viewport=false]/navigation-menu:ring-foreground/5 group-data-[viewport=false]/navigation-menu:duration-300 data-[motion=from-end]:slide-in-from-right-52 data-[motion=from-start]:slide-in-from-left-52 data-[motion=to-end]:slide-out-to-right-52 data-[motion=to-start]:slide-out-to-left-52 data-[motion^=from-]:animate-in data-[motion^=from-]:fade-in data-[motion^=to-]:animate-out data-[motion^=to-]:fade-out **:data-[slot=navigation-menu-link]:focus:ring-0 **:data-[slot=navigation-menu-link]:focus:outline-none md:absolute md:w-auto group-data-[viewport=false]/navigation-menu:data-open:animate-in group-data-[viewport=false]/navigation-menu:data-open:fade-in-0 group-data-[viewport=false]/navigation-menu:data-open:zoom-in-95 group-data-[viewport=false]/navigation-menu:data-closed:animate-out group-data-[viewport=false]/navigation-menu:data-closed:fade-out-0 group-data-[viewport=false]/navigation-menu:data-closed:zoom-out-95",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function NavigationMenuViewport({
+  className,
+  ...props
+}: React.ComponentProps<typeof NavigationMenuPrimitive.Viewport>) {
+  return (
+    <div className={cn("absolute top-full left-0 isolate z-50 flex justify-center")}>
+      <NavigationMenuPrimitive.Viewport
+        data-slot="navigation-menu-viewport"
+        className={cn(
+          "origin-top-center relative mt-1.5 h-(--radix-navigation-menu-viewport-height) w-full overflow-hidden rounded-2xl bg-popover text-popover-foreground shadow-2xl ring-1 ring-foreground/5 duration-100 md:w-(--radix-navigation-menu-viewport-width) data-open:animate-in data-open:zoom-in-90 data-closed:animate-out data-closed:zoom-out-90",
+          className,
+        )}
+        {...props}
+      />
+    </div>
+  );
+}
+
+function NavigationMenuLink({
+  className,
+  ...props
+}: React.ComponentProps<typeof NavigationMenuPrimitive.Link>) {
+  return (
+    <NavigationMenuPrimitive.Link
+      data-slot="navigation-menu-link"
+      className={cn(
+        "flex items-center gap-1.5 rounded-2xl p-3 text-sm transition-all outline-none hover:bg-muted focus:bg-muted focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-1 in-data-[slot=navigation-menu-content]:rounded-xl data-[active=true]:bg-muted/50 data-[active=true]:hover:bg-muted data-[active=true]:focus:bg-muted [&_svg:not([class*='size-'])]:size-4",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function NavigationMenuIndicator({
+  className,
+  ...props
+}: React.ComponentProps<typeof NavigationMenuPrimitive.Indicator>) {
+  return (
+    <NavigationMenuPrimitive.Indicator
+      data-slot="navigation-menu-indicator"
+      className={cn(
+        "top-full z-1 flex h-1.5 items-end justify-center overflow-hidden data-[state=hidden]:animate-out data-[state=hidden]:fade-out data-[state=visible]:animate-in data-[state=visible]:fade-in",
+        className,
+      )}
+      {...props}
+    >
+      <div className="relative top-[60%] h-2 w-2 rotate-45 rounded-tl-sm bg-border shadow-md" />
+    </NavigationMenuPrimitive.Indicator>
+  );
+}
+
+export {
+  NavigationMenu,
+  NavigationMenuContent,
+  NavigationMenuIndicator,
+  NavigationMenuItem,
+  NavigationMenuLink,
+  NavigationMenuList,
+  NavigationMenuTrigger,
+  NavigationMenuViewport,
+  navigationMenuTriggerStyle,
+};
diff --git a/packages/agents/preview-template/src/components/ui/pagination.tsx b/packages/agents/preview-template/src/components/ui/pagination.tsx
new file mode 100644
index 00000000..b50e2b22
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/pagination.tsx
@@ -0,0 +1,110 @@
+import { ChevronLeftIcon, ChevronRightIcon, MoreHorizontalIcon } from "lucide-react";
+import type * as React from "react";
+import { Button } from "@/components/ui/button";
+import { cn } from "@/lib/utils";
+
+function Pagination({ className, ...props }: React.ComponentProps<"nav">) {
+  return (
+    <nav
+      aria-label="pagination"
+      data-slot="pagination"
+      className={cn("mx-auto flex w-full justify-center", className)}
+      {...props}
+    />
+  );
+}
+
+function PaginationContent({ className, ...props }: React.ComponentProps<"ul">) {
+  return (
+    <ul
+      data-slot="pagination-content"
+      className={cn("flex items-center gap-1", className)}
+      {...props}
+    />
+  );
+}
+
+function PaginationItem({ ...props }: React.ComponentProps<"li">) {
+  return <li data-slot="pagination-item" {...props} />;
+}
+
+type PaginationLinkProps = {
+  isActive?: boolean;
+} & Pick<React.ComponentProps<typeof Button>, "size"> &
+  React.ComponentProps<"a">;
+
+function PaginationLink({ className, isActive, size = "icon", ...props }: PaginationLinkProps) {
+  return (
+    <Button asChild variant={isActive ? "outline" : "ghost"} size={size} className={cn(className)}>
+      <a
+        aria-current={isActive ? "page" : undefined}
+        data-slot="pagination-link"
+        data-active={isActive}
+        {...props}
+      />
+    </Button>
+  );
+}
+
+function PaginationPrevious({
+  className,
+  text = "Previous",
+  ...props
+}: React.ComponentProps<typeof PaginationLink> & { text?: string }) {
+  return (
+    <PaginationLink
+      aria-label="Go to previous page"
+      size="default"
+      className={cn("pl-2!", className)}
+      {...props}
+    >
+      <ChevronLeftIcon data-icon="inline-start" />
+      <span className="hidden sm:block">{text}</span>
+    </PaginationLink>
+  );
+}
+
+function PaginationNext({
+  className,
+  text = "Next",
+  ...props
+}: React.ComponentProps<typeof PaginationLink> & { text?: string }) {
+  return (
+    <PaginationLink
+      aria-label="Go to next page"
+      size="default"
+      className={cn("pr-2!", className)}
+      {...props}
+    >
+      <span className="hidden sm:block">{text}</span>
+      <ChevronRightIcon data-icon="inline-end" />
+    </PaginationLink>
+  );
+}
+
+function PaginationEllipsis({ className, ...props }: React.ComponentProps<"span">) {
+  return (
+    <span
+      aria-hidden
+      data-slot="pagination-ellipsis"
+      className={cn(
+        "flex size-9 items-center justify-center [&_svg:not([class*='size-'])]:size-4",
+        className,
+      )}
+      {...props}
+    >
+      <MoreHorizontalIcon />
+      <span className="sr-only">More pages</span>
+    </span>
+  );
+}
+
+export {
+  Pagination,
+  PaginationContent,
+  PaginationEllipsis,
+  PaginationItem,
+  PaginationLink,
+  PaginationNext,
+  PaginationPrevious,
+};
diff --git a/packages/agents/preview-template/src/components/ui/popover.tsx b/packages/agents/preview-template/src/components/ui/popover.tsx
new file mode 100644
index 00000000..f8ce00d4
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/popover.tsx
@@ -0,0 +1,76 @@
+"use client";
+
+import { Popover as PopoverPrimitive } from "radix-ui";
+import type * as React from "react";
+
+import { cn } from "@/lib/utils";
+
+function Popover({ ...props }: React.ComponentProps<typeof PopoverPrimitive.Root>) {
+  return <PopoverPrimitive.Root data-slot="popover" {...props} />;
+}
+
+function PopoverTrigger({ ...props }: React.ComponentProps<typeof PopoverPrimitive.Trigger>) {
+  return <PopoverPrimitive.Trigger data-slot="popover-trigger" {...props} />;
+}
+
+function PopoverContent({
+  className,
+  align = "center",
+  sideOffset = 4,
+  ...props
+}: React.ComponentProps<typeof PopoverPrimitive.Content>) {
+  return (
+    <PopoverPrimitive.Portal>
+      <PopoverPrimitive.Content
+        data-slot="popover-content"
+        align={align}
+        sideOffset={sideOffset}
+        className={cn(
+          "z-50 flex w-72 origin-(--radix-popover-content-transform-origin) flex-col gap-4 rounded-2xl bg-popover p-4 text-sm text-popover-foreground shadow-2xl ring-1 ring-foreground/5 outline-hidden duration-100 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 data-open:animate-in data-open:fade-in-0 data-open:zoom-in-95 data-closed:animate-out data-closed:fade-out-0 data-closed:zoom-out-95",
+          className,
+        )}
+        {...props}
+      />
+    </PopoverPrimitive.Portal>
+  );
+}
+
+function PopoverAnchor({ ...props }: React.ComponentProps<typeof PopoverPrimitive.Anchor>) {
+  return <PopoverPrimitive.Anchor data-slot="popover-anchor" {...props} />;
+}
+
+function PopoverHeader({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="popover-header"
+      className={cn("flex flex-col gap-1 text-sm", className)}
+      {...props}
+    />
+  );
+}
+
+function PopoverTitle({ className, ...props }: React.ComponentProps<"h2">) {
+  return (
+    <div data-slot="popover-title" className={cn("text-base font-medium", className)} {...props} />
+  );
+}
+
+function PopoverDescription({ className, ...props }: React.ComponentProps<"p">) {
+  return (
+    <p
+      data-slot="popover-description"
+      className={cn("text-muted-foreground", className)}
+      {...props}
+    />
+  );
+}
+
+export {
+  Popover,
+  PopoverAnchor,
+  PopoverContent,
+  PopoverDescription,
+  PopoverHeader,
+  PopoverTitle,
+  PopoverTrigger,
+};
diff --git a/packages/agents/preview-template/src/components/ui/progress.tsx b/packages/agents/preview-template/src/components/ui/progress.tsx
new file mode 100644
index 00000000..af496e91
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/progress.tsx
@@ -0,0 +1,31 @@
+"use client";
+
+import { Progress as ProgressPrimitive } from "radix-ui";
+import type * as React from "react";
+
+import { cn } from "@/lib/utils";
+
+function Progress({
+  className,
+  value,
+  ...props
+}: React.ComponentProps<typeof ProgressPrimitive.Root>) {
+  return (
+    <ProgressPrimitive.Root
+      data-slot="progress"
+      className={cn(
+        "relative flex h-3 w-full items-center overflow-x-hidden rounded-4xl bg-muted",
+        className,
+      )}
+      {...props}
+    >
+      <ProgressPrimitive.Indicator
+        data-slot="progress-indicator"
+        className="size-full flex-1 bg-primary transition-all"
+        style={{ transform: `translateX(-${100 - (value || 0)}%)` }}
+      />
+    </ProgressPrimitive.Root>
+  );
+}
+
+export { Progress };
diff --git a/packages/agents/preview-template/src/components/ui/radio-group.tsx b/packages/agents/preview-template/src/components/ui/radio-group.tsx
new file mode 100644
index 00000000..e6a4b7cc
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/radio-group.tsx
@@ -0,0 +1,44 @@
+"use client";
+
+import { RadioGroup as RadioGroupPrimitive } from "radix-ui";
+import type * as React from "react";
+
+import { cn } from "@/lib/utils";
+
+function RadioGroup({
+  className,
+  ...props
+}: React.ComponentProps<typeof RadioGroupPrimitive.Root>) {
+  return (
+    <RadioGroupPrimitive.Root
+      data-slot="radio-group"
+      className={cn("grid w-full gap-3", className)}
+      {...props}
+    />
+  );
+}
+
+function RadioGroupItem({
+  className,
+  ...props
+}: React.ComponentProps<typeof RadioGroupPrimitive.Item>) {
+  return (
+    <RadioGroupPrimitive.Item
+      data-slot="radio-group-item"
+      className={cn(
+        "group/radio-group-item peer relative flex aspect-square size-4 shrink-0 rounded-full border border-input outline-none after:absolute after:-inset-x-3 after:-inset-y-2 focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 aria-invalid:aria-checked:border-primary dark:bg-input/30 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40 data-checked:border-primary data-checked:bg-primary data-checked:text-primary-foreground dark:data-checked:bg-primary",
+        className,
+      )}
+      {...props}
+    >
+      <RadioGroupPrimitive.Indicator
+        data-slot="radio-group-indicator"
+        className="flex size-4 items-center justify-center"
+      >
+        <span className="absolute top-1/2 left-1/2 size-2 -translate-x-1/2 -translate-y-1/2 rounded-full bg-primary-foreground" />
+      </RadioGroupPrimitive.Indicator>
+    </RadioGroupPrimitive.Item>
+  );
+}
+
+export { RadioGroup, RadioGroupItem };
diff --git a/packages/agents/preview-template/src/components/ui/resizable.tsx b/packages/agents/preview-template/src/components/ui/resizable.tsx
new file mode 100644
index 00000000..add9c005
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/resizable.tsx
@@ -0,0 +1,42 @@
+"use client";
+
+import * as ResizablePrimitive from "react-resizable-panels";
+
+import { cn } from "@/lib/utils";
+
+function ResizablePanelGroup({ className, ...props }: ResizablePrimitive.GroupProps) {
+  return (
+    <ResizablePrimitive.Group
+      data-slot="resizable-panel-group"
+      className={cn("flex h-full w-full aria-[orientation=vertical]:flex-col", className)}
+      {...props}
+    />
+  );
+}
+
+function ResizablePanel({ ...props }: ResizablePrimitive.PanelProps) {
+  return <ResizablePrimitive.Panel data-slot="resizable-panel" {...props} />;
+}
+
+function ResizableHandle({
+  withHandle,
+  className,
+  ...props
+}: ResizablePrimitive.SeparatorProps & {
+  withHandle?: boolean;
+}) {
+  return (
+    <ResizablePrimitive.Separator
+      data-slot="resizable-handle"
+      className={cn(
+        "relative flex w-px items-center justify-center bg-border ring-offset-background after:absolute after:inset-y-0 after:left-1/2 after:w-1 after:-translate-x-1/2 focus-visible:ring-1 focus-visible:ring-ring focus-visible:outline-hidden aria-[orientation=horizontal]:h-px aria-[orientation=horizontal]:w-full aria-[orientation=horizontal]:after:left-0 aria-[orientation=horizontal]:after:h-1 aria-[orientation=horizontal]:after:w-full aria-[orientation=horizontal]:after:translate-x-0 aria-[orientation=horizontal]:after:-translate-y-1/2 [&[aria-orientation=horizontal]>div]:rotate-90",
+        className,
+      )}
+      {...props}
+    >
+      {withHandle && <div className="z-10 flex h-6 w-1 shrink-0 rounded-lg bg-border" />}
+    </ResizablePrimitive.Separator>
+  );
+}
+
+export { ResizableHandle, ResizablePanel, ResizablePanelGroup };
diff --git a/packages/agents/preview-template/src/components/ui/scroll-area.tsx b/packages/agents/preview-template/src/components/ui/scroll-area.tsx
new file mode 100644
index 00000000..2395b115
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/scroll-area.tsx
@@ -0,0 +1,55 @@
+"use client";
+
+import { ScrollArea as ScrollAreaPrimitive } from "radix-ui";
+import type * as React from "react";
+
+import { cn } from "@/lib/utils";
+
+function ScrollArea({
+  className,
+  children,
+  ...props
+}: React.ComponentProps<typeof ScrollAreaPrimitive.Root>) {
+  return (
+    <ScrollAreaPrimitive.Root
+      data-slot="scroll-area"
+      className={cn("relative", className)}
+      {...props}
+    >
+      <ScrollAreaPrimitive.Viewport
+        data-slot="scroll-area-viewport"
+        className="size-full rounded-[inherit] transition-[color,box-shadow] outline-none focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-1"
+      >
+        {children}
+      </ScrollAreaPrimitive.Viewport>
+      <ScrollBar />
+      <ScrollAreaPrimitive.Corner />
+    </ScrollAreaPrimitive.Root>
+  );
+}
+
+function ScrollBar({
+  className,
+  orientation = "vertical",
+  ...props
+}: React.ComponentProps<typeof ScrollAreaPrimitive.ScrollAreaScrollbar>) {
+  return (
+    <ScrollAreaPrimitive.ScrollAreaScrollbar
+      data-slot="scroll-area-scrollbar"
+      data-orientation={orientation}
+      orientation={orientation}
+      className={cn(
+        "flex touch-none p-px transition-colors select-none data-horizontal:h-2.5 data-horizontal:flex-col data-horizontal:border-t data-horizontal:border-t-transparent data-vertical:h-full data-vertical:w-2.5 data-vertical:border-l data-vertical:border-l-transparent",
+        className,
+      )}
+      {...props}
+    >
+      <ScrollAreaPrimitive.ScrollAreaThumb
+        data-slot="scroll-area-thumb"
+        className="relative flex-1 rounded-full bg-border"
+      />
+    </ScrollAreaPrimitive.ScrollAreaScrollbar>
+  );
+}
+
+export { ScrollArea, ScrollBar };
diff --git a/packages/agents/preview-template/src/components/ui/select.tsx b/packages/agents/preview-template/src/components/ui/select.tsx
new file mode 100644
index 00000000..e824e530
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/select.tsx
@@ -0,0 +1,184 @@
+"use client";
+
+import { CheckIcon, ChevronDownIcon, ChevronUpIcon } from "lucide-react";
+import { Select as SelectPrimitive } from "radix-ui";
+import type * as React from "react";
+import { cn } from "@/lib/utils";
+
+function Select({ ...props }: React.ComponentProps<typeof SelectPrimitive.Root>) {
+  return <SelectPrimitive.Root data-slot="select" {...props} />;
+}
+
+function SelectGroup({ className, ...props }: React.ComponentProps<typeof SelectPrimitive.Group>) {
+  return (
+    <SelectPrimitive.Group
+      data-slot="select-group"
+      className={cn("scroll-my-1 p-1", className)}
+      {...props}
+    />
+  );
+}
+
+function SelectValue({ ...props }: React.ComponentProps<typeof SelectPrimitive.Value>) {
+  return <SelectPrimitive.Value data-slot="select-value" {...props} />;
+}
+
+function SelectTrigger({
+  className,
+  size = "default",
+  children,
+  ...props
+}: React.ComponentProps<typeof SelectPrimitive.Trigger> & {
+  size?: "sm" | "default";
+}) {
+  return (
+    <SelectPrimitive.Trigger
+      data-slot="select-trigger"
+      data-size={size}
+      className={cn(
+        "flex w-fit items-center justify-between gap-1.5 rounded-4xl border border-input bg-input/30 px-3 py-2 text-sm whitespace-nowrap transition-colors outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-[3px] aria-invalid:ring-destructive/20 data-placeholder:text-muted-foreground data-[size=default]:h-9 data-[size=sm]:h-8 *:data-[slot=select-value]:line-clamp-1 *:data-[slot=select-value]:flex *:data-[slot=select-value]:items-center *:data-[slot=select-value]:gap-1.5 dark:hover:bg-input/50 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+        className,
+      )}
+      {...props}
+    >
+      {children}
+      <SelectPrimitive.Icon asChild>
+        <ChevronDownIcon className="pointer-events-none size-4 text-muted-foreground" />
+      </SelectPrimitive.Icon>
+    </SelectPrimitive.Trigger>
+  );
+}
+
+function SelectContent({
+  className,
+  children,
+  position = "item-aligned",
+  align = "center",
+  ...props
+}: React.ComponentProps<typeof SelectPrimitive.Content>) {
+  return (
+    <SelectPrimitive.Portal>
+      <SelectPrimitive.Content
+        data-slot="select-content"
+        data-align-trigger={position === "item-aligned"}
+        className={cn(
+          "relative z-50 max-h-(--radix-select-content-available-height) min-w-36 origin-(--radix-select-content-transform-origin) overflow-x-hidden overflow-y-auto rounded-2xl bg-popover text-popover-foreground shadow-2xl ring-1 ring-foreground/5 duration-100 data-[align-trigger=true]:animate-none data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 data-open:animate-in data-open:fade-in-0 data-open:zoom-in-95 data-closed:animate-out data-closed:fade-out-0 data-closed:zoom-out-95",
+          position === "popper" &&
+            "data-[side=bottom]:translate-y-1 data-[side=left]:-translate-x-1 data-[side=right]:translate-x-1 data-[side=top]:-translate-y-1",
+          className,
+        )}
+        position={position}
+        align={align}
+        {...props}
+      >
+        <SelectScrollUpButton />
+        <SelectPrimitive.Viewport
+          data-position={position}
+          className={cn(
+            "data-[position=popper]:h-(--radix-select-trigger-height) data-[position=popper]:w-full data-[position=popper]:min-w-(--radix-select-trigger-width)",
+            position === "popper" && "",
+          )}
+        >
+          {children}
+        </SelectPrimitive.Viewport>
+        <SelectScrollDownButton />
+      </SelectPrimitive.Content>
+    </SelectPrimitive.Portal>
+  );
+}
+
+function SelectLabel({ className, ...props }: React.ComponentProps<typeof SelectPrimitive.Label>) {
+  return (
+    <SelectPrimitive.Label
+      data-slot="select-label"
+      className={cn("px-3 py-2.5 text-xs text-muted-foreground", className)}
+      {...props}
+    />
+  );
+}
+
+function SelectItem({
+  className,
+  children,
+  ...props
+}: React.ComponentProps<typeof SelectPrimitive.Item>) {
+  return (
+    <SelectPrimitive.Item
+      data-slot="select-item"
+      className={cn(
+        "relative flex w-full cursor-default items-center gap-2.5 rounded-xl py-2 pr-8 pl-3 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground not-data-[variant=destructive]:focus:**:text-accent-foreground data-disabled:pointer-events-none data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 *:[span]:last:flex *:[span]:last:items-center *:[span]:last:gap-2",
+        className,
+      )}
+      {...props}
+    >
+      <span className="pointer-events-none absolute right-2 flex size-4 items-center justify-center">
+        <SelectPrimitive.ItemIndicator>
+          <CheckIcon className="pointer-events-none" />
+        </SelectPrimitive.ItemIndicator>
+      </span>
+      <SelectPrimitive.ItemText>{children}</SelectPrimitive.ItemText>
+    </SelectPrimitive.Item>
+  );
+}
+
+function SelectSeparator({
+  className,
+  ...props
+}: React.ComponentProps<typeof SelectPrimitive.Separator>) {
+  return (
+    <SelectPrimitive.Separator
+      data-slot="select-separator"
+      className={cn("pointer-events-none -mx-1 my-1 h-px bg-border/50", className)}
+      {...props}
+    />
+  );
+}
+
+function SelectScrollUpButton({
+  className,
+  ...props
+}: React.ComponentProps<typeof SelectPrimitive.ScrollUpButton>) {
+  return (
+    <SelectPrimitive.ScrollUpButton
+      data-slot="select-scroll-up-button"
+      className={cn(
+        "z-10 flex cursor-default items-center justify-center bg-popover py-1 [&_svg:not([class*='size-'])]:size-4",
+        className,
+      )}
+      {...props}
+    >
+      <ChevronUpIcon />
+    </SelectPrimitive.ScrollUpButton>
+  );
+}
+
+function SelectScrollDownButton({
+  className,
+  ...props
+}: React.ComponentProps<typeof SelectPrimitive.ScrollDownButton>) {
+  return (
+    <SelectPrimitive.ScrollDownButton
+      data-slot="select-scroll-down-button"
+      className={cn(
+        "z-10 flex cursor-default items-center justify-center bg-popover py-1 [&_svg:not([class*='size-'])]:size-4",
+        className,
+      )}
+      {...props}
+    >
+      <ChevronDownIcon />
+    </SelectPrimitive.ScrollDownButton>
+  );
+}
+
+export {
+  Select,
+  SelectContent,
+  SelectGroup,
+  SelectItem,
+  SelectLabel,
+  SelectScrollDownButton,
+  SelectScrollUpButton,
+  SelectSeparator,
+  SelectTrigger,
+  SelectValue,
+};
diff --git a/packages/agents/preview-template/src/components/ui/separator.tsx b/packages/agents/preview-template/src/components/ui/separator.tsx
new file mode 100644
index 00000000..786d2e05
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/separator.tsx
@@ -0,0 +1,28 @@
+"use client";
+
+import { Separator as SeparatorPrimitive } from "radix-ui";
+import type * as React from "react";
+
+import { cn } from "@/lib/utils";
+
+function Separator({
+  className,
+  orientation = "horizontal",
+  decorative = true,
+  ...props
+}: React.ComponentProps<typeof SeparatorPrimitive.Root>) {
+  return (
+    <SeparatorPrimitive.Root
+      data-slot="separator"
+      decorative={decorative}
+      orientation={orientation}
+      className={cn(
+        "shrink-0 bg-border data-horizontal:h-px data-horizontal:w-full data-vertical:w-px data-vertical:self-stretch",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+export { Separator };
diff --git a/packages/agents/preview-template/src/components/ui/sheet.tsx b/packages/agents/preview-template/src/components/ui/sheet.tsx
new file mode 100644
index 00000000..0367f89d
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/sheet.tsx
@@ -0,0 +1,129 @@
+"use client";
+
+import { XIcon } from "lucide-react";
+import { Dialog as SheetPrimitive } from "radix-ui";
+import type * as React from "react";
+import { Button } from "@/components/ui/button";
+import { cn } from "@/lib/utils";
+
+function Sheet({ ...props }: React.ComponentProps<typeof SheetPrimitive.Root>) {
+  return <SheetPrimitive.Root data-slot="sheet" {...props} />;
+}
+
+function SheetTrigger({ ...props }: React.ComponentProps<typeof SheetPrimitive.Trigger>) {
+  return <SheetPrimitive.Trigger data-slot="sheet-trigger" {...props} />;
+}
+
+function SheetClose({ ...props }: React.ComponentProps<typeof SheetPrimitive.Close>) {
+  return <SheetPrimitive.Close data-slot="sheet-close" {...props} />;
+}
+
+function SheetPortal({ ...props }: React.ComponentProps<typeof SheetPrimitive.Portal>) {
+  return <SheetPrimitive.Portal data-slot="sheet-portal" {...props} />;
+}
+
+function SheetOverlay({
+  className,
+  ...props
+}: React.ComponentProps<typeof SheetPrimitive.Overlay>) {
+  return (
+    <SheetPrimitive.Overlay
+      data-slot="sheet-overlay"
+      className={cn(
+        "fixed inset-0 z-50 bg-black/80 duration-100 supports-backdrop-filter:backdrop-blur-xs data-open:animate-in data-open:fade-in-0 data-closed:animate-out data-closed:fade-out-0",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function SheetContent({
+  className,
+  children,
+  side = "right",
+  showCloseButton = true,
+  ...props
+}: React.ComponentProps<typeof SheetPrimitive.Content> & {
+  side?: "top" | "right" | "bottom" | "left";
+  showCloseButton?: boolean;
+}) {
+  return (
+    <SheetPortal>
+      <SheetOverlay />
+      <SheetPrimitive.Content
+        data-slot="sheet-content"
+        data-side={side}
+        className={cn(
+          "fixed z-50 flex flex-col bg-popover bg-clip-padding text-sm text-popover-foreground shadow-lg transition duration-200 ease-in-out data-[side=bottom]:inset-x-0 data-[side=bottom]:bottom-0 data-[side=bottom]:h-auto data-[side=bottom]:border-t data-[side=left]:inset-y-0 data-[side=left]:left-0 data-[side=left]:h-full data-[side=left]:w-3/4 data-[side=left]:border-r data-[side=right]:inset-y-0 data-[side=right]:right-0 data-[side=right]:h-full data-[side=right]:w-3/4 data-[side=right]:border-l data-[side=top]:inset-x-0 data-[side=top]:top-0 data-[side=top]:h-auto data-[side=top]:border-b data-[side=left]:sm:max-w-sm data-[side=right]:sm:max-w-sm data-open:animate-in data-open:fade-in-0 data-[side=bottom]:data-open:slide-in-from-bottom-10 data-[side=left]:data-open:slide-in-from-left-10 data-[side=right]:data-open:slide-in-from-right-10 data-[side=top]:data-open:slide-in-from-top-10 data-closed:animate-out data-closed:fade-out-0 data-[side=bottom]:data-closed:slide-out-to-bottom-10 data-[side=left]:data-closed:slide-out-to-left-10 data-[side=right]:data-closed:slide-out-to-right-10 data-[side=top]:data-closed:slide-out-to-top-10",
+          className,
+        )}
+        {...props}
+      >
+        {children}
+        {showCloseButton && (
+          <SheetPrimitive.Close data-slot="sheet-close" asChild>
+            <Button variant="ghost" className="absolute top-4 right-4" size="icon-sm">
+              <XIcon />
+              <span className="sr-only">Close</span>
+            </Button>
+          </SheetPrimitive.Close>
+        )}
+      </SheetPrimitive.Content>
+    </SheetPortal>
+  );
+}
+
+function SheetHeader({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="sheet-header"
+      className={cn("flex flex-col gap-1.5 p-6", className)}
+      {...props}
+    />
+  );
+}
+
+function SheetFooter({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="sheet-footer"
+      className={cn("mt-auto flex flex-col gap-2 p-6", className)}
+      {...props}
+    />
+  );
+}
+
+function SheetTitle({ className, ...props }: React.ComponentProps<typeof SheetPrimitive.Title>) {
+  return (
+    <SheetPrimitive.Title
+      data-slot="sheet-title"
+      className={cn("text-base font-medium text-foreground", className)}
+      {...props}
+    />
+  );
+}
+
+function SheetDescription({
+  className,
+  ...props
+}: React.ComponentProps<typeof SheetPrimitive.Description>) {
+  return (
+    <SheetPrimitive.Description
+      data-slot="sheet-description"
+      className={cn("text-sm text-muted-foreground", className)}
+      {...props}
+    />
+  );
+}
+
+export {
+  Sheet,
+  SheetClose,
+  SheetContent,
+  SheetDescription,
+  SheetFooter,
+  SheetHeader,
+  SheetTitle,
+  SheetTrigger,
+};
diff --git a/packages/agents/preview-template/src/components/ui/sidebar.tsx b/packages/agents/preview-template/src/components/ui/sidebar.tsx
new file mode 100644
index 00000000..1beb7859
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/sidebar.tsx
@@ -0,0 +1,670 @@
+"use client";
+
+import { cva, type VariantProps } from "class-variance-authority";
+import { PanelLeftIcon } from "lucide-react";
+import { Slot } from "radix-ui";
+import * as React from "react";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Separator } from "@/components/ui/separator";
+import {
+  Sheet,
+  SheetContent,
+  SheetDescription,
+  SheetHeader,
+  SheetTitle,
+} from "@/components/ui/sheet";
+import { Skeleton } from "@/components/ui/skeleton";
+import { Tooltip, TooltipContent, TooltipTrigger } from "@/components/ui/tooltip";
+import { useIsMobile } from "@/hooks/use-mobile";
+import { cn } from "@/lib/utils";
+
+const SIDEBAR_COOKIE_NAME = "sidebar_state";
+const SIDEBAR_COOKIE_MAX_AGE = 60 * 60 * 24 * 7;
+const SIDEBAR_WIDTH = "16rem";
+const SIDEBAR_WIDTH_MOBILE = "18rem";
+const SIDEBAR_WIDTH_ICON = "3rem";
+const SIDEBAR_KEYBOARD_SHORTCUT = "b";
+
+type SidebarContextProps = {
+  state: "expanded" | "collapsed";
+  open: boolean;
+  setOpen: (open: boolean) => void;
+  openMobile: boolean;
+  setOpenMobile: (open: boolean) => void;
+  isMobile: boolean;
+  toggleSidebar: () => void;
+};
+
+const SidebarContext = React.createContext<SidebarContextProps | null>(null);
+
+function useSidebar() {
+  const context = React.useContext(SidebarContext);
+  if (!context) {
+    throw new Error("useSidebar must be used within a SidebarProvider.");
+  }
+
+  return context;
+}
+
+function SidebarProvider({
+  defaultOpen = true,
+  open: openProp,
+  onOpenChange: setOpenProp,
+  className,
+  style,
+  children,
+  ...props
+}: React.ComponentProps<"div"> & {
+  defaultOpen?: boolean;
+  open?: boolean;
+  onOpenChange?: (open: boolean) => void;
+}) {
+  const isMobile = useIsMobile();
+  const [openMobile, setOpenMobile] = React.useState(false);
+
+  // This is the internal state of the sidebar.
+  // We use openProp and setOpenProp for control from outside the component.
+  const [_open, _setOpen] = React.useState(defaultOpen);
+  const open = openProp ?? _open;
+  const setOpen = React.useCallback(
+    (value: boolean | ((value: boolean) => boolean)) => {
+      const openState = typeof value === "function" ? value(open) : value;
+      if (setOpenProp) {
+        setOpenProp(openState);
+      } else {
+        _setOpen(openState);
+      }
+
+      // This sets the cookie to keep the sidebar state.
+      document.cookie = `${SIDEBAR_COOKIE_NAME}=${openState}; path=/; max-age=${SIDEBAR_COOKIE_MAX_AGE}`;
+    },
+    [setOpenProp, open],
+  );
+
+  // Helper to toggle the sidebar.
+  const toggleSidebar = React.useCallback(() => {
+    return isMobile ? setOpenMobile((open) => !open) : setOpen((open) => !open);
+  }, [isMobile, setOpen, setOpenMobile]);
+
+  // Adds a keyboard shortcut to toggle the sidebar.
+  React.useEffect(() => {
+    const handleKeyDown = (event: KeyboardEvent) => {
+      if (event.key === SIDEBAR_KEYBOARD_SHORTCUT && (event.metaKey || event.ctrlKey)) {
+        event.preventDefault();
+        toggleSidebar();
+      }
+    };
+
+    window.addEventListener("keydown", handleKeyDown);
+    return () => window.removeEventListener("keydown", handleKeyDown);
+  }, [toggleSidebar]);
+
+  // We add a state so that we can do data-state="expanded" or "collapsed".
+  // This makes it easier to style the sidebar with Tailwind classes.
+  const state = open ? "expanded" : "collapsed";
+
+  const contextValue = React.useMemo<SidebarContextProps>(
+    () => ({
+      state,
+      open,
+      setOpen,
+      isMobile,
+      openMobile,
+      setOpenMobile,
+      toggleSidebar,
+    }),
+    [state, open, setOpen, isMobile, openMobile, setOpenMobile, toggleSidebar],
+  );
+
+  return (
+    <SidebarContext.Provider value={contextValue}>
+      <div
+        data-slot="sidebar-wrapper"
+        style={
+          {
+            "--sidebar-width": SIDEBAR_WIDTH,
+            "--sidebar-width-icon": SIDEBAR_WIDTH_ICON,
+            ...style,
+          } as React.CSSProperties
+        }
+        className={cn(
+          "group/sidebar-wrapper flex min-h-svh w-full has-data-[variant=inset]:bg-sidebar",
+          className,
+        )}
+        {...props}
+      >
+        {children}
+      </div>
+    </SidebarContext.Provider>
+  );
+}
+
+function Sidebar({
+  side = "left",
+  variant = "sidebar",
+  collapsible = "offcanvas",
+  className,
+  children,
+  dir,
+  ...props
+}: React.ComponentProps<"div"> & {
+  side?: "left" | "right";
+  variant?: "sidebar" | "floating" | "inset";
+  collapsible?: "offcanvas" | "icon" | "none";
+}) {
+  const { isMobile, state, openMobile, setOpenMobile } = useSidebar();
+
+  if (collapsible === "none") {
+    return (
+      <div
+        data-slot="sidebar"
+        className={cn(
+          "flex h-full w-(--sidebar-width) flex-col bg-sidebar text-sidebar-foreground",
+          className,
+        )}
+        {...props}
+      >
+        {children}
+      </div>
+    );
+  }
+
+  if (isMobile) {
+    return (
+      <Sheet open={openMobile} onOpenChange={setOpenMobile} {...props}>
+        <SheetContent
+          dir={dir}
+          data-sidebar="sidebar"
+          data-slot="sidebar"
+          data-mobile="true"
+          className="w-(--sidebar-width) bg-sidebar p-0 text-sidebar-foreground [&>button]:hidden"
+          style={
+            {
+              "--sidebar-width": SIDEBAR_WIDTH_MOBILE,
+            } as React.CSSProperties
+          }
+          side={side}
+        >
+          <SheetHeader className="sr-only">
+            <SheetTitle>Sidebar</SheetTitle>
+            <SheetDescription>Displays the mobile sidebar.</SheetDescription>
+          </SheetHeader>
+          <div className="flex h-full w-full flex-col">{children}</div>
+        </SheetContent>
+      </Sheet>
+    );
+  }
+
+  return (
+    <div
+      className="group peer hidden text-sidebar-foreground md:block"
+      data-state={state}
+      data-collapsible={state === "collapsed" ? collapsible : ""}
+      data-variant={variant}
+      data-side={side}
+      data-slot="sidebar"
+    >
+      {/* This is what handles the sidebar gap on desktop */}
+      <div
+        data-slot="sidebar-gap"
+        className={cn(
+          "relative w-(--sidebar-width) bg-transparent transition-[width] duration-200 ease-linear",
+          "group-data-[collapsible=offcanvas]:w-0",
+          "group-data-[side=right]:rotate-180",
+          variant === "floating" || variant === "inset"
+            ? "group-data-[collapsible=icon]:w-[calc(var(--sidebar-width-icon)+(--spacing(4)))]"
+            : "group-data-[collapsible=icon]:w-(--sidebar-width-icon)",
+        )}
+      />
+      <div
+        data-slot="sidebar-container"
+        data-side={side}
+        className={cn(
+          "fixed inset-y-0 z-10 hidden h-svh w-(--sidebar-width) transition-[left,right,width] duration-200 ease-linear data-[side=left]:left-0 data-[side=left]:group-data-[collapsible=offcanvas]:left-[calc(var(--sidebar-width)*-1)] data-[side=right]:right-0 data-[side=right]:group-data-[collapsible=offcanvas]:right-[calc(var(--sidebar-width)*-1)] md:flex",
+          // Adjust the padding for floating and inset variants.
+          variant === "floating" || variant === "inset"
+            ? "p-2 group-data-[collapsible=icon]:w-[calc(var(--sidebar-width-icon)+(--spacing(4))+2px)]"
+            : "group-data-[collapsible=icon]:w-(--sidebar-width-icon)",
+          className,
+        )}
+        {...props}
+      >
+        <div
+          data-sidebar="sidebar"
+          data-slot="sidebar-inner"
+          className="flex size-full flex-col bg-sidebar group-data-[variant=floating]:rounded-lg group-data-[variant=floating]:shadow-sm group-data-[variant=floating]:ring-1 group-data-[variant=floating]:ring-sidebar-border"
+        >
+          {children}
+        </div>
+      </div>
+    </div>
+  );
+}
+
+function SidebarTrigger({ className, onClick, ...props }: React.ComponentProps<typeof Button>) {
+  const { toggleSidebar } = useSidebar();
+
+  return (
+    <Button
+      data-sidebar="trigger"
+      data-slot="sidebar-trigger"
+      variant="ghost"
+      size="icon-sm"
+      className={cn(className)}
+      onClick={(event) => {
+        onClick?.(event);
+        toggleSidebar();
+      }}
+      {...props}
+    >
+      <PanelLeftIcon />
+      <span className="sr-only">Toggle Sidebar</span>
+    </Button>
+  );
+}
+
+function SidebarRail({ className, ...props }: React.ComponentProps<"button">) {
+  const { toggleSidebar } = useSidebar();
+
+  return (
+    <button
+      data-sidebar="rail"
+      data-slot="sidebar-rail"
+      aria-label="Toggle Sidebar"
+      tabIndex={-1}
+      onClick={toggleSidebar}
+      title="Toggle Sidebar"
+      className={cn(
+        "absolute inset-y-0 z-20 hidden w-4 transition-all ease-linear group-data-[side=left]:-right-4 group-data-[side=right]:left-0 after:absolute after:inset-y-0 after:start-1/2 after:w-[2px] hover:after:bg-sidebar-border sm:flex ltr:-translate-x-1/2 rtl:-translate-x-1/2",
+        "in-data-[side=left]:cursor-w-resize in-data-[side=right]:cursor-e-resize",
+        "[[data-side=left][data-state=collapsed]_&]:cursor-e-resize [[data-side=right][data-state=collapsed]_&]:cursor-w-resize",
+        "group-data-[collapsible=offcanvas]:translate-x-0 group-data-[collapsible=offcanvas]:after:left-full hover:group-data-[collapsible=offcanvas]:bg-sidebar",
+        "[[data-side=left][data-collapsible=offcanvas]_&]:-right-2",
+        "[[data-side=right][data-collapsible=offcanvas]_&]:-left-2",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function SidebarInset({ className, ...props }: React.ComponentProps<"main">) {
+  return (
+    <main
+      data-slot="sidebar-inset"
+      className={cn(
+        "relative flex w-full flex-1 flex-col bg-background md:peer-data-[variant=inset]:m-2 md:peer-data-[variant=inset]:ml-0 md:peer-data-[variant=inset]:rounded-xl md:peer-data-[variant=inset]:shadow-sm md:peer-data-[variant=inset]:peer-data-[state=collapsed]:ml-2",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function SidebarInput({ className, ...props }: React.ComponentProps<typeof Input>) {
+  return (
+    <Input
+      data-slot="sidebar-input"
+      data-sidebar="input"
+      className={cn("h-8 w-full bg-background shadow-none", className)}
+      {...props}
+    />
+  );
+}
+
+function SidebarHeader({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="sidebar-header"
+      data-sidebar="header"
+      className={cn("flex flex-col gap-2 p-2 [--radius:var(--radius-xl)]", className)}
+      {...props}
+    />
+  );
+}
+
+function SidebarFooter({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="sidebar-footer"
+      data-sidebar="footer"
+      className={cn("flex flex-col gap-2 p-2", className)}
+      {...props}
+    />
+  );
+}
+
+function SidebarSeparator({ className, ...props }: React.ComponentProps<typeof Separator>) {
+  return (
+    <Separator
+      data-slot="sidebar-separator"
+      data-sidebar="separator"
+      className={cn("mx-2 w-auto bg-sidebar-border", className)}
+      {...props}
+    />
+  );
+}
+
+function SidebarContent({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="sidebar-content"
+      data-sidebar="content"
+      className={cn(
+        "no-scrollbar flex min-h-0 flex-1 flex-col gap-2 overflow-auto [--radius:var(--radius-xl)] group-data-[collapsible=icon]:overflow-hidden",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function SidebarGroup({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="sidebar-group"
+      data-sidebar="group"
+      className={cn("relative flex w-full min-w-0 flex-col p-2", className)}
+      {...props}
+    />
+  );
+}
+
+function SidebarGroupLabel({
+  className,
+  asChild = false,
+  ...props
+}: React.ComponentProps<"div"> & { asChild?: boolean }) {
+  const Comp = asChild ? Slot.Root : "div";
+
+  return (
+    <Comp
+      data-slot="sidebar-group-label"
+      data-sidebar="group-label"
+      className={cn(
+        "flex h-8 shrink-0 items-center rounded-md px-3 text-xs font-medium text-sidebar-foreground/70 ring-sidebar-ring outline-hidden transition-[margin,opacity] duration-200 ease-linear group-data-[collapsible=icon]:-mt-8 group-data-[collapsible=icon]:opacity-0 focus-visible:ring-2 [&>svg]:size-4 [&>svg]:shrink-0",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function SidebarGroupAction({
+  className,
+  asChild = false,
+  ...props
+}: React.ComponentProps<"button"> & { asChild?: boolean }) {
+  const Comp = asChild ? Slot.Root : "button";
+
+  return (
+    <Comp
+      data-slot="sidebar-group-action"
+      data-sidebar="group-action"
+      className={cn(
+        "absolute top-3.5 right-3 flex aspect-square w-5 items-center justify-center rounded-md p-0 text-sidebar-foreground ring-sidebar-ring outline-hidden transition-transform group-data-[collapsible=icon]:hidden after:absolute after:-inset-2 hover:bg-sidebar-accent hover:text-sidebar-accent-foreground focus-visible:ring-2 md:after:hidden [&>svg]:size-4 [&>svg]:shrink-0",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function SidebarGroupContent({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="sidebar-group-content"
+      data-sidebar="group-content"
+      className={cn("w-full text-sm", className)}
+      {...props}
+    />
+  );
+}
+
+function SidebarMenu({ className, ...props }: React.ComponentProps<"ul">) {
+  return (
+    <ul
+      data-slot="sidebar-menu"
+      data-sidebar="menu"
+      className={cn("flex w-full min-w-0 flex-col gap-1", className)}
+      {...props}
+    />
+  );
+}
+
+function SidebarMenuItem({ className, ...props }: React.ComponentProps<"li">) {
+  return (
+    <li
+      data-slot="sidebar-menu-item"
+      data-sidebar="menu-item"
+      className={cn("group/menu-item relative", className)}
+      {...props}
+    />
+  );
+}
+
+const sidebarMenuButtonVariants = cva(
+  "peer/menu-button group/menu-button flex w-full items-center gap-2 overflow-hidden rounded-lg px-3 py-2 text-left text-sm ring-sidebar-ring outline-hidden transition-[width,height,padding] group-has-data-[sidebar=menu-action]/menu-item:pr-8 group-data-[collapsible=icon]:size-8! group-data-[collapsible=icon]:p-2! hover:bg-sidebar-accent hover:text-sidebar-accent-foreground focus-visible:ring-2 active:bg-sidebar-accent active:text-sidebar-accent-foreground disabled:pointer-events-none disabled:opacity-50 aria-disabled:pointer-events-none aria-disabled:opacity-50 data-open:hover:bg-sidebar-accent data-open:hover:text-sidebar-accent-foreground data-[active=true]:bg-sidebar-accent data-[active=true]:font-medium data-[active=true]:text-sidebar-accent-foreground [&_svg]:size-4 [&_svg]:shrink-0 [&>span:last-child]:truncate",
+  {
+    variants: {
+      variant: {
+        default: "hover:bg-sidebar-accent hover:text-sidebar-accent-foreground",
+        outline:
+          "bg-background shadow-[0_0_0_1px_hsl(var(--sidebar-border))] hover:bg-sidebar-accent hover:text-sidebar-accent-foreground hover:shadow-[0_0_0_1px_hsl(var(--sidebar-accent))]",
+      },
+      size: {
+        default: "h-9 text-sm",
+        sm: "h-8 text-xs",
+        lg: "h-14 px-3 text-sm group-data-[collapsible=icon]:p-0!",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+      size: "default",
+    },
+  },
+);
+
+function SidebarMenuButton({
+  asChild = false,
+  isActive = false,
+  variant = "default",
+  size = "default",
+  tooltip,
+  className,
+  ...props
+}: React.ComponentProps<"button"> & {
+  asChild?: boolean;
+  isActive?: boolean;
+  tooltip?: string | React.ComponentProps<typeof TooltipContent>;
+} & VariantProps<typeof sidebarMenuButtonVariants>) {
+  const Comp = asChild ? Slot.Root : "button";
+  const { isMobile, state } = useSidebar();
+
+  const button = (
+    <Comp
+      data-slot="sidebar-menu-button"
+      data-sidebar="menu-button"
+      data-size={size}
+      data-active={isActive}
+      className={cn(sidebarMenuButtonVariants({ variant, size }), className)}
+      {...props}
+    />
+  );
+
+  if (!tooltip) {
+    return button;
+  }
+
+  if (typeof tooltip === "string") {
+    tooltip = {
+      children: tooltip,
+    };
+  }
+
+  return (
+    <Tooltip>
+      <TooltipTrigger asChild>{button}</TooltipTrigger>
+      <TooltipContent
+        side="right"
+        align="center"
+        hidden={state !== "collapsed" || isMobile}
+        {...tooltip}
+      />
+    </Tooltip>
+  );
+}
+
+function SidebarMenuAction({
+  className,
+  asChild = false,
+  showOnHover = false,
+  ...props
+}: React.ComponentProps<"button"> & {
+  asChild?: boolean;
+  showOnHover?: boolean;
+}) {
+  const Comp = asChild ? Slot.Root : "button";
+
+  return (
+    <Comp
+      data-slot="sidebar-menu-action"
+      data-sidebar="menu-action"
+      className={cn(
+        "absolute top-1.5 right-1 flex aspect-square w-5 items-center justify-center rounded-md p-0 text-sidebar-foreground ring-sidebar-ring outline-hidden transition-transform group-data-[collapsible=icon]:hidden peer-hover/menu-button:text-sidebar-accent-foreground peer-data-[size=default]/menu-button:top-2 peer-data-[size=lg]/menu-button:top-2.5 peer-data-[size=sm]/menu-button:top-1 after:absolute after:-inset-2 hover:bg-sidebar-accent hover:text-sidebar-accent-foreground focus-visible:ring-2 md:after:hidden [&>svg]:size-4 [&>svg]:shrink-0",
+        showOnHover &&
+          "group-focus-within/menu-item:opacity-100 group-hover/menu-item:opacity-100 peer-data-active/menu-button:text-sidebar-accent-foreground aria-expanded:opacity-100 md:opacity-0",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function SidebarMenuBadge({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="sidebar-menu-badge"
+      data-sidebar="menu-badge"
+      className={cn(
+        "pointer-events-none absolute right-1 flex h-5 min-w-5 items-center justify-center rounded-md px-1 text-xs font-medium text-sidebar-foreground tabular-nums select-none group-data-[collapsible=icon]:hidden peer-hover/menu-button:text-sidebar-accent-foreground peer-data-[size=default]/menu-button:top-1.5 peer-data-[size=lg]/menu-button:top-2.5 peer-data-[size=sm]/menu-button:top-1 peer-data-active/menu-button:text-sidebar-accent-foreground",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function SidebarMenuSkeleton({
+  className,
+  showIcon = false,
+  ...props
+}: React.ComponentProps<"div"> & {
+  showIcon?: boolean;
+}) {
+  // Random width between 50 to 90%.
+  const [width] = React.useState(() => {
+    return `${Math.floor(Math.random() * 40) + 50}%`;
+  });
+
+  return (
+    <div
+      data-slot="sidebar-menu-skeleton"
+      data-sidebar="menu-skeleton"
+      className={cn("flex h-8 items-center gap-2 rounded-md px-2", className)}
+      {...props}
+    >
+      {showIcon && <Skeleton className="size-4 rounded-md" data-sidebar="menu-skeleton-icon" />}
+      <Skeleton
+        className="h-4 max-w-(--skeleton-width) flex-1"
+        data-sidebar="menu-skeleton-text"
+        style={
+          {
+            "--skeleton-width": width,
+          } as React.CSSProperties
+        }
+      />
+    </div>
+  );
+}
+
+function SidebarMenuSub({ className, ...props }: React.ComponentProps<"ul">) {
+  return (
+    <ul
+      data-slot="sidebar-menu-sub"
+      data-sidebar="menu-sub"
+      className={cn(
+        "mx-3.5 flex min-w-0 translate-x-px flex-col gap-1 border-l border-sidebar-border px-2.5 py-0.5 group-data-[collapsible=icon]:hidden",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function SidebarMenuSubItem({ className, ...props }: React.ComponentProps<"li">) {
+  return (
+    <li
+      data-slot="sidebar-menu-sub-item"
+      data-sidebar="menu-sub-item"
+      className={cn("group/menu-sub-item relative", className)}
+      {...props}
+    />
+  );
+}
+
+function SidebarMenuSubButton({
+  asChild = false,
+  size = "md",
+  isActive = false,
+  className,
+  ...props
+}: React.ComponentProps<"a"> & {
+  asChild?: boolean;
+  size?: "sm" | "md";
+  isActive?: boolean;
+}) {
+  const Comp = asChild ? Slot.Root : "a";
+
+  return (
+    <Comp
+      data-slot="sidebar-menu-sub-button"
+      data-sidebar="menu-sub-button"
+      data-size={size}
+      data-active={isActive}
+      className={cn(
+        "flex h-7 min-w-0 -translate-x-px items-center gap-2 overflow-hidden rounded-md px-2 text-sidebar-foreground ring-sidebar-ring outline-hidden group-data-[collapsible=icon]:hidden hover:bg-sidebar-accent hover:text-sidebar-accent-foreground focus-visible:ring-2 active:bg-sidebar-accent active:text-sidebar-accent-foreground disabled:pointer-events-none disabled:opacity-50 aria-disabled:pointer-events-none aria-disabled:opacity-50 data-[size=md]:text-sm data-[size=sm]:text-xs data-active:bg-sidebar-accent data-active:text-sidebar-accent-foreground [&>span:last-child]:truncate [&>svg]:size-4 [&>svg]:shrink-0 [&>svg]:text-sidebar-accent-foreground",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+export {
+  Sidebar,
+  SidebarContent,
+  SidebarFooter,
+  SidebarGroup,
+  SidebarGroupAction,
+  SidebarGroupContent,
+  SidebarGroupLabel,
+  SidebarHeader,
+  SidebarInput,
+  SidebarInset,
+  SidebarMenu,
+  SidebarMenuAction,
+  SidebarMenuBadge,
+  SidebarMenuButton,
+  SidebarMenuItem,
+  SidebarMenuSkeleton,
+  SidebarMenuSub,
+  SidebarMenuSubButton,
+  SidebarMenuSubItem,
+  SidebarProvider,
+  SidebarRail,
+  SidebarSeparator,
+  SidebarTrigger,
+  useSidebar,
+};
diff --git a/packages/agents/preview-template/src/components/ui/skeleton.tsx b/packages/agents/preview-template/src/components/ui/skeleton.tsx
new file mode 100644
index 00000000..743dbe29
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/skeleton.tsx
@@ -0,0 +1,13 @@
+import { cn } from "@/lib/utils";
+
+function Skeleton({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="skeleton"
+      className={cn("animate-pulse rounded-xl bg-muted", className)}
+      {...props}
+    />
+  );
+}
+
+export { Skeleton };
diff --git a/packages/agents/preview-template/src/components/ui/slider.tsx b/packages/agents/preview-template/src/components/ui/slider.tsx
new file mode 100644
index 00000000..8681cdc8
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/slider.tsx
@@ -0,0 +1,54 @@
+"use client";
+
+import { Slider as SliderPrimitive } from "radix-ui";
+import * as React from "react";
+
+import { cn } from "@/lib/utils";
+
+function Slider({
+  className,
+  defaultValue,
+  value,
+  min = 0,
+  max = 100,
+  ...props
+}: React.ComponentProps<typeof SliderPrimitive.Root>) {
+  const _values = React.useMemo(
+    () => (Array.isArray(value) ? value : Array.isArray(defaultValue) ? defaultValue : [min, max]),
+    [value, defaultValue, min, max],
+  );
+
+  return (
+    <SliderPrimitive.Root
+      data-slot="slider"
+      defaultValue={defaultValue}
+      value={value}
+      min={min}
+      max={max}
+      className={cn(
+        "relative flex w-full touch-none items-center select-none data-disabled:opacity-50 data-vertical:h-full data-vertical:min-h-40 data-vertical:w-auto data-vertical:flex-col",
+        className,
+      )}
+      {...props}
+    >
+      <SliderPrimitive.Track
+        data-slot="slider-track"
+        className="relative grow overflow-hidden rounded-4xl bg-muted data-horizontal:h-3 data-horizontal:w-full data-vertical:h-full data-vertical:w-3"
+      >
+        <SliderPrimitive.Range
+          data-slot="slider-range"
+          className="absolute bg-primary select-none data-horizontal:h-full data-vertical:w-full"
+        />
+      </SliderPrimitive.Track>
+      {Array.from({ length: _values.length }, (_, index) => (
+        <SliderPrimitive.Thumb
+          data-slot="slider-thumb"
+          key={index}
+          className="block size-4 shrink-0 rounded-4xl border border-primary bg-white shadow-sm ring-ring/50 transition-colors select-none hover:ring-4 focus-visible:ring-4 focus-visible:outline-hidden disabled:pointer-events-none disabled:opacity-50"
+        />
+      ))}
+    </SliderPrimitive.Root>
+  );
+}
+
+export { Slider };
diff --git a/packages/web/src/components/ui/sonner.tsx b/packages/agents/preview-template/src/components/ui/sonner.tsx
similarity index 100%
rename from packages/web/src/components/ui/sonner.tsx
rename to packages/agents/preview-template/src/components/ui/sonner.tsx
diff --git a/packages/agents/preview-template/src/components/ui/spinner.tsx b/packages/agents/preview-template/src/components/ui/spinner.tsx
new file mode 100644
index 00000000..37532529
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/spinner.tsx
@@ -0,0 +1,15 @@
+import { Loader2Icon } from "lucide-react";
+import { cn } from "@/lib/utils";
+
+function Spinner({ className, ...props }: React.ComponentProps<"svg">) {
+  return (
+    <Loader2Icon
+      role="status"
+      aria-label="Loading"
+      className={cn("size-4 animate-spin", className)}
+      {...props}
+    />
+  );
+}
+
+export { Spinner };
diff --git a/packages/agents/preview-template/src/components/ui/switch.tsx b/packages/agents/preview-template/src/components/ui/switch.tsx
new file mode 100644
index 00000000..90df2179
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/switch.tsx
@@ -0,0 +1,33 @@
+"use client";
+
+import { Switch as SwitchPrimitive } from "radix-ui";
+import type * as React from "react";
+
+import { cn } from "@/lib/utils";
+
+function Switch({
+  className,
+  size = "default",
+  ...props
+}: React.ComponentProps<typeof SwitchPrimitive.Root> & {
+  size?: "sm" | "default";
+}) {
+  return (
+    <SwitchPrimitive.Root
+      data-slot="switch"
+      data-size={size}
+      className={cn(
+        "peer group/switch relative inline-flex shrink-0 items-center rounded-full border border-transparent transition-all outline-none after:absolute after:-inset-x-3 after:-inset-y-2 focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 aria-invalid:border-destructive aria-invalid:ring-[3px] aria-invalid:ring-destructive/20 data-[size=default]:h-[18.4px] data-[size=default]:w-[32px] data-[size=sm]:h-[14px] data-[size=sm]:w-[24px] dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40 data-checked:bg-primary data-unchecked:bg-input dark:data-unchecked:bg-input/80 data-disabled:cursor-not-allowed data-disabled:opacity-50",
+        className,
+      )}
+      {...props}
+    >
+      <SwitchPrimitive.Thumb
+        data-slot="switch-thumb"
+        className="pointer-events-none block rounded-full bg-background ring-0 transition-transform group-data-[size=default]/switch:size-4 group-data-[size=sm]/switch:size-3 group-data-[size=default]/switch:data-checked:translate-x-[calc(100%-2px)] group-data-[size=sm]/switch:data-checked:translate-x-[calc(100%-2px)] dark:data-checked:bg-primary-foreground group-data-[size=default]/switch:data-unchecked:translate-x-0 group-data-[size=sm]/switch:data-unchecked:translate-x-0 dark:data-unchecked:bg-foreground"
+      />
+    </SwitchPrimitive.Root>
+  );
+}
+
+export { Switch };
diff --git a/packages/agents/preview-template/src/components/ui/table.tsx b/packages/agents/preview-template/src/components/ui/table.tsx
new file mode 100644
index 00000000..674f7c1f
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/table.tsx
@@ -0,0 +1,89 @@
+"use client";
+
+import type * as React from "react";
+
+import { cn } from "@/lib/utils";
+
+function Table({ className, ...props }: React.ComponentProps<"table">) {
+  return (
+    <div data-slot="table-container" className="relative w-full overflow-x-auto">
+      <table
+        data-slot="table"
+        className={cn("w-full caption-bottom text-sm", className)}
+        {...props}
+      />
+    </div>
+  );
+}
+
+function TableHeader({ className, ...props }: React.ComponentProps<"thead">) {
+  return <thead data-slot="table-header" className={cn("[&_tr]:border-b", className)} {...props} />;
+}
+
+function TableBody({ className, ...props }: React.ComponentProps<"tbody">) {
+  return (
+    <tbody
+      data-slot="table-body"
+      className={cn("[&_tr:last-child]:border-0", className)}
+      {...props}
+    />
+  );
+}
+
+function TableFooter({ className, ...props }: React.ComponentProps<"tfoot">) {
+  return (
+    <tfoot
+      data-slot="table-footer"
+      className={cn("border-t bg-muted/50 font-medium [&>tr]:last:border-b-0", className)}
+      {...props}
+    />
+  );
+}
+
+function TableRow({ className, ...props }: React.ComponentProps<"tr">) {
+  return (
+    <tr
+      data-slot="table-row"
+      className={cn(
+        "border-b transition-colors hover:bg-muted/50 has-aria-expanded:bg-muted/50 data-[state=selected]:bg-muted",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function TableHead({ className, ...props }: React.ComponentProps<"th">) {
+  return (
+    <th
+      data-slot="table-head"
+      className={cn(
+        "h-12 px-3 text-left align-middle font-medium whitespace-nowrap text-foreground [&:has([role=checkbox])]:pr-0",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function TableCell({ className, ...props }: React.ComponentProps<"td">) {
+  return (
+    <td
+      data-slot="table-cell"
+      className={cn("p-3 align-middle whitespace-nowrap [&:has([role=checkbox])]:pr-0", className)}
+      {...props}
+    />
+  );
+}
+
+function TableCaption({ className, ...props }: React.ComponentProps<"caption">) {
+  return (
+    <caption
+      data-slot="table-caption"
+      className={cn("mt-4 text-sm text-muted-foreground", className)}
+      {...props}
+    />
+  );
+}
+
+export { Table, TableBody, TableCaption, TableCell, TableFooter, TableHead, TableHeader, TableRow };
diff --git a/packages/agents/preview-template/src/components/ui/tabs.tsx b/packages/agents/preview-template/src/components/ui/tabs.tsx
new file mode 100644
index 00000000..e007d7a6
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/tabs.tsx
@@ -0,0 +1,80 @@
+"use client";
+
+import { cva, type VariantProps } from "class-variance-authority";
+import { Tabs as TabsPrimitive } from "radix-ui";
+import type * as React from "react";
+
+import { cn } from "@/lib/utils";
+
+function Tabs({
+  className,
+  orientation = "horizontal",
+  ...props
+}: React.ComponentProps<typeof TabsPrimitive.Root>) {
+  return (
+    <TabsPrimitive.Root
+      data-slot="tabs"
+      data-orientation={orientation}
+      className={cn("group/tabs flex gap-2 data-horizontal:flex-col", className)}
+      {...props}
+    />
+  );
+}
+
+const tabsListVariants = cva(
+  "group/tabs-list inline-flex w-fit items-center justify-center rounded-4xl p-[3px] text-muted-foreground group-data-horizontal/tabs:h-9 group-data-vertical/tabs:h-fit group-data-vertical/tabs:flex-col group-data-vertical/tabs:rounded-2xl data-[variant=line]:rounded-none",
+  {
+    variants: {
+      variant: {
+        default: "bg-muted",
+        line: "gap-1 bg-transparent",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+    },
+  },
+);
+
+function TabsList({
+  className,
+  variant = "default",
+  ...props
+}: React.ComponentProps<typeof TabsPrimitive.List> & VariantProps<typeof tabsListVariants>) {
+  return (
+    <TabsPrimitive.List
+      data-slot="tabs-list"
+      data-variant={variant}
+      className={cn(tabsListVariants({ variant }), className)}
+      {...props}
+    />
+  );
+}
+
+function TabsTrigger({ className, ...props }: React.ComponentProps<typeof TabsPrimitive.Trigger>) {
+  return (
+    <TabsPrimitive.Trigger
+      data-slot="tabs-trigger"
+      className={cn(
+        "relative inline-flex h-[calc(100%-1px)] flex-1 items-center justify-center gap-1.5 rounded-xl border border-transparent px-2 py-1 text-sm font-medium whitespace-nowrap text-foreground/60 transition-all group-data-vertical/tabs:w-full group-data-vertical/tabs:justify-start group-data-vertical/tabs:px-2.5 group-data-vertical/tabs:py-1.5 hover:text-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-1 focus-visible:outline-ring disabled:pointer-events-none disabled:opacity-50 has-data-[icon=inline-end]:pr-1.5 has-data-[icon=inline-start]:pl-1.5 dark:text-muted-foreground dark:hover:text-foreground [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+        "group-data-[variant=line]/tabs-list:bg-transparent group-data-[variant=line]/tabs-list:data-active:bg-transparent dark:group-data-[variant=line]/tabs-list:data-active:border-transparent dark:group-data-[variant=line]/tabs-list:data-active:bg-transparent",
+        "data-active:bg-background data-active:text-foreground dark:data-active:border-input dark:data-active:bg-input/30 dark:data-active:text-foreground",
+        "after:absolute after:bg-foreground after:opacity-0 after:transition-opacity group-data-horizontal/tabs:after:inset-x-0 group-data-horizontal/tabs:after:bottom-[-5px] group-data-horizontal/tabs:after:h-0.5 group-data-vertical/tabs:after:inset-y-0 group-data-vertical/tabs:after:-right-1 group-data-vertical/tabs:after:w-0.5 group-data-[variant=line]/tabs-list:data-active:after:opacity-100",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function TabsContent({ className, ...props }: React.ComponentProps<typeof TabsPrimitive.Content>) {
+  return (
+    <TabsPrimitive.Content
+      data-slot="tabs-content"
+      className={cn("flex-1 text-sm outline-none", className)}
+      {...props}
+    />
+  );
+}
+
+export { Tabs, TabsContent, TabsList, TabsTrigger, tabsListVariants };
diff --git a/packages/agents/preview-template/src/components/ui/textarea.tsx b/packages/agents/preview-template/src/components/ui/textarea.tsx
new file mode 100644
index 00000000..f959a6eb
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/textarea.tsx
@@ -0,0 +1,18 @@
+import type * as React from "react";
+
+import { cn } from "@/lib/utils";
+
+function Textarea({ className, ...props }: React.ComponentProps<"textarea">) {
+  return (
+    <textarea
+      data-slot="textarea"
+      className={cn(
+        "flex field-sizing-content min-h-16 w-full resize-none rounded-xl border border-input bg-input/30 px-3 py-3 text-base transition-colors outline-none placeholder:text-muted-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-[3px] aria-invalid:ring-destructive/20 md:text-sm dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+export { Textarea };
diff --git a/packages/agents/preview-template/src/components/ui/toggle-group.tsx b/packages/agents/preview-template/src/components/ui/toggle-group.tsx
new file mode 100644
index 00000000..067e748d
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/toggle-group.tsx
@@ -0,0 +1,85 @@
+"use client";
+
+import type { VariantProps } from "class-variance-authority";
+import { ToggleGroup as ToggleGroupPrimitive } from "radix-ui";
+import * as React from "react";
+import { toggleVariants } from "@/components/ui/toggle";
+import { cn } from "@/lib/utils";
+
+const ToggleGroupContext = React.createContext<
+  VariantProps<typeof toggleVariants> & {
+    spacing?: number;
+    orientation?: "horizontal" | "vertical";
+  }
+>({
+  size: "default",
+  variant: "default",
+  spacing: 0,
+  orientation: "horizontal",
+});
+
+function ToggleGroup({
+  className,
+  variant,
+  size,
+  spacing = 0,
+  orientation = "horizontal",
+  children,
+  ...props
+}: React.ComponentProps<typeof ToggleGroupPrimitive.Root> &
+  VariantProps<typeof toggleVariants> & {
+    spacing?: number;
+    orientation?: "horizontal" | "vertical";
+  }) {
+  return (
+    <ToggleGroupPrimitive.Root
+      data-slot="toggle-group"
+      data-variant={variant}
+      data-size={size}
+      data-spacing={spacing}
+      data-orientation={orientation}
+      style={{ "--gap": spacing } as React.CSSProperties}
+      className={cn(
+        "group/toggle-group flex w-fit flex-row items-center gap-[--spacing(var(--gap))] data-[spacing=0]:data-[variant=outline]:rounded-4xl data-vertical:flex-col data-vertical:items-stretch",
+        className,
+      )}
+      {...props}
+    >
+      <ToggleGroupContext.Provider value={{ variant, size, spacing, orientation }}>
+        {children}
+      </ToggleGroupContext.Provider>
+    </ToggleGroupPrimitive.Root>
+  );
+}
+
+function ToggleGroupItem({
+  className,
+  children,
+  variant = "default",
+  size = "default",
+  ...props
+}: React.ComponentProps<typeof ToggleGroupPrimitive.Item> & VariantProps<typeof toggleVariants>) {
+  const context = React.useContext(ToggleGroupContext);
+
+  return (
+    <ToggleGroupPrimitive.Item
+      data-slot="toggle-group-item"
+      data-variant={context.variant || variant}
+      data-size={context.size || size}
+      data-spacing={context.spacing}
+      className={cn(
+        "shrink-0 group-data-[spacing=0]/toggle-group:rounded-none group-data-[spacing=0]/toggle-group:px-3 group-data-[spacing=0]/toggle-group:shadow-none focus:z-10 focus-visible:z-10 group-data-[spacing=0]/toggle-group:has-data-[icon=inline-end]:pr-2.5 group-data-[spacing=0]/toggle-group:has-data-[icon=inline-start]:pl-2.5 group-data-horizontal/toggle-group:data-[spacing=0]:first:rounded-l-3xl group-data-vertical/toggle-group:data-[spacing=0]:first:rounded-t-3xl group-data-horizontal/toggle-group:data-[spacing=0]:last:rounded-r-3xl group-data-vertical/toggle-group:data-[spacing=0]:last:rounded-b-3xl data-[state=on]:bg-muted group-data-horizontal/toggle-group:data-[spacing=0]:data-[variant=outline]:border-l-0 group-data-vertical/toggle-group:data-[spacing=0]:data-[variant=outline]:border-t-0 group-data-horizontal/toggle-group:data-[spacing=0]:data-[variant=outline]:first:border-l group-data-vertical/toggle-group:data-[spacing=0]:data-[variant=outline]:first:border-t",
+        toggleVariants({
+          variant: context.variant || variant,
+          size: context.size || size,
+        }),
+        className,
+      )}
+      {...props}
+    >
+      {children}
+    </ToggleGroupPrimitive.Item>
+  );
+}
+
+export { ToggleGroup, ToggleGroupItem };
diff --git a/packages/agents/preview-template/src/components/ui/toggle.tsx b/packages/agents/preview-template/src/components/ui/toggle.tsx
new file mode 100644
index 00000000..e95aba75
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/toggle.tsx
@@ -0,0 +1,46 @@
+"use client";
+
+import { cva, type VariantProps } from "class-variance-authority";
+import { Toggle as TogglePrimitive } from "radix-ui";
+import type * as React from "react";
+
+import { cn } from "@/lib/utils";
+
+const toggleVariants = cva(
+  "group/toggle inline-flex items-center justify-center gap-1 rounded-4xl text-sm font-medium whitespace-nowrap transition-colors outline-none hover:bg-muted hover:text-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:pointer-events-none disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-destructive/20 aria-pressed:bg-muted dark:aria-invalid:ring-destructive/40 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+  {
+    variants: {
+      variant: {
+        default: "bg-transparent",
+        outline: "border border-input bg-transparent hover:bg-muted",
+      },
+      size: {
+        default:
+          "h-9 min-w-9 px-3 has-data-[icon=inline-end]:pr-2.5 has-data-[icon=inline-start]:pl-2.5",
+        sm: "h-8 min-w-8 px-3 has-data-[icon=inline-end]:pr-2 has-data-[icon=inline-start]:pl-2",
+        lg: "h-10 min-w-10 px-4 has-data-[icon=inline-end]:pr-3 has-data-[icon=inline-start]:pl-3",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+      size: "default",
+    },
+  },
+);
+
+function Toggle({
+  className,
+  variant = "default",
+  size = "default",
+  ...props
+}: React.ComponentProps<typeof TogglePrimitive.Root> & VariantProps<typeof toggleVariants>) {
+  return (
+    <TogglePrimitive.Root
+      data-slot="toggle"
+      className={cn(toggleVariants({ variant, size, className }))}
+      {...props}
+    />
+  );
+}
+
+export { Toggle, toggleVariants };
diff --git a/packages/agents/preview-template/src/components/ui/tooltip.tsx b/packages/agents/preview-template/src/components/ui/tooltip.tsx
new file mode 100644
index 00000000..acbe4915
--- /dev/null
+++ b/packages/agents/preview-template/src/components/ui/tooltip.tsx
@@ -0,0 +1,53 @@
+"use client";
+
+import { Tooltip as TooltipPrimitive } from "radix-ui";
+import type * as React from "react";
+
+import { cn } from "@/lib/utils";
+
+function TooltipProvider({
+  delayDuration = 0,
+  ...props
+}: React.ComponentProps<typeof TooltipPrimitive.Provider>) {
+  return (
+    <TooltipPrimitive.Provider
+      data-slot="tooltip-provider"
+      delayDuration={delayDuration}
+      {...props}
+    />
+  );
+}
+
+function Tooltip({ ...props }: React.ComponentProps<typeof TooltipPrimitive.Root>) {
+  return <TooltipPrimitive.Root data-slot="tooltip" {...props} />;
+}
+
+function TooltipTrigger({ ...props }: React.ComponentProps<typeof TooltipPrimitive.Trigger>) {
+  return <TooltipPrimitive.Trigger data-slot="tooltip-trigger" {...props} />;
+}
+
+function TooltipContent({
+  className,
+  sideOffset = 0,
+  children,
+  ...props
+}: React.ComponentProps<typeof TooltipPrimitive.Content>) {
+  return (
+    <TooltipPrimitive.Portal>
+      <TooltipPrimitive.Content
+        data-slot="tooltip-content"
+        sideOffset={sideOffset}
+        className={cn(
+          "z-50 inline-flex w-fit max-w-xs origin-(--radix-tooltip-content-transform-origin) items-center gap-1.5 rounded-2xl bg-foreground px-3 py-1.5 text-xs text-background has-data-[slot=kbd]:pr-1.5 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 **:data-[slot=kbd]:relative **:data-[slot=kbd]:isolate **:data-[slot=kbd]:z-50 **:data-[slot=kbd]:rounded-4xl data-[state=delayed-open]:animate-in data-[state=delayed-open]:fade-in-0 data-[state=delayed-open]:zoom-in-95 data-open:animate-in data-open:fade-in-0 data-open:zoom-in-95 data-closed:animate-out data-closed:fade-out-0 data-closed:zoom-out-95",
+          className,
+        )}
+        {...props}
+      >
+        {children}
+        <TooltipPrimitive.Arrow className="z-50 size-2.5 translate-y-[calc(-50%_-_2px)] rotate-45 rounded-[2px] bg-foreground fill-foreground data-[side=left]:translate-x-[-1.5px] data-[side=right]:translate-x-[1.5px]" />
+      </TooltipPrimitive.Content>
+    </TooltipPrimitive.Portal>
+  );
+}
+
+export { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger };
diff --git a/packages/agents/preview-template/src/generated.tsx b/packages/agents/preview-template/src/generated.tsx
new file mode 100644
index 00000000..739461b7
--- /dev/null
+++ b/packages/agents/preview-template/src/generated.tsx
@@ -0,0 +1,187 @@
+import { DollarSign, HandshakeIcon, TrendingUp } from "lucide-react";
+import { Bar, BarChart, CartesianGrid, ReferenceLine, XAxis, YAxis } from "recharts";
+import { Badge } from "@/components/ui/badge";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import {
+  type ChartConfig,
+  ChartContainer,
+  ChartTooltip,
+  ChartTooltipContent,
+} from "@/components/ui/chart";
+
+const chartData = [
+  { month: "Jan", revenue: 245000 },
+  { month: "Feb", revenue: 268000 },
+  { month: "Mar", revenue: 312000 },
+  { month: "Apr", revenue: 298000 },
+  { month: "May", revenue: 356000 },
+  { month: "Jun", revenue: 389000 },
+  { month: "Jul", revenue: 412000 },
+  { month: "Aug", revenue: 398000 },
+  { month: "Sep", revenue: 367000 },
+  { month: "Oct", revenue: 421000 },
+  { month: "Nov", revenue: 445000 },
+  { month: "Dec", revenue: 495000 },
+];
+
+const chartConfig = {
+  revenue: {
+    label: "Revenue",
+    color: "hsl(217, 91%, 60%)",
+  },
+} satisfies ChartConfig;
+
+const averageRevenue = chartData.reduce((sum, item) => sum + item.revenue, 0) / chartData.length;
+
+export default function Dashboard() {
+  return (
+    <div className="min-h-screen bg-gradient-to-br from-slate-50 to-slate-100 p-6 md:p-8">
+      <div className="mx-auto max-w-7xl space-y-8">
+        {/* Header */}
+        <div className="space-y-2">
+          <h1 className="text-3xl font-semibold tracking-tight">Sales Dashboard</h1>
+          <p className="text-sm text-muted-foreground">
+            Track your sales performance and key metrics
+          </p>
+        </div>
+
+        {/* KPI Cards */}
+        <div className="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
+          {/* Total Revenue Card */}
+          <Card className="bg-white shadow-sm border-slate-200">
+            <CardHeader className="pb-3">
+              <div className="flex items-start justify-between">
+                <div className="space-y-1">
+                  <CardDescription className="text-xs font-semibold uppercase tracking-wider text-slate-500">
+                    Total Revenue
+                  </CardDescription>
+                  <CardTitle className="text-3xl font-semibold tabular-nums text-slate-900">
+                    $3,847,200
+                  </CardTitle>
+                </div>
+                <div className="rounded-lg bg-blue-50 p-2">
+                  <DollarSign className="h-5 w-5 text-blue-600" />
+                </div>
+              </div>
+            </CardHeader>
+            <CardContent>
+              <Badge
+                variant="secondary"
+                className="gap-1 bg-green-50 text-green-700 hover:bg-green-50"
+              >
+                <TrendingUp className="h-3 w-3" />
+                <span>+12.4%</span>
+              </Badge>
+            </CardContent>
+          </Card>
+
+          {/* Deals Won Card */}
+          <Card className="bg-white shadow-sm border-slate-200">
+            <CardHeader className="pb-3">
+              <div className="flex items-start justify-between">
+                <div className="space-y-1">
+                  <CardDescription className="text-xs font-semibold uppercase tracking-wider text-slate-500">
+                    Deals Won
+                  </CardDescription>
+                  <CardTitle className="text-3xl font-semibold tabular-nums text-slate-900">
+                    214
+                  </CardTitle>
+                </div>
+                <div className="rounded-lg bg-emerald-50 p-2">
+                  <HandshakeIcon className="h-5 w-5 text-emerald-600" />
+                </div>
+              </div>
+            </CardHeader>
+            <CardContent>
+              <Badge
+                variant="secondary"
+                className="gap-1 bg-green-50 text-green-700 hover:bg-green-50"
+              >
+                <TrendingUp className="h-3 w-3" />
+                <span>+8.1%</span>
+              </Badge>
+            </CardContent>
+          </Card>
+
+          {/* Avg Deal Size Card */}
+          <Card className="bg-white shadow-sm border-slate-200">
+            <CardHeader className="pb-3">
+              <div className="flex items-start justify-between">
+                <div className="space-y-1">
+                  <CardDescription className="text-xs font-semibold uppercase tracking-wider text-slate-500">
+                    Avg Deal Size
+                  </CardDescription>
+                  <CardTitle className="text-3xl font-semibold tabular-nums text-slate-900">
+                    $17,978
+                  </CardTitle>
+                </div>
+                <div className="rounded-lg bg-purple-50 p-2">
+                  <DollarSign className="h-5 w-5 text-purple-600" />
+                </div>
+              </div>
+            </CardHeader>
+            <CardContent>
+              <Badge
+                variant="secondary"
+                className="gap-1 bg-green-50 text-green-700 hover:bg-green-50"
+              >
+                <TrendingUp className="h-3 w-3" />
+                <span>+3.9%</span>
+              </Badge>
+            </CardContent>
+          </Card>
+        </div>
+
+        {/* Revenue Chart */}
+        <Card className="bg-white shadow-sm border-slate-200">
+          <CardHeader>
+            <CardTitle className="text-lg font-semibold">Monthly Revenue</CardTitle>
+            <CardDescription>Revenue trend across 12 months with average baseline</CardDescription>
+          </CardHeader>
+          <CardContent>
+            <ChartContainer config={chartConfig} className="h-80 w-full">
+              <BarChart data={chartData} accessibilityLayer>
+                <CartesianGrid vertical={false} stroke="hsl(210, 40%, 96%)" strokeDasharray="0" />
+                <XAxis
+                  dataKey="month"
+                  tickLine={false}
+                  axisLine={false}
+                  tickMargin={8}
+                  tick={{ fill: "hsl(215, 13%, 34%)", fontSize: 12 }}
+                />
+                <YAxis
+                  tickLine={false}
+                  axisLine={false}
+                  width={48}
+                  tickFormatter={(value) => `$${(value / 1000).toFixed(0)}K`}
+                  tick={{ fill: "hsl(215, 13%, 34%)", fontSize: 12 }}
+                />
+                <ChartTooltip
+                  content={
+                    <ChartTooltipContent
+                      formatter={(value) => [`$${(value as number).toLocaleString()}`, "Revenue"]}
+                    />
+                  }
+                />
+                <ReferenceLine
+                  y={averageRevenue}
+                  stroke="hsl(217, 91%, 60%)"
+                  strokeDasharray="5 5"
+                  opacity={0.5}
+                  label={{
+                    value: "Average",
+                    position: "right",
+                    fill: "hsl(215, 13%, 34%)",
+                    fontSize: 12,
+                    offset: 10,
+                  }}
+                />
+                <Bar dataKey="revenue" fill="var(--color-revenue)" radius={[8, 8, 0, 0]} />
+              </BarChart>
+            </ChartContainer>
+          </CardContent>
+        </Card>
+      </div>
+    </div>
+  );
+}
diff --git a/packages/agents/preview-template/src/hooks/use-mobile.ts b/packages/agents/preview-template/src/hooks/use-mobile.ts
new file mode 100644
index 00000000..502fd323
--- /dev/null
+++ b/packages/agents/preview-template/src/hooks/use-mobile.ts
@@ -0,0 +1,19 @@
+import * as React from "react";
+
+const MOBILE_BREAKPOINT = 768;
+
+export function useIsMobile() {
+  const [isMobile, setIsMobile] = React.useState<boolean | undefined>(undefined);
+
+  React.useEffect(() => {
+    const mql = window.matchMedia(`(max-width: ${MOBILE_BREAKPOINT - 1}px)`);
+    const onChange = () => {
+      setIsMobile(window.innerWidth < MOBILE_BREAKPOINT);
+    };
+    mql.addEventListener("change", onChange);
+    setIsMobile(window.innerWidth < MOBILE_BREAKPOINT);
+    return () => mql.removeEventListener("change", onChange);
+  }, []);
+
+  return !!isMobile;
+}
diff --git a/packages/agents/preview-template/src/index.css b/packages/agents/preview-template/src/index.css
new file mode 100644
index 00000000..ddf53f02
--- /dev/null
+++ b/packages/agents/preview-template/src/index.css
@@ -0,0 +1,157 @@
+@import "tailwindcss";
+
+/* `dark:` variant is class-driven (a `.dark` ancestor), not prefers-color-scheme.
+   Default render is the light theme below; tokens are kept self-contained. */
+@custom-variant dark (&:is(.dark *));
+
+/* ─────────────────────────────────────────────────────────────
+   shadcn design tokens — Foreman brand (orange accent on neutral
+   grayscale). `muted` is a subtle BACKGROUND, `muted-foreground` is
+   dim TEXT. Copied from packages/web/src/app/globals.css.
+   ───────────────────────────────────────────────────────────── */
+:root {
+  --radius: 0.625rem;
+
+  --background: #ffffff;
+  --foreground: #0a0a0a;
+  --card: #ffffff;
+  --card-foreground: #0a0a0a;
+  --popover: #ffffff;
+  --popover-foreground: #0a0a0a;
+
+  --primary: #ff4a00;
+  --primary-foreground: #ffffff;
+  --secondary: #f4f4f5;
+  --secondary-foreground: #18181b;
+  --muted: #f4f4f5;
+  --muted-foreground: #52525b;
+  --accent: #ff4a00;
+  --accent-foreground: #ffffff;
+  --destructive: #dc2626;
+  --destructive-foreground: #ffffff;
+
+  --border: #d4d4d8;
+  --input: #d4d4d8;
+  --ring: #ff4a00;
+
+  --surface: #f8f8f8;
+
+  --chart-1: #ff4a00;
+  --chart-2: #2563eb;
+  --chart-3: #16a34a;
+  --chart-4: #d97706;
+  --chart-5: #7c3aed;
+
+  --sidebar: #f8f8f8;
+  --sidebar-foreground: #0a0a0a;
+  --sidebar-primary: #ff4a00;
+  --sidebar-primary-foreground: #ffffff;
+  --sidebar-accent: #f4f4f5;
+  --sidebar-accent-foreground: #18181b;
+  --sidebar-border: #e5e7eb;
+  --sidebar-ring: #ff4a00;
+}
+
+.dark {
+  --background: #09090b;
+  --foreground: #fafafa;
+  --card: #111114;
+  --card-foreground: #fafafa;
+  --popover: #111114;
+  --popover-foreground: #fafafa;
+
+  --primary: #ff5a1a;
+  --primary-foreground: #ffffff;
+  --secondary: #27272a;
+  --secondary-foreground: #fafafa;
+  --muted: #27272a;
+  --muted-foreground: #a1a1aa;
+  --accent: #ff5a1a;
+  --accent-foreground: #ffffff;
+  --destructive: #ef4444;
+  --destructive-foreground: #ffffff;
+
+  --border: #1e1e22;
+  --input: #1e1e22;
+  --ring: #ff5a1a;
+
+  --surface: #111114;
+
+  --chart-1: #ff5a1a;
+  --chart-2: #3b82f6;
+  --chart-3: #22c55e;
+  --chart-4: #f59e0b;
+  --chart-5: #a78bfa;
+
+  --sidebar: #111114;
+  --sidebar-foreground: #fafafa;
+  --sidebar-primary: #ff5a1a;
+  --sidebar-primary-foreground: #ffffff;
+  --sidebar-accent: #27272a;
+  --sidebar-accent-foreground: #fafafa;
+  --sidebar-border: #1e1e22;
+  --sidebar-ring: #ff5a1a;
+}
+
+@theme inline {
+  /* Surface tokens are blended a few percent toward the brand hue (--primary)
+     so the brand reaches the whole UI — cards, inputs, borders, accent states.
+     Foreground/text tokens stay untinted for contrast. */
+  --color-background: color-mix(in oklab, var(--background), var(--primary) 4%);
+  --color-foreground: var(--foreground);
+  --color-card: color-mix(in oklab, var(--card), var(--primary) 8%);
+  --color-card-foreground: var(--card-foreground);
+  --color-popover: color-mix(in oklab, var(--popover), var(--primary) 8%);
+  --color-popover-foreground: var(--popover-foreground);
+  --color-primary: var(--primary);
+  --color-primary-foreground: var(--primary-foreground);
+  --color-secondary: color-mix(in oklab, var(--secondary), var(--primary) 12%);
+  --color-secondary-foreground: var(--secondary-foreground);
+  --color-muted: color-mix(in oklab, var(--muted), var(--primary) 10%);
+  --color-muted-foreground: var(--muted-foreground);
+  --color-accent: color-mix(in oklab, var(--accent), var(--primary) 25%);
+  --color-accent-foreground: var(--accent-foreground);
+  --color-destructive: var(--destructive);
+  --color-destructive-foreground: var(--destructive-foreground);
+  --color-border: color-mix(in oklab, var(--border), var(--primary) 16%);
+  --color-input: color-mix(in oklab, var(--input), var(--primary) 16%);
+  --color-ring: var(--ring);
+  --color-surface: var(--surface);
+  --color-chart-1: var(--chart-1);
+  --color-chart-2: var(--chart-2);
+  --color-chart-3: var(--chart-3);
+  --color-chart-4: var(--chart-4);
+  --color-chart-5: var(--chart-5);
+  --color-sidebar: color-mix(in oklab, var(--background), var(--primary) 4%);
+  --color-sidebar-foreground: var(--sidebar-foreground);
+  --color-sidebar-primary: var(--sidebar-primary);
+  --color-sidebar-primary-foreground: var(--sidebar-primary-foreground);
+  --color-sidebar-accent: var(--sidebar-accent);
+  --color-sidebar-accent-foreground: var(--sidebar-accent-foreground);
+  --color-sidebar-border: var(--sidebar-border);
+  --color-sidebar-ring: var(--sidebar-ring);
+
+  --radius-sm: calc(var(--radius) - 4px);
+  --radius-md: calc(var(--radius) - 2px);
+  --radius-lg: var(--radius);
+  --radius-xl: calc(var(--radius) + 4px);
+
+  --font-sans: "Geist", "Geist Fallback", ui-sans-serif, system-ui, sans-serif;
+  --font-mono: "Geist Mono", "Geist Mono Fallback", ui-monospace, monospace;
+}
+
+body {
+  background: var(--background);
+  color: var(--foreground);
+  font-family: var(--font-sans), system-ui, -apple-system, sans-serif;
+  -webkit-font-smoothing: antialiased;
+}
+
+/* Hide scrollbars in the preview — content still scrolls, just no visible bar
+   (the preview reads as a clean embedded canvas, not a scrolling document). */
+* {
+  scrollbar-width: none; /* Firefox */
+}
+*::-webkit-scrollbar {
+  display: none; /* Chromium / WebKit */
+}
diff --git a/packages/agents/preview-template/src/lib/utils.ts b/packages/agents/preview-template/src/lib/utils.ts
new file mode 100644
index 00000000..7610a640
--- /dev/null
+++ b/packages/agents/preview-template/src/lib/utils.ts
@@ -0,0 +1,9 @@
+import { type ClassValue, clsx } from "clsx";
+import { twMerge } from "tailwind-merge";
+
+// Canonical shadcn `cn` helper. The web app's lib/utils.ts is a superset that
+// also pulls in chat/db/ai concerns the shadcn components never use — only `cn`
+// is needed here, so the preview template keeps a minimal, self-contained copy.
+export function cn(...inputs: ClassValue[]) {
+  return twMerge(clsx(inputs));
+}
diff --git a/packages/agents/preview-template/src/main.tsx b/packages/agents/preview-template/src/main.tsx
new file mode 100644
index 00000000..55ce814b
--- /dev/null
+++ b/packages/agents/preview-template/src/main.tsx
@@ -0,0 +1,16 @@
+import { StrictMode } from "react";
+import { createRoot } from "react-dom/client";
+
+import App from "./App";
+import "./index.css";
+
+const rootElement = document.getElementById("root");
+if (!rootElement) {
+  throw new Error('Root element "#root" not found in index.html');
+}
+
+createRoot(rootElement).render(
+  <StrictMode>
+    <App />
+  </StrictMode>,
+);
diff --git a/packages/agents/preview-template/src/vite-env.d.ts b/packages/agents/preview-template/src/vite-env.d.ts
new file mode 100644
index 00000000..11f02fe2
--- /dev/null
+++ b/packages/agents/preview-template/src/vite-env.d.ts
@@ -0,0 +1 @@
+/// <reference types="vite/client" />
diff --git a/packages/agents/preview-template/tsconfig.json b/packages/agents/preview-template/tsconfig.json
new file mode 100644
index 00000000..d55c6486
--- /dev/null
+++ b/packages/agents/preview-template/tsconfig.json
@@ -0,0 +1,32 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "useDefineForClassFields": true,
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "skipLibCheck": true,
+
+    /* Bundler mode */
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "verbatimModuleSyntax": true,
+    "moduleDetection": "force",
+    "noEmit": true,
+    "jsx": "react-jsx",
+
+    /* Linting */
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "erasableSyntaxOnly": true,
+    "noFallthroughCasesInSwitch": true,
+    "noUncheckedSideEffectImports": true,
+
+    /* Path alias */
+    "baseUrl": ".",
+    "paths": {
+      "@/*": ["./src/*"]
+    }
+  },
+  "include": ["src"]
+}
diff --git a/packages/agents/preview-template/vite.config.ts b/packages/agents/preview-template/vite.config.ts
new file mode 100644
index 00000000..2060c783
--- /dev/null
+++ b/packages/agents/preview-template/vite.config.ts
@@ -0,0 +1,20 @@
+import { fileURLToPath, URL } from "node:url";
+import tailwindcss from "@tailwindcss/vite";
+import react from "@vitejs/plugin-react";
+import { defineConfig } from "vite";
+
+// Warm template for Foreman's live-preview harness. The agent overwrites
+// src/generated.tsx at runtime; Vite HMR renders it live.
+export default defineConfig({
+  plugins: [react(), tailwindcss()],
+  resolve: {
+    alias: {
+      "@": fileURLToPath(new URL("./src", import.meta.url)),
+    },
+  },
+  server: {
+    host: "127.0.0.1",
+    port: 7332,
+    strictPort: true,
+  },
+});
diff --git a/packages/agents/scripts/README.md b/packages/agents/scripts/README.md
new file mode 100644
index 00000000..654411b8
--- /dev/null
+++ b/packages/agents/scripts/README.md
@@ -0,0 +1,79 @@
+# Agent scripts
+
+Operational, eval, and probe scripts for the agents package. Most are run through
+the npm scripts in `packages/agents/package.json`; a few are standalone probes run
+directly with `npx tsx`.
+
+**Prerequisites**
+
+- A `packages/agents/.env.local` with the secrets the script needs. Scripts load it
+  via `--env-file=.env.local` (or `npx tsx --env-file=.env.local …`) — **no
+  credentials are hardcoded**. Common keys: `SUPABASE_URL`,
+  `SUPABASE_SERVICE_ROLE_KEY`, `DATABASE_URL`, `ANTHROPIC_API_KEY`, and (for the
+  Zapier probes) a logged-in Zapier SDK session + `ZAPIER_ACCOUNT_ID`.
+- A running local Supabase (`npx supabase start` from the repo root) for anything
+  that touches Postgres.
+
+## Evaluation / datasets
+
+The Mastra Datasets pipeline that scores the agent against a labeled set (see the
+"Evaluation pipeline" section in the repo `CLAUDE.md`). Run from `packages/agents`:
+
+| Command | Purpose |
+|---|---|
+| `npm run datasets:smoke` | Build/validate a tiny dataset slice |
+| `npm run datasets:load-raw` | Load the raw dataset items |
+| `npm run datasets:label` | Label items with `category_hint` / `expected_behavior` |
+| `npm run datasets:set-trajectory` / `:set-context` / `:fix-input` | Dataset field fixups |
+| `npm run datasets:mini-experiment` | 2-item smoke before paying for the full run |
+| `npm run datasets:experiment -- --full` | Full 80-item experiment (uses real model calls) |
+| `npm run datasets:analyze` | Per-scorer averages + per-category breakdown + worst-10 |
+
+## App catalog & embeddings
+
+| Command | Purpose |
+|---|---|
+| `npm run catalog:seed` | Seed the Zapier app catalog into local Postgres (`seed-catalog.ts`) |
+| `npm run catalog:seed:quick` | Apps only (skip actions) |
+| `npm run catalog:embed` | Compute catalog embeddings only |
+| `npm run embeddings:reindex` | Rebuild the action-history embeddings index |
+
+## Ops / debugging
+
+| Command | Purpose |
+|---|---|
+| `npm run logs` / `logs:watch` | Tail recent agent activity from the DB (`show-logs.mjs`) |
+| `npm run verify:aimock` | Check AIMock fixture coverage for the mocked tests |
+
+`show-logs.mjs` reads `DATABASE_URL` (falls back to the local Supabase default).
+
+## Zapier durable / trigger-inbox probes (standalone)
+
+Manual harness + probes for the Zapier experimental durable-workflow and
+trigger-inbox surfaces. These need a Zapier account with durable early access, a
+logged-in SDK session, and `ZAPIER_ACCOUNT_ID` set (your numeric catch-hook account
+segment — find it in a Zapier catch-hook URL: `hooks.zapier.com/hooks/catch/<ACCOUNT_ID>/<code>/`).
+Run with `npx tsx --env-file=.env.local scripts/<name>.ts`.
+
+| Script | Purpose |
+|---|---|
+| `durable-loop-smoke.ts` | End-to-end: deploy durable → inbox trigger → event → worker → run (live) |
+| `durable-smoke.ts` | Minimal ephemeral durable run (echo) |
+| `durable-write-roundtrip.ts` | create → publish → trigger → delete a durable workflow |
+| `durable-endpoints-probe.ts` | Probe which durable/workflow endpoints are reachable under each auth |
+| `durable-pkce-probe.ts` | Probe the PKCE userJwt auth path against durable endpoints |
+| `probe-connections.ts` | List the account's connected apps + connection fields |
+| `probe-webhook-inbox.ts` | Probe instant webhook delivery into a trigger-inbox |
+| `sdk-surface-sweep.ts` | Enumerate the installed Zapier SDK method surface |
+| `trigger-inbox-spike.ts` | Spike: ensure/lease/ack/drain a trigger-inbox |
+
+> These probes hit a real Zapier account and may create/delete cloud resources.
+> They self-clean, but run them against a non-sensitive test account.
+
+## Root scripts (`/scripts`)
+
+| Command | Purpose |
+|---|---|
+| `npm run check:deps` (root) | Fail the install if `@mastra/*` versions diverge (`check-dep-uniqueness.mjs`) |
+| `npm run sdk:check` (root) | Watch for new Zapier SDK/CLI releases (`zapier-sdk-watch.mjs`) |
+| `npm run dead-code` (root) | Fallow dead-code report |
diff --git a/packages/agents/scripts/datasets-label.ts b/packages/agents/scripts/datasets-label.ts
index 361d5e3b..5920c9db 100644
--- a/packages/agents/scripts/datasets-label.ts
+++ b/packages/agents/scripts/datasets-label.ts
@@ -45,52 +45,52 @@ interface RawGroundTruth {
 
 const TEMPLATES: Record<string, (req: string) => ExpectedBehavior> = {
   "one-shot-action": (_req) => ({
-    expected_behavior: `Single-app action. Foreman should run the 5-phase action_flow: find-unique-connection → list-actions(actionType: "write" or "search") → get-input-fields-schema (first pass) → list-input-field-choices for selectors → get-input-fields-schema (second pass) → confirm using the structured template ("I'll run **<action>** on **<app>** using the **<account>** connection with: …Confirm?") → run-action on user confirmation. Should NOT proceed with the write before confirming. Read/search actions skip confirmation.`,
+    expected_behavior: `Single-app action. Foreman should run the 5-phase action_flow: find-unique-connection → list-actions(actionType: "write" or "search") → get-action-input-fields-schema (first pass) → list-action-input-field-choices for selectors → get-action-input-fields-schema (second pass) → confirm using the structured template ("I'll run **<action>** on **<app>** using the **<account>** connection with: …Confirm?") → run-action on user confirmation. Should NOT proceed with the write before confirming. Read/search actions skip confirmation.`,
     expected_tools: [
       "find-unique-connection",
       "list-actions",
-      "get-input-fields-schema",
-      "list-input-field-choices",
-      "get-input-fields-schema",
+      "get-action-input-fields-schema",
+      "list-action-input-field-choices",
+      "get-action-input-fields-schema",
       "run-action",
     ],
     forbidden_tools: ["run-action[app=zapier-tables]", "create-table"],
   }),
 
   "save-as-workflow": (_req) => ({
-    expected_behavior: `Multi-step recurring shape (no explicit time/event trigger). Foreman should walk through the multi-step flow once via run-action, then in Phase 5 ask: "Want me to save this as a workflow you can re-run later?" If user agrees, the conversation becomes saveable via saveWorkflowFromConversation.`,
+    expected_behavior: `Multi-step recurring shape (no explicit time/event trigger). Foreman should walk through the multi-step flow once via run-action. Saving/replaying a conversation as a reusable workflow is NOT available yet — Foreman runs the steps now and, if the user wants to repeat them, says plainly that saved/reusable workflows aren't available yet (never redirect to zapier.com).`,
     expected_tools: [
       "find-unique-connection",
       "list-actions",
-      "get-input-fields-schema",
-      "list-input-field-choices",
-      "get-input-fields-schema",
+      "get-action-input-fields-schema",
+      "list-action-input-field-choices",
+      "get-action-input-fields-schema",
       "run-action",
     ],
     forbidden_tools: ["run-action[app=zapier-tables]"],
   }),
 
   "scheduled-workflow": (_req) => ({
-    expected_behavior: `Time-based recurring automation (e.g., "every Monday 9am"). Foreman should walk through the action shape, then in Phase 5 offer to save as a workflow with a schedule. The Mastra workflow scheduling primitive is what handles the cron — Foreman should not invent a different mechanism. If timing is ambiguous, ask one clear question (when exactly?).`,
+    expected_behavior: `Time-based recurring request (e.g., "every Monday 9am"). Foreman should run the action shape once now via run-action, then tell the user plainly that scheduled/recurring runs aren't available yet — it must NOT claim to have scheduled anything and must NOT redirect to zapier.com. It may ask one clarifying question about timing, but cannot actually schedule.`,
     expected_tools: [
       "find-unique-connection",
       "list-actions",
-      "get-input-fields-schema",
-      "list-input-field-choices",
-      "get-input-fields-schema",
+      "get-action-input-fields-schema",
+      "list-action-input-field-choices",
+      "get-action-input-fields-schema",
       "run-action",
     ],
     forbidden_tools: ["run-action[app=zapier-tables]"],
   }),
 
   "channel-triggered-workflow": (_req) => ({
-    expected_behavior: `Event-triggered recurring automation (e.g., "when X happens, do Y"). Foreman should walk through the action shape that runs once per trigger event, then in Phase 5 offer to save as a workflow that fires on the relevant channel webhook (Discord/Slack/Telegram/etc.) or via a Zapier-side trigger. Should NOT redirect the user to zapier.com — Foreman handles this end-to-end.`,
+    expected_behavior: `Event-triggered recurring request (e.g., "when X happens, do Y"). Foreman should run the action shape once now via run-action, then tell the user plainly that event-triggered automation isn't available yet — it must NOT claim to have set up a trigger and must NOT redirect to zapier.com.`,
     expected_tools: [
       "find-unique-connection",
       "list-actions",
-      "get-input-fields-schema",
-      "list-input-field-choices",
-      "get-input-fields-schema",
+      "get-action-input-fields-schema",
+      "list-action-input-field-choices",
+      "get-action-input-fields-schema",
       "run-action",
     ],
     forbidden_tools: ["run-action[app=zapier-tables]"],
@@ -107,7 +107,7 @@ const TEMPLATES: Record<string, (req: string) => ExpectedBehavior> = {
     expected_tools: [
       "find-unique-connection",
       "list-actions",
-      "get-input-fields-schema",
+      "get-action-input-fields-schema",
       "run-action",
     ],
     forbidden_tools: [],
diff --git a/packages/agents/scripts/datasets-mini-experiment.ts b/packages/agents/scripts/datasets-mini-experiment.ts
index 5e1fb0fe..9650df9b 100644
--- a/packages/agents/scripts/datasets-mini-experiment.ts
+++ b/packages/agents/scripts/datasets-mini-experiment.ts
@@ -39,9 +39,9 @@ const TEST_CASES = [
         expected_tools: [
           "find-unique-connection",
           "list-actions",
-          "get-input-fields-schema",
-          "list-input-field-choices",
-          "get-input-fields-schema",
+          "get-action-input-fields-schema",
+          "list-action-input-field-choices",
+          "get-action-input-fields-schema",
         ],
         forbidden_tools: ["run-action[app=zapier-tables]"],
         expected_behavior:
diff --git a/packages/agents/scripts/digest-narrator-probe.ts b/packages/agents/scripts/digest-narrator-probe.ts
new file mode 100644
index 00000000..2426708d
--- /dev/null
+++ b/packages/agents/scripts/digest-narrator-probe.ts
@@ -0,0 +1,58 @@
+/**
+ * foreman-ufo3 narrative check: proves the opt-in LLM digest summary works with a
+ * real provider (OpenAI). No DB — builds a representative digest in-memory and runs
+ * the SHIPPED narrateDigest through the SHIPPED Mastra-agent path.
+ *
+ * Run (packages/agents, needs the provider key via Infisical):
+ *   $env:DIGEST_MODEL="openai/gpt-4o-mini"
+ *   infisical run --projectId <id> --env dev --path=/foreman --silent -- \
+ *     npx tsx scripts/digest-narrator-probe.ts
+ */
+import { buildDigest } from "../src/lib/automations/digest";
+import { narrateDigest } from "../src/lib/automations/digest-narrator";
+
+const digest = buildDigest(
+  [
+    {
+      automationId: "a",
+      automationName: "Nightly Sheets→Slack sync",
+      status: "failed",
+      error: { message: "connection refused" },
+      createdAt: "2026-07-05T02:00:00Z",
+    },
+    {
+      automationId: "b",
+      automationName: "Invoice approval",
+      status: "waiting",
+      createdAt: "2026-07-05T09:00:00Z",
+    },
+    {
+      automationId: "c",
+      automationName: "Daily backup",
+      status: "finished",
+      createdAt: "2026-07-05T03:00:00Z",
+    },
+    {
+      automationId: "d",
+      automationName: "Lead enrichment",
+      status: "finished",
+      createdAt: "2026-07-05T06:00:00Z",
+    },
+  ],
+  "2026-07-04T12:00:00Z",
+  "2026-07-05T12:00:00Z",
+);
+
+async function main() {
+  console.log(`model    : ${process.env.DIGEST_MODEL ?? "(fast tier default)"}`);
+  console.log(`headline : ${digest.headline}`);
+  const narrative = await narrateDigest(digest);
+  console.log(`narrative: ${narrative ?? "(null — disabled or failed)"}`);
+  console.log(`\n→ OpenAI narrative : ${narrative ? "PROVEN" : "NOT GENERATED — see above"}`);
+  if (!narrative) process.exit(1);
+}
+
+main().catch((e) => {
+  console.error("probe failed:", e);
+  process.exit(1);
+});
diff --git a/packages/agents/scripts/digest-query-probe.ts b/packages/agents/scripts/digest-query-probe.ts
new file mode 100644
index 00000000..81b9383e
--- /dev/null
+++ b/packages/agents/scripts/digest-query-probe.ts
@@ -0,0 +1,83 @@
+/**
+ * foreman-ufo3.2 real-DB check: the digest surfacing relies on a JSONB filter
+ * (`output->>kind = automation_digest`) that unit mocks can't exercise. This runs
+ * the SHIPPED store.getLatestDigest against the live local Supabase and, when a
+ * real automation exists, round-trips a digest run through it. Proves the query
+ * syntax is accepted by PostgREST and that the kind-discriminator lookup works.
+ *
+ * Run (packages/agents): npx tsx --env-file=.env.local scripts/digest-query-probe.ts
+ */
+
+import { buildDigest } from "../src/lib/automations/digest";
+import {
+  getLatestDigest,
+  listRecentRunsForWorkspace,
+  recordRun,
+} from "../src/lib/automations/store";
+import { getSupabase } from "../src/lib/db";
+
+async function main() {
+  const supabase = getSupabase();
+
+  // 1) The syntax check: the jsonb filter must EXECUTE (not 400) even with 0 rows.
+  const bogus = await getLatestDigest("00000000-0000-0000-0000-000000000000");
+  console.log(
+    `getLatestDigest(bogus ws) → ${bogus === null ? "null ✓ (query accepted)" : "unexpected"}`,
+  );
+
+  // 2) Round-trip through a real automation if one exists (FKs require valid parents).
+  const { data: autos } = await supabase
+    .from("automation")
+    .select("id, workspace_id")
+    .not("workspace_id", "is", null)
+    .limit(1);
+  const auto = (autos ?? [])[0] as { id: string; workspace_id: string } | undefined;
+
+  if (!auto) {
+    console.log("no automation with a workspace in local DB — syntax check only.");
+    console.log("→ getLatestDigest query : ACCEPTED by PostgREST");
+    return;
+  }
+
+  const since = new Date(Date.now() - 24 * 3600 * 1000).toISOString();
+  const recent = await listRecentRunsForWorkspace(auto.workspace_id, since, { limit: 50 });
+  console.log(`listRecentRunsForWorkspace(${auto.workspace_id}) → ${recent.length} recent run(s)`);
+
+  const digest = buildDigest(
+    recent.map((r) => ({
+      automationId: r.automation_id,
+      automationName: "probe",
+      status: r.status,
+      error: r.error,
+      createdAt: r.created_at,
+    })),
+    since,
+    new Date().toISOString(),
+  );
+  const runId = await recordRun({
+    automationId: auto.id,
+    workspaceId: auto.workspace_id,
+    status: "finished",
+    output: digest,
+  });
+  console.log(`recorded digest run ${runId} (headline: "${digest.headline}")`);
+
+  const latest = (await getLatestDigest(auto.workspace_id)) as {
+    kind?: string;
+    headline?: string;
+  } | null;
+  const ok = latest?.kind === "automation_digest";
+  console.log(
+    `getLatestDigest(real ws) → ${ok ? `FOUND ✓ ("${latest?.headline}")` : "NOT FOUND ✗"}`,
+  );
+
+  // Clean up the probe row.
+  await supabase.from("automation_run").delete().eq("id", runId);
+  console.log("cleaned up probe run");
+  console.log(`→ digest query round-trip : ${ok ? "PROVEN" : "FAILED"}`);
+}
+
+main().catch((e) => {
+  console.error("probe failed:", e);
+  process.exit(1);
+});
diff --git a/packages/agents/scripts/digest-workflow-e2e-probe.ts b/packages/agents/scripts/digest-workflow-e2e-probe.ts
new file mode 100644
index 00000000..0aa12fe8
--- /dev/null
+++ b/packages/agents/scripts/digest-workflow-e2e-probe.ts
@@ -0,0 +1,130 @@
+/**
+ * foreman-bhb5 native E2E: prove the daily-digest MASTRA WORKFLOW fires via an
+ * imperative Mastra schedule and stores a digest — the full native replacement for
+ * the retired custom runDueSchedules. Local DB only (no Infisical, no provider key;
+ * the narrate step fails soft to null without a key).
+ *
+ *   npx tsx --env-file=.env.local scripts/digest-workflow-e2e-probe.ts
+ *
+ * Seed workspace + a failed & a finished run → register a `* * * * *` schedule
+ * targeting daily-digest with inputData {workspaceId, automationId} → the
+ * WorkflowScheduler fires it → the workflow synthesizes + stores → getLatestDigest
+ * surfaces it. Cleans up.
+ */
+import { Mastra } from "@mastra/core";
+import { MastraCompositeStore } from "@mastra/core/storage";
+import "@mastra/core/workflows/evented";
+import { computeNextFireAt } from "@mastra/core/workflows";
+import { PostgresStore } from "@mastra/pg";
+import * as store from "../src/lib/automations/store";
+import { getLatestDigest } from "../src/lib/automations/store";
+import { getSupabase } from "../src/lib/db";
+import { dailyDigestWorkflow } from "../src/workflows/daily-digest";
+
+async function main() {
+  const connectionString = process.env.DATABASE_URL;
+  if (!connectionString) throw new Error("DATABASE_URL missing (need .env.local)");
+
+  // Mirror Foreman's composite store (schedules must route to the Postgres default).
+  const mastra = new Mastra({
+    storage: new MastraCompositeStore({
+      id: "probe-storage",
+      default: new PostgresStore({ id: "probe-pg", connectionString }),
+    }),
+    workflows: { "daily-digest": dailyDigestWorkflow },
+    scheduler: { enabled: true },
+  });
+  await mastra.startWorkers();
+  console.log(`scheduler defined: ${Boolean(mastra.scheduler)}`);
+
+  const supabase = getSupabase();
+  const stamp = Math.floor(Number(process.env.PROBE_STAMP) || 1);
+  const { data: ws, error: wsErr } = await supabase
+    .from("workspaces")
+    .insert({ name: "bhb5 probe", slug: `bhb5-probe-${stamp}` })
+    .select("id")
+    .single();
+  if (wsErr) throw new Error(`workspace insert: ${wsErr.message}`);
+  const workspaceId = (ws as { id: string }).id;
+
+  // A target automation with a failed + finished run, and the digest automation.
+  const targetId = await store.createAutomation({
+    userId: "probe",
+    workspaceId,
+    name: "Nightly sync",
+    zapierWorkflowId: `probe:manual:${stamp}`,
+    source: "",
+    trigger: null,
+    enabled: false,
+    status: "disabled",
+  });
+  await store.recordRun({
+    automationId: targetId,
+    workspaceId,
+    status: "failed",
+    error: { message: "connection refused" },
+  });
+  await store.recordRun({ automationId: targetId, workspaceId, status: "finished" });
+
+  const digestId = await store.createAutomation({
+    userId: "probe",
+    workspaceId,
+    name: "Morning digest",
+    zapierWorkflowId: `foreman:digest:${stamp}`,
+    source: "",
+    trigger: { schedule: { cron: "* * * * *" }, digest: true },
+    enabled: true,
+    status: "active",
+  });
+
+  // Imperative schedule → daily-digest workflow (what registerAutomationSchedule does).
+  const schedules = await mastra.getStorage()?.getStore("schedules");
+  if (!schedules) throw new Error("schedules store unavailable");
+  const now = Date.now();
+  await schedules.createSchedule({
+    id: `foreman-auto-${digestId}`,
+    target: {
+      type: "workflow",
+      workflowId: "daily-digest",
+      inputData: { workspaceId, automationId: digestId },
+    },
+    cron: "* * * * *",
+    status: "active",
+    nextFireAt: computeNextFireAt("* * * * *"),
+    createdAt: now,
+    updatedAt: now,
+  });
+  console.log("registered schedule; waiting for a fire…");
+
+  let digest: { kind?: string; headline?: string; totals?: Record<string, number> } | null = null;
+  for (let i = 0; i < 27; i++) {
+    await new Promise((r) => setTimeout(r, 5000));
+    digest = (await getLatestDigest(workspaceId)) as typeof digest;
+    if (digest?.kind === "automation_digest") break;
+  }
+
+  const ok =
+    digest?.kind === "automation_digest" &&
+    (digest.totals?.failed ?? 0) >= 1 &&
+    (digest.totals?.finished ?? 0) >= 1;
+
+  console.log("\n=== VERDICT ===");
+  console.log(`digest headline : ${digest?.headline ?? "(none)"}`);
+  console.log(`totals f/ok     : ${digest?.totals?.failed}/${digest?.totals?.finished}`);
+  console.log(
+    `→ native digest : ${ok ? "PROVEN end-to-end (schedule → workflow → store)" : "NOT PROVEN"}`,
+  );
+
+  // Cleanup.
+  await schedules.deleteSchedule(`foreman-auto-${digestId}`);
+  await supabase.from("automation_run").delete().eq("workspace_id", workspaceId);
+  await supabase.from("automation").delete().eq("workspace_id", workspaceId);
+  await supabase.from("workspaces").delete().eq("id", workspaceId);
+  await mastra.stopWorkers();
+  process.exit(ok ? 0 : 1);
+}
+
+main().catch((e) => {
+  console.error("probe failed:", e);
+  process.exit(1);
+});
diff --git a/packages/agents/scripts/durable-approval-probe.ts b/packages/agents/scripts/durable-approval-probe.ts
new file mode 100644
index 00000000..c369fff3
--- /dev/null
+++ b/packages/agents/scripts/durable-approval-probe.ts
@@ -0,0 +1,103 @@
+/**
+ * foreman-zfnj end-to-end proof. Composes an approval-gated durable with the
+ * SHIPPED authoring helper (`humanApprovalGate`), runs it, then approves it via the
+ * SHIPPED lib chain the /automations route uses — `resolveCallbackUrl` (reads the
+ * URL the durable self-reported) + `postCallback` (POSTs the decision) — and confirms
+ * the run resumes to finished carrying that decision. Proves the whole zfnj mechanism
+ * against real Zapier (the workspace/route wrapper is covered by unit tests).
+ *
+ * Run (packages/agents, client-creds via Infisical):
+ *   infisical run --projectId <id> --env dev --path=/foreman --silent -- \
+ *     npx tsx scripts/durable-approval-probe.ts
+ */
+import { createZapierSdk } from "@zapier/zapier-sdk/experimental";
+import {
+  getDurableRunStatus,
+  humanApprovalGate,
+  postCallback,
+  resolveCallbackUrl,
+  runAutomationOnce,
+} from "../src/lib/durable";
+
+const sdk = createZapierSdk(
+  process.env.ZAPIER_CLIENT_ID && process.env.ZAPIER_CLIENT_SECRET
+    ? {
+        credentials: {
+          clientId: process.env.ZAPIER_CLIENT_ID,
+          clientSecret: process.env.ZAPIER_CLIENT_SECRET,
+        },
+      }
+    : undefined,
+) as ReturnType<typeof createZapierSdk> & {
+  getDurableRun: (o: {
+    run: string;
+  }) => Promise<{ data: { execution: { status?: string } | null } }>;
+};
+
+// Approval durable authored with the SHIPPED gate helper (self-reports its URL).
+const SOURCE = `import { defineDurable } from "@zapier/zapier-durable";
+
+const workflow = defineDurable("foreman-approval-probe", async (ctx, input) => {
+  await ctx.step("prep", async () => ({ ready: true }));
+${humanApprovalGate("approve")}
+  return { decision: approveDecision };
+});
+
+export default workflow;
+`;
+
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+async function main() {
+  console.log("running an approval-gated durable (humanApprovalGate)…");
+  const { runId } = await runAutomationOnce({ sdk, source: SOURCE, input: { req: "ship it" } });
+  console.log(`run ${runId}`);
+
+  // Wait until it's parked waiting on the gate.
+  for (let i = 0; i < 15; i++) {
+    await sleep(3000);
+    const execStatus = (await sdk.getDurableRun({ run: runId })).data.execution?.status;
+    console.log(`  [t+${(i + 1) * 3}s] exec=${execStatus ?? "—"}`);
+    if (execStatus === "waiting") break;
+  }
+
+  // Exactly what respondToCallbackForUser does server-side:
+  const cb = await resolveCallbackUrl(sdk, runId, "approve");
+  console.log(`\nresolveCallbackUrl → ${cb ? `${cb.name} @ ${cb.url}` : "NULL"}`);
+  if (!cb) {
+    console.log("✗ FAIL — could not resolve the callback URL (authoring convention broken)");
+    process.exit(1);
+  }
+
+  const res = await postCallback(cb.url, { approved: true, by: "zfnj-probe" });
+  console.log(`postCallback → HTTP ${res.status} ok=${res.ok}`);
+
+  let final: { status: string; output: unknown } | undefined;
+  for (let i = 0; i < 15; i++) {
+    await sleep(3000);
+    const s = await getDurableRunStatus(sdk, runId);
+    console.log(`  [resume t+${(i + 1) * 3}s] status=${s.status}`);
+    if (["finished", "failed", "cancelled"].includes(s.status)) {
+      final = { status: s.status, output: s.output };
+      break;
+    }
+  }
+
+  console.log("\n=== VERDICT ===");
+  console.log("resolved URL     :", cb ? "YES ✓" : "NO ✗");
+  console.log("POST accepted    :", res.ok ? `YES (${res.status})` : `NO (${res.status})`);
+  console.log(
+    "resumed+finished :",
+    final?.status === "finished" ? "YES ✓" : (final?.status ?? "timed out"),
+  );
+  console.log("final output     :", JSON.stringify(final?.output ?? null));
+  console.log(
+    "→ zfnj mechanism :",
+    cb && res.ok && final?.status === "finished" ? "PROVEN end-to-end" : "INCOMPLETE — see above",
+  );
+}
+
+main().catch((e) => {
+  console.error("probe failed:", e);
+  process.exit(1);
+});
diff --git a/packages/agents/scripts/durable-callback-probe.ts b/packages/agents/scripts/durable-callback-probe.ts
new file mode 100644
index 00000000..0b3f97fc
--- /dev/null
+++ b/packages/agents/scripts/durable-callback-probe.ts
@@ -0,0 +1,114 @@
+/**
+ * foreman-e1ob / zfnj / rm8z — does getDurableRun expose the ctx.createCallback URL?
+ *
+ * Runs a durable that pauses on a human-approval callback, then inspects the RAW
+ * getDurableRun.execution FROM OUTSIDE to answer, with evidence, the exact Zapier
+ * question: is the callback URL available to Foreman —
+ *   (a) natively on the callback operation, or
+ *   (b) only if the durable itself reports it via a step output (the zfnj option)?
+ * Also verifies rm8z's waiting-detection (getDurableRunStatus.detail.waiting) on
+ * real data, then cancels the run to clean up (also exercises y4kc live).
+ *
+ * Run (from packages/agents, client-creds via Infisical):
+ *   infisical run --projectId <id> --env dev --path=/foreman --silent -- \
+ *     npx tsx scripts/durable-callback-probe.ts
+ */
+import { createZapierSdk } from "@zapier/zapier-sdk/experimental";
+import { cancelDurableRun, getDurableRunStatus, runAutomationOnce } from "../src/lib/durable";
+
+const sdk = createZapierSdk(
+  process.env.ZAPIER_CLIENT_ID && process.env.ZAPIER_CLIENT_SECRET
+    ? {
+        credentials: {
+          clientId: process.env.ZAPIER_CLIENT_ID,
+          clientSecret: process.env.ZAPIER_CLIENT_SECRET,
+        },
+      }
+    : undefined,
+) as ReturnType<typeof createZapierSdk> & {
+  getDurableRun: (o: { run: string }) => Promise<{ data: { status: string; execution: unknown } }>;
+  getProfile: () => Promise<{ data: { email?: string; id?: string } }>;
+};
+
+const CALLBACK_SOURCE = `import { defineDurable } from "@zapier/zapier-durable";
+
+const workflow = defineDurable("foreman-cb-probe", async (ctx, input) => {
+  await ctx.step("prep", async () => ({ ready: true }));
+  const [approval, callbackUrl] = await ctx.createCallback("approve");
+  // Report the URL the durable itself received — this is the zfnj "durable reports
+  // its own callback URL" option; if it flows through getDurableRun we can use it.
+  await ctx.step("report-url", async () => ({ callbackUrl }));
+  const payload = await approval;
+  return { approved: payload };
+});
+
+export default workflow;
+`;
+
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+async function main() {
+  try {
+    const p = await sdk.getProfile();
+    console.log("auth:", p.data?.email ?? p.data?.id ?? "?");
+  } catch (e) {
+    console.log("auth failed:", (e as Error).message);
+    process.exit(1);
+  }
+
+  console.log("\nrunning a durable that pauses on ctx.createCallback…");
+  const { runId, status } = await runAutomationOnce({
+    sdk,
+    source: CALLBACK_SOURCE,
+    input: { req: "approve me" },
+  });
+  console.log(`run ${runId} → ${status}`);
+
+  let exec: Record<string, unknown> | undefined;
+  for (let i = 0; i < 15; i++) {
+    await sleep(3000);
+    const data = (await sdk.getDurableRun({ run: runId })).data;
+    exec = (data.execution ?? undefined) as Record<string, unknown> | undefined;
+    const ops = (exec?.operations as Array<Record<string, unknown>>) ?? [];
+    console.log(
+      `  [t+${(i + 1) * 3}s] top=${data.status} exec=${exec?.status ?? "—"} ops=${ops.length}`,
+    );
+    if (exec?.status === "waiting" || ops.some((o) => o.callback_token)) break;
+  }
+
+  console.log("\n=== RAW execution dump (first 3.5k) ===");
+  console.log(JSON.stringify(exec, null, 2)?.slice(0, 3500));
+
+  const distilled = await getDurableRunStatus(sdk, runId);
+  console.log("\n=== Foreman getDurableRunStatus.detail (rm8z) ===");
+  console.log(JSON.stringify(distilled.detail, null, 2));
+
+  const dump = JSON.stringify(exec ?? {});
+  const ops = (exec?.operations as Array<Record<string, unknown>>) ?? [];
+  const cbOp = ops.find((o) => o.callback_token);
+  const urlMatch = dump.match(/https?:\/\/[^"\\]+/);
+  console.log("\n=== VERDICT ===");
+  console.log("exec.status            :", exec?.status ?? "—");
+  console.log("callback op present    :", cbOp ? "YES" : "no");
+  console.log("callback_token         :", cbOp?.callback_token ?? "—");
+  console.log("callback op URL field  :", cbOp?.callback_url ?? cbOp?.url ?? "(none on the op)");
+  console.log("ANY http(s) URL in exec:", urlMatch ? `YES → ${urlMatch[0]}` : "NO");
+  console.log(
+    "→ interpretation       :",
+    urlMatch
+      ? "URL IS reachable from outside (natively or via the report-url step) — zfnj is buildable"
+      : "URL is NOT exposed by getDurableRun — need the durable to report it or a Zapier resume endpoint",
+  );
+
+  try {
+    const s = await cancelDurableRun(sdk, runId);
+    console.log(`\ncleanup — cancelDurableRun → ${s}`);
+  } catch (e) {
+    console.log("cleanup cancel failed:", (e as Error).message);
+  }
+}
+
+main().catch((e) => {
+  console.error("probe failed:", e);
+  process.exit(1);
+});
diff --git a/packages/agents/scripts/durable-callback-resume-probe.ts b/packages/agents/scripts/durable-callback-resume-probe.ts
new file mode 100644
index 00000000..e980d3a1
--- /dev/null
+++ b/packages/agents/scripts/durable-callback-resume-probe.ts
@@ -0,0 +1,125 @@
+/**
+ * foreman-e1ob / zfnj — does POSTing the createCallback URL actually RESUME the run?
+ *
+ * Completes the callback loop the exposure probe started: run a durable that pauses
+ * on ctx.createCallback, read the URL it self-reports via a step, POST an approval
+ * payload to it, and confirm the run leaves "waiting" and finishes with that payload.
+ * This is the last unknown for zfnj — visible ≠ resumable.
+ *
+ * Run (packages/agents, client-creds via Infisical):
+ *   infisical run --projectId <id> --env dev --path=/foreman --silent -- \
+ *     npx tsx scripts/durable-callback-resume-probe.ts
+ */
+import { createZapierSdk } from "@zapier/zapier-sdk/experimental";
+import { cancelDurableRun, runAutomationOnce } from "../src/lib/durable";
+
+const sdk = createZapierSdk(
+  process.env.ZAPIER_CLIENT_ID && process.env.ZAPIER_CLIENT_SECRET
+    ? {
+        credentials: {
+          clientId: process.env.ZAPIER_CLIENT_ID,
+          clientSecret: process.env.ZAPIER_CLIENT_SECRET,
+        },
+      }
+    : undefined,
+) as ReturnType<typeof createZapierSdk> & {
+  getDurableRun: (o: {
+    run: string;
+  }) => Promise<{ data: { status: string; output: unknown; execution: unknown } }>;
+};
+
+const CALLBACK_SOURCE = `import { defineDurable } from "@zapier/zapier-durable";
+
+const workflow = defineDurable("foreman-cb-resume", async (ctx, input) => {
+  const [approval, callbackUrl] = await ctx.createCallback("approve");
+  await ctx.step("report-url", async () => ({ callbackUrl }));
+  const payload = await approval;
+  return { approved: payload };
+});
+
+export default workflow;
+`;
+
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+function findCallbackUrl(exec: unknown): string | undefined {
+  const ops = ((exec as { operations?: Array<Record<string, unknown>> })?.operations ??
+    []) as Array<Record<string, unknown>>;
+  for (const op of ops) {
+    const res = op.result as { callbackUrl?: string } | undefined;
+    if (res?.callbackUrl) return res.callbackUrl;
+  }
+  return undefined;
+}
+
+async function main() {
+  console.log("running a durable that pauses on ctx.createCallback…");
+  const { runId } = await runAutomationOnce({
+    sdk,
+    source: CALLBACK_SOURCE,
+    input: { req: "please approve" },
+  });
+  console.log(`run ${runId}`);
+
+  // Wait until it's parked in "waiting" and has reported its URL.
+  let url: string | undefined;
+  for (let i = 0; i < 15; i++) {
+    await sleep(3000);
+    const { execution, status } = (await sdk.getDurableRun({ run: runId })).data;
+    url = findCallbackUrl(execution);
+    const execStatus = (execution as { status?: string })?.status;
+    console.log(
+      `  [t+${(i + 1) * 3}s] top=${status} exec=${execStatus ?? "—"} url=${url ? "got" : "—"}`,
+    );
+    if (url && execStatus === "waiting") break;
+  }
+  if (!url) {
+    console.log("never captured a callback URL — cancelling.");
+    await cancelDurableRun(sdk, runId).catch(() => {});
+    process.exit(1);
+  }
+
+  console.log(`\nPOSTing approval to the callback URL…\n  ${url}`);
+  const body = { decision: "approved", by: "foreman-probe" };
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  console.log(`  → HTTP ${res.status} ${res.statusText}`);
+  const text = await res.text().catch(() => "");
+  if (text) console.log(`  body: ${text.slice(0, 300)}`);
+
+  // Did it resume?
+  let final: { status: string; output: unknown } | undefined;
+  for (let i = 0; i < 15; i++) {
+    await sleep(3000);
+    const d = (await sdk.getDurableRun({ run: runId })).data;
+    console.log(`  [resume t+${(i + 1) * 3}s] status=${d.status}`);
+    if (d.status === "finished" || d.status === "failed") {
+      final = { status: d.status, output: d.output };
+      break;
+    }
+  }
+
+  console.log("\n=== VERDICT ===");
+  console.log("POST accepted        :", res.ok ? `YES (${res.status})` : `NO (${res.status})`);
+  console.log(
+    "run resumed+finished :",
+    final?.status === "finished" ? "YES ✓" : (final?.status ?? "still waiting / timed out"),
+  );
+  console.log("final output         :", JSON.stringify(final?.output ?? null));
+  console.log(
+    "→ zfnj              :",
+    res.ok && final?.status === "finished"
+      ? "PROVEN buildable via durable-self-reported URL + plain POST"
+      : "POST/resume did NOT complete — see status above",
+  );
+
+  if (!final) await cancelDurableRun(sdk, runId).catch(() => {});
+}
+
+main().catch((e) => {
+  console.error("probe failed:", e);
+  process.exit(1);
+});
diff --git a/packages/agents/scripts/durable-cleanup-probes.ts b/packages/agents/scripts/durable-cleanup-probes.ts
new file mode 100644
index 00000000..621a3b0c
--- /dev/null
+++ b/packages/agents/scripts/durable-cleanup-probes.ts
@@ -0,0 +1,47 @@
+/**
+ * Delete leftover probe/smoke durable workflows from the account (hygiene for the
+ * durable-*-probe scripts, which mostly self-clean but can leave a workflow behind
+ * on a hard failure). Deletes any workflow whose name matches /probe|smoke|access/i.
+ *
+ * Run (packages/agents, client-creds via Infisical):
+ *   infisical run --projectId <id> --env dev --path=/foreman --silent -- \
+ *     npx tsx scripts/durable-cleanup-probes.ts
+ */
+import { createZapierSdk } from "@zapier/zapier-sdk/experimental";
+import { deleteAutomation } from "../src/lib/durable";
+
+const sdk = createZapierSdk(
+  process.env.ZAPIER_CLIENT_ID && process.env.ZAPIER_CLIENT_SECRET
+    ? {
+        credentials: {
+          clientId: process.env.ZAPIER_CLIENT_ID,
+          clientSecret: process.env.ZAPIER_CLIENT_SECRET,
+        },
+      }
+    : undefined,
+);
+
+async function main() {
+  const { data } = await sdk.listWorkflows();
+  console.log(`${data.length} workflow(s) on the account`);
+  let deleted = 0;
+  for (const w of data) {
+    if (/probe|smoke|access/i.test(w.name)) {
+      try {
+        await deleteAutomation(sdk, w.id);
+        console.log(`  deleted ${w.id}  "${w.name}"`);
+        deleted++;
+      } catch (e) {
+        console.log(`  FAILED to delete ${w.id} "${w.name}": ${(e as Error).message}`);
+      }
+    } else {
+      console.log(`  kept    ${w.id}  "${w.name}"`);
+    }
+  }
+  console.log(`\ndeleted ${deleted} probe workflow(s)`);
+}
+
+main().catch((e) => {
+  console.error("cleanup failed:", e);
+  process.exit(1);
+});
diff --git a/packages/agents/scripts/durable-loop-smoke.ts b/packages/agents/scripts/durable-loop-smoke.ts
new file mode 100644
index 00000000..7f20fc36
--- /dev/null
+++ b/packages/agents/scripts/durable-loop-smoke.ts
@@ -0,0 +1,155 @@
+/**
+ * FULL connected-loop smoke test (foreman-hnbx). Proves the entire
+ * event → inbox → worker → durable chain against REAL Zapier + REAL local Postgres
+ * + a REAL webhook event:
+ *
+ *   deploy durable → persist automation (webhook inbox trigger) → worker cycle 1
+ *   (arm inbox) → POST event to the catch URL → worker cycle 2 (lease → claim
+ *   [real-Postgres dedup] → fire durable → record automation_run → ack) → verify
+ *   the run row → clean up everything.
+ *
+ * Run:   cd packages/agents && npx tsx --env-file=.env.local scripts/durable-loop-smoke.ts
+ * Needs: local Supabase (SUPABASE_URL + SUPABASE_SERVICE_ROLE_KEY in .env.local)
+ *        and a Zapier CLI login. Uses a private no-side-effect echo durable; the
+ *        automation has workspace_id=null (so trigger_inbox_id persistence — gated
+ *        on a workspace — isn't exercised; the inbox is re-ensured each cycle).
+ */
+import { createZapierSdk } from "@zapier/zapier-sdk/experimental";
+import * as store from "../src/lib/automations/store";
+import { reconcilePendingRuns, runInboxCycleForAutomation } from "../src/lib/automations/worker";
+import { getSupabase } from "../src/lib/db";
+import { deleteAutomation } from "../src/lib/durable";
+
+const sdk = createZapierSdk();
+// Numeric catch-URL account segment — find it in your Zapier catch-hook URL
+// (hooks.zapier.com/hooks/catch/<ACCOUNT_ID>/<code>/). Set via env.
+const ACCOUNT_ID = process.env.ZAPIER_ACCOUNT_ID ?? "";
+if (!ACCOUNT_ID) throw new Error("Set ZAPIER_ACCOUNT_ID to run this smoke test.");
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+const ECHO_SOURCE = `import { defineDurable } from "@zapier/zapier-durable";
+function normalizeInput(raw) {
+  if (typeof raw === "string") { try { return JSON.parse(raw); } catch { return raw; } }
+  return raw;
+}
+const workflow = defineDurable("foreman-loop", async (ctx, input) => {
+  return await ctx.step("echo", async () => ({ ok: true, echo: normalizeInput(input) }));
+});
+export default workflow;
+`;
+
+async function main() {
+  const code = `fmnloop${Math.floor(Date.now() / 1000)}`;
+  const catchUrl = `https://hooks.zapier.com/hooks/catch/${ACCOUNT_ID}/${code}/`;
+
+  let workflowId: string | undefined;
+  let automationId: string | undefined;
+  let inboxId: string | null = null;
+
+  try {
+    // 1. Deploy a manual durable (live).
+    const { deployAutomation } = await import("../src/lib/durable");
+    const dep = await deployAutomation({
+      sdk,
+      name: "Foreman Loop Smoke",
+      description: "connected-loop smoke — safe to delete",
+      source: ECHO_SOURCE,
+      enabled: true,
+      isPrivate: true,
+    });
+    workflowId = dep.workflowId;
+    console.log(`1. deployed durable ${workflowId} (enabled=${dep.enabled})`);
+
+    // 2. Persist the automation with a webhook inbox trigger (real Postgres).
+    automationId = await store.createAutomation({
+      userId: "loop-smoke-user",
+      workspaceId: null,
+      name: "Foreman Loop Smoke",
+      source: ECHO_SOURCE,
+      zapierWorkflowId: workflowId,
+      zapierVersionId: dep.versionId,
+      trigger: { app: "webhook", action: "hook_v2", inputs: { _zap_static_hook_code: code } },
+      enabled: true,
+      status: "active",
+      editorUrl: dep.editorUrl,
+      triggerUrl: dep.triggerUrl,
+    });
+    console.log(`2. persisted automation ${automationId}`);
+
+    const row = await store.getAutomationByZapierWorkflowId(workflowId);
+    if (!row) throw new Error("automation row not found after insert");
+
+    // 3. Worker cycle 1 — arm the inbox (idempotent ensureInbox).
+    const c1 = await runInboxCycleForAutomation({ sdk, automation: row });
+    inboxId = c1.inboxId;
+    console.log(`3. worker cycle 1 (arm): inbox=${c1.inboxId} status=${c1.inboxStatus}`);
+
+    // 4. POST a real event to the catch URL.
+    console.log(`4. POST event → ${catchUrl}`);
+    const res = await fetch(catchUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ source: "loop-smoke", code }),
+    });
+    console.log(`   POST → ${res.status}`);
+
+    // 5. Worker cycle 2 — poll until the message lands, then lease→claim→fire→record→ack.
+    let fired = false;
+    for (let i = 1; i <= 10; i++) {
+      await sleep(4000);
+      const fresh = await store.getAutomationByZapierWorkflowId(workflowId);
+      const c2 = await runInboxCycleForAutomation({ sdk, automation: fresh ?? row });
+      console.log(
+        `5. worker cycle 2 attempt ${i} (${i * 4}s): processed=${c2.processed} skipped=${c2.skipped} failed=${c2.failed}`,
+      );
+      if (c2.processed > 0 || c2.skipped > 0 || c2.failed > 0) {
+        fired = true;
+        break;
+      }
+    }
+
+    // 6. Reconcile — advance the run from 'started' to its real terminal status.
+    let terminal = false;
+    for (let i = 1; i <= 12 && !terminal; i++) {
+      await sleep(4000);
+      const rec = await reconcilePendingRuns();
+      const { data: rows } = await getSupabase()
+        .from("automation_run")
+        .select("status,durable_run_id")
+        .eq("automation_id", automationId);
+      const st = rows?.[0]?.status;
+      console.log(
+        `6. reconcile attempt ${i} (${i * 4}s): updated=${rec.updated} run.status=${st} durable_run_id=${rows?.[0]?.durable_run_id ?? "—"}`,
+      );
+      if (st === "finished" || st === "failed") terminal = true;
+    }
+
+    // 7. Verify the final automation_run row (real Postgres).
+    const { data: runs } = await getSupabase()
+      .from("automation_run")
+      .select("*")
+      .eq("automation_id", automationId);
+    console.log(`7. automation_run rows: ${runs?.length ?? 0}`);
+    if (runs?.length) console.log(JSON.stringify(runs[0], null, 2));
+
+    const finished = runs?.[0]?.status === "finished";
+    console.log(
+      `\n${fired && finished ? "✓✓ FULL LOOP PASS (run reached 'finished')" : "✗ LOOP INCOMPLETE"} — event → inbox → worker → durable → reconciled, in Postgres`,
+    );
+  } catch (e) {
+    console.error("LOOP ERROR:", (e as Error).message);
+  } finally {
+    console.log("\ncleanup…");
+    if (inboxId) await sdk.deleteTriggerInbox({ inbox: inboxId }).catch(() => {});
+    if (workflowId) await deleteAutomation(sdk, workflowId).catch(() => {});
+    if (automationId) {
+      await getSupabase().from("automation").delete().eq("id", automationId);
+      console.log(`  removed automation ${automationId} (+ runs cascade), workflow, inbox`);
+    }
+  }
+}
+
+main().catch((e) => {
+  console.error(e);
+  process.exit(1);
+});
diff --git a/packages/agents/scripts/durable-pkce-probe.ts b/packages/agents/scripts/durable-pkce-probe.ts
index 7a7570e3..049d0507 100644
--- a/packages/agents/scripts/durable-pkce-probe.ts
+++ b/packages/agents/scripts/durable-pkce-probe.ts
@@ -21,9 +21,14 @@
  *   npx tsx scripts/durable-pkce-probe.ts
  */
 import { createHash, randomBytes } from "node:crypto";
+import { writeFileSync } from "node:fs";
 import { createServer } from "node:http";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
 import { createZapierSdk } from "@zapier/zapier-sdk/experimental";
 
+const URL_FILE = path.join(path.dirname(fileURLToPath(import.meta.url)), ".pkce-url.txt");
+
 // --- Mirrors src/lib/zapier/connect.ts exactly ---
 const ZAPIER_AUTHORIZE_URL = "https://zapier.com/oauth/authorize/";
 const ZAPIER_TOKEN_URL = "https://zapier.com/oauth/token/";
@@ -98,6 +103,7 @@ async function mintUserJwt(): Promise<string> {
     code_challenge_method: "S256",
   });
   const authorizeUrl = `${ZAPIER_AUTHORIZE_URL}?${params.toString()}`;
+  writeFileSync(URL_FILE, authorizeUrl, "utf8"); // so the runner can hand it over immediately
 
   console.log("\n========================================================");
   console.log("ACTION REQUIRED — open this URL and authorize:\n");
@@ -127,65 +133,60 @@ async function mintUserJwt(): Promise<string> {
   return data.access_token;
 }
 
-// Best-effort hello-world against @zapier/zapier-durable's defineDurable shape.
-// (Contract is undocumented — this is a probe; the runtime error teaches us the real shape.)
-const HELLO_SOURCE = `import { defineDurable } from "@zapier/zapier-durable";
-import { z } from "zod";
-
-export default defineDurable({
-  name: "hello-world",
-  inputSchema: z.object({ name: z.string().optional() }),
-  run: async (ctx, input) => {
-    const greeting = await ctx.step("greet", async () => \`Hello, \${input?.name ?? "world"}!\`);
-    return { greeting };
-  },
+// Echo durable in the CURRENT @zapier/zapier-durable contract (matches durable-smoke.ts),
+// run via Foreman's own lib/durable (aged deps + camelCase) so this is apples-to-apples
+// with the client-creds smoke — a passing auth yields a real finished run.
+const ECHO_SOURCE = `import { defineDurable } from "@zapier/zapier-durable";
+
+const workflow = defineDurable("foreman-pkce-probe", async (ctx, input) => {
+  return await ctx.step("echo", async () => ({ ok: true, echo: input }));
 });
+
+export default workflow;
 `;
 
 async function main() {
   const token = await mintUserJwt();
-  const sdk = createZapierSdk({ credentials: token }) as any;
+  const sdk = createZapierSdk({ credentials: token });
 
   try {
-    const { data: profile } = await sdk.getProfile();
+    const { data: profile } = (await sdk.getProfile()) as { data: { email?: string; id?: string } };
     console.log(`profile OK: ${profile?.email ?? profile?.id ?? "?"}`);
   } catch (e) {
     console.log(`profile probe failed: ${(e as Error).message}`);
   }
 
-  console.log("\nCalling runDurable with the userJwt…");
-  let run: any;
+  // Use Foreman's PRODUCTION durable code path with this per-user token.
+  const { runAutomationOnce, getDurableRunStatus } = await import("../src/lib/durable");
+
+  console.log("\nrunDurable via the per-user PKCE token (Foreman's production path)…");
+  let runId: string | undefined;
   try {
-    const { data } = await sdk.runDurable({
-      source_files: { "index.ts": HELLO_SOURCE },
-      input: { name: "Foreman" },
-      private: true,
-    });
-    run = data;
-    console.log(`✓ AUTH PASSED — runDurable accepted. run id=${data.id} status=${data.status}`);
-  } catch (e: any) {
-    const msg = String(e?.message ?? e);
-    console.log(`runDurable threw: ${msg}`);
-    if (/userJwt|security scheme|authenticate|unauthor/i.test(msg)) {
-      console.log("→ STILL AN AUTH FAILURE: the userJwt did NOT satisfy the durable scheme.");
+    const once = await runAutomationOnce({ sdk, source: ECHO_SOURCE, input: { hello: "pkce" } });
+    runId = once.runId;
+    console.log(`✓ AUTH PASSED — runDurable accepted. run id=${once.runId} status=${once.status}`);
+  } catch (e) {
+    const msg = String((e as Error)?.message ?? e);
+    console.log(`runDurable threw: ${msg.slice(0, 400)}`);
+    if (/userJwt|security scheme|authenticate|unauthor|403/i.test(msg)) {
+      console.log(
+        "→ ❌ STILL AN AUTH WALL for the per-user PKCE token — durable is NOT open on the production path.",
+      );
     } else {
-      console.log("→ AUTH PASSED (error is NOT auth-related — likely source_files contract).");
-    }
-    for (const k of ["status", "statusCode", "response", "body", "cause"]) {
-      if (e?.[k] !== undefined)
-        console.log(`  ${k}:`, JSON.stringify(e[k], null, 2).slice(0, 1500));
+      console.log("→ ✅ AUTH PASSED (error is NOT auth-related — a contract/validation error).");
     }
     return;
   }
 
-  console.log("\nPolling getDurableRun to terminal…");
+  console.log("\nPolling getDurableRunStatus to terminal…");
   for (let i = 0; i < 20; i++) {
     await sleep(3000);
-    const { data: cur } = await sdk.getDurableRun({ run: run.id });
-    console.log(`  status=${cur.status}`);
-    if (["finished", "failed", "cancelled"].includes(cur.status)) {
-      console.log("\nFINAL RUN STATE:");
-      console.log(JSON.stringify(cur, null, 2).slice(0, 4000));
+    const s = await getDurableRunStatus(sdk, runId);
+    console.log(`  status=${s.status}`);
+    if (["finished", "failed", "cancelled"].includes(s.status)) {
+      console.log(
+        `\n✅ PER-USER PKCE PATH WORKS — final=${s.status} output=${JSON.stringify(s.output)}`,
+      );
       return;
     }
   }
diff --git a/packages/agents/scripts/durable-smoke.ts b/packages/agents/scripts/durable-smoke.ts
new file mode 100644
index 00000000..87a7c5bb
--- /dev/null
+++ b/packages/agents/scripts/durable-smoke.ts
@@ -0,0 +1,170 @@
+/**
+ * Live smoke test for the durable rebuild (foreman-l7xq). Drives the REAL
+ * experimental Zapier SDK (CLI login) through Foreman's own lib/durable +
+ * lib/trigger-inbox code — the gap the mocked unit tests can't cover.
+ *
+ * Run:   cd packages/agents && npx tsx scripts/durable-smoke.ts
+ * Auth:  cached CLI login (~/.zapier-sdk/config.json). If it 401s, re-login with
+ *        `npx zapier-sdk login` and re-run.
+ *
+ * Creates a PRIVATE, no-connection echo durable (NO app side effects) and cleans
+ * up after itself. Tiers: (1) ephemeral runDurable, (2) deploy+trigger+poll+delete,
+ * (3) trigger-inbox reachability.
+ */
+import { createZapierSdk } from "@zapier/zapier-sdk/experimental";
+import {
+  deleteAutomation,
+  deployAutomation,
+  getDurableRunStatus,
+  getTriggerRunStatus,
+  runAutomationOnce,
+  triggerAutomation,
+} from "../src/lib/durable";
+import { ensureInbox, leaseMessages } from "../src/lib/trigger-inbox";
+
+// Prefer client-credentials (env, via `infisical run`) so this runs headless in
+// CI/probes; fall back to the cached CLI login (~/.zapier-sdk/config.json) locally.
+const sdk =
+  process.env.ZAPIER_CLIENT_ID && process.env.ZAPIER_CLIENT_SECRET
+    ? createZapierSdk({
+        credentials: {
+          clientId: process.env.ZAPIER_CLIENT_ID,
+          clientSecret: process.env.ZAPIER_CLIENT_SECRET,
+        },
+      })
+    : createZapierSdk();
+
+const ECHO_SOURCE = `import { defineDurable } from "@zapier/zapier-durable";
+
+function normalizeInput(raw) {
+  if (typeof raw === "string") {
+    try { return JSON.parse(raw); } catch { return raw; }
+  }
+  return raw;
+}
+
+const workflow = defineDurable("foreman-smoke", async (ctx, input) => {
+  return await ctx.step("echo", async () => ({ ok: true, echo: normalizeInput(input) }));
+});
+
+export default workflow;
+`;
+
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+async function pollDurable(runId: string, capMs = 120_000) {
+  const start = Date.now();
+  while (Date.now() - start < capMs) {
+    const s = await getDurableRunStatus(sdk, runId);
+    if (s.status === "finished" || s.status === "failed") return s;
+    await sleep(3000);
+  }
+  return { status: "timeout", output: null, error: null };
+}
+
+async function pollTrigger(triggerId: string, capMs = 120_000) {
+  const start = Date.now();
+  let last: Awaited<ReturnType<typeof getTriggerRunStatus>> | undefined;
+  while (Date.now() - start < capMs) {
+    last = await getTriggerRunStatus(sdk, triggerId);
+    if (last.durableRunId && (last.status === "finished" || last.status === "failed")) return last;
+    await sleep(3000);
+  }
+  return last ?? { status: "timeout", durableRunId: null, output: null, error: null };
+}
+
+async function main() {
+  // Step 0 — auth probe (also the baseline workflow count for the clean-up check).
+  let baseline = 0;
+  try {
+    const r = await sdk.listWorkflows();
+    baseline = r.data.length;
+    console.log(`✓ AUTH OK — ${baseline} existing workflow(s)`);
+  } catch (e) {
+    console.error(`✗ AUTH FAIL: ${(e as Error).message}`);
+    console.error("  Re-login:  npx zapier-sdk login   (then re-run)");
+    process.exit(1);
+  }
+
+  // Tier 1 — ephemeral runDurable (no saved workflow).
+  console.log("\n[Tier 1] ephemeral runDurable (echo)…");
+  try {
+    const once = await runAutomationOnce({ sdk, source: ECHO_SOURCE, input: { hello: "foreman" } });
+    console.log(`  run ${once.runId} → ${once.status}; polling…`);
+    const r1 = await pollDurable(once.runId);
+    console.log(`  → ${r1.status} ${r1.output ? `output=${JSON.stringify(r1.output)}` : ""}`);
+    console.log(`  ${r1.status === "finished" ? "✓ PASS" : "✗ FAIL"}`);
+  } catch (e) {
+    console.error(`  ✗ FAIL: ${(e as Error).message}`);
+  }
+
+  // Tier 2 — deploy → manual trigger → bridge to durable run → delete.
+  console.log("\n[Tier 2] deploy + manual trigger…");
+  let workflowId: string | undefined;
+  try {
+    const dep = await deployAutomation({
+      sdk,
+      name: "Foreman Smoke",
+      description: "live smoke test — safe to delete",
+      source: ECHO_SOURCE,
+      enabled: true,
+      isPrivate: true,
+    });
+    workflowId = dep.workflowId;
+    console.log(`  deployed ${dep.workflowId} (enabled=${dep.enabled}) ${dep.editorUrl}`);
+    const t = await triggerAutomation({
+      sdk,
+      workflowId: dep.workflowId,
+      input: { fired: "smoke" },
+    });
+    console.log(`  trigger ${t.triggerId}; bridging to run…`);
+    const r2 = await pollTrigger(t.triggerId);
+    console.log(`  → status=${r2.status} durableRunId=${r2.durableRunId ?? "—"}`);
+    console.log(`  ${r2.status === "finished" ? "✓ PASS" : "✗ FAIL"}`);
+  } catch (e) {
+    console.error(`  ✗ FAIL: ${(e as Error).message}`);
+  } finally {
+    if (workflowId) {
+      try {
+        await deleteAutomation(sdk, workflowId);
+        console.log(`  cleaned up ${workflowId}`);
+      } catch (e) {
+        console.error(`  cleanup failed for ${workflowId}: ${(e as Error).message}`);
+      }
+    }
+  }
+
+  // Tier 3 — trigger-inbox reachability (no connection → API reachable; the inbox
+  // can't fully subscribe without a connection, but the lib calls must hit the API).
+  console.log("\n[Tier 3] trigger-inbox reachability…");
+  try {
+    const inbox = await ensureInbox({
+      sdk,
+      key: "foreman-smoke-inbox",
+      app: "github",
+      action: "issue_v2",
+    });
+    console.log(`  ensureInbox → ${inbox.id} status=${inbox.status}`);
+    const lease = await leaseMessages({ sdk, inbox: inbox.id, leaseLimit: 1, leaseSeconds: 30 });
+    console.log(
+      `  lease → lease_id=${lease.lease_id ?? "—"} messages=${lease.results.length} inbox=${lease.inbox_attributes.status}`,
+    );
+    await sdk.deleteTriggerInbox({ inbox: inbox.id });
+    console.log(`  cleaned up inbox ${inbox.id}`);
+    console.log("  ✓ PASS (API reachable)");
+  } catch (e) {
+    console.error(`  ✗ inbox probe error: ${(e as Error).message}`);
+  }
+
+  const final = await sdk.listWorkflows();
+  const clean = final.data.length === baseline;
+  console.log(
+    `\n${clean ? "✓" : "⚠"} DONE — workflows now: ${final.data.length} (baseline ${baseline})`,
+  );
+  if (!clean) console.log("  ⚠ leftover workflow(s) — check https://zapier.com/durables-editor");
+}
+
+main().catch((e) => {
+  console.error("SMOKE FAILED:", e);
+  process.exit(1);
+});
diff --git a/packages/agents/scripts/durable-write-roundtrip.ts b/packages/agents/scripts/durable-write-roundtrip.ts
new file mode 100644
index 00000000..bfd0c111
--- /dev/null
+++ b/packages/agents/scripts/durable-write-roundtrip.ts
@@ -0,0 +1,75 @@
+/**
+ * Definitive WRITE round-trip (foreman-13mw): prove the durable/workflow DEFINE
+ * path works end-to-end now that next-gen-Zaps early access is granted.
+ *
+ * createWorkflow (only needs a name) -> capture id -> deleteWorkflow (cleanup).
+ * SELF-CLEANING: the created workflow is private (is_private) and is deleted right
+ * after, so it never lingers on the account. If delete fails it prints the id for
+ * manual cleanup. Read auth = client credentials.
+ *
+ * Run from packages/agents:
+ *   infisical run --projectId <id> --env dev --recursive --silent -- npx tsx scripts/durable-write-roundtrip.ts
+ */
+import { createZapierSdk } from "@zapier/zapier-sdk/experimental";
+
+async function main() {
+  const clientId = process.env.ZAPIER_CLIENT_ID;
+  const clientSecret = process.env.ZAPIER_CLIENT_SECRET;
+  if (!clientId || !clientSecret) {
+    console.error("ZAPIER_CLIENT_ID / ZAPIER_CLIENT_SECRET not set — run via infisical run.");
+    process.exit(1);
+  }
+  const sdk = createZapierSdk({ credentials: { clientId, clientSecret } }) as any;
+
+  try {
+    const { data } = await sdk.getProfile();
+    console.log(`auth: ${data?.email ?? data?.id ?? "?"}`);
+  } catch (e: any) {
+    console.log(`auth: getProfile failed -> ${e?.message ?? e}`);
+  }
+
+  const name = `foreman-access-probe-${Date.now()}`;
+  let createdId: string | undefined;
+  let created = false;
+
+  console.log(`\ncreateWorkflow({ name: "${name}", is_private: true }) ...`);
+  try {
+    const { data } = await sdk.createWorkflow({ name, is_private: true });
+    createdId = data?.id;
+    created = true;
+    console.log(
+      `  -> CREATED  id=${data?.id}  enabled=${data?.enabled}  is_private=${data?.is_private}`,
+    );
+    if (data?.trigger_url) console.log(`     trigger_url=${data.trigger_url}`);
+  } catch (e: any) {
+    const code = e?.statusCode ?? e?.status;
+    console.log(
+      `  -> createWorkflow FAILED (${code ?? "?"}): ${String(e?.message ?? e).slice(0, 180)}`,
+    );
+  }
+
+  if (createdId) {
+    try {
+      await sdk.deleteWorkflow({ workflow: createdId });
+      console.log(`deleteWorkflow({ workflow: "${createdId}" }) -> DELETED (cleaned up)`);
+    } catch (e: any) {
+      console.log(
+        `deleteWorkflow FAILED for ${createdId}: ${String(e?.message ?? e).slice(0, 180)}`,
+      );
+      console.log(`  MANUAL CLEANUP NEEDED: workflow ${createdId}`);
+    }
+  }
+
+  console.log(
+    `\nVERDICT: ${
+      created
+        ? "workflow DEFINE works end-to-end — createWorkflow succeeded, cleanup attempted."
+        : "create did NOT succeed — see error above."
+    }`,
+  );
+}
+
+main().catch((e) => {
+  console.error("FAILED:", e?.message ?? e);
+  process.exit(1);
+});
diff --git a/packages/agents/scripts/knowledge-e2e-probe.ts b/packages/agents/scripts/knowledge-e2e-probe.ts
new file mode 100644
index 00000000..38a19d66
--- /dev/null
+++ b/packages/agents/scripts/knowledge-e2e-probe.ts
@@ -0,0 +1,81 @@
+/**
+ * foreman-aqjx E2E: prove per-workspace knowledge search works against REAL
+ * Postgres and that indexes are ISOLATED per tenant (the whole security model).
+ * Local DB only — run with .env.local, NOT under `infisical run` (which injects
+ * cloud DB creds that override the local ones).
+ *
+ *   npx tsx --env-file=.env.local scripts/knowledge-e2e-probe.ts
+ *
+ * Indexes a distinct doc into two tenant indexes, then searches each with a
+ * freshly-constructed (non-init) Workspace: tenant A must find its own doc, and
+ * tenant B must NOT see A's doc (different physical index = the tenant boundary).
+ */
+import { getKnowledgeVector, knowledgeIndexName } from "../src/lib/knowledge/vector";
+import { buildTenantKnowledgeWorkspace, indexSharedDoc } from "../src/mastra/agents/workspace";
+
+function mentionsPricing(
+  hits: Array<{ content?: string; metadata?: Record<string, unknown> }>,
+): boolean {
+  return hits.some(
+    (h) => (h.content ?? "").includes("Pro plan") || h.metadata?.path === "documents/pricing.md",
+  );
+}
+
+async function main() {
+  if (!process.env.DATABASE_URL) throw new Error("DATABASE_URL missing (need .env.local)");
+  const stamp = Math.floor(Number(process.env.PROBE_STAMP) || 1);
+  const tenantA = `probe-a-${stamp}`;
+  const tenantB = `probe-b-${stamp}`;
+
+  // Distinct topics so we can tell which index a hit came from.
+  await indexSharedDoc({
+    tenantKey: tenantA,
+    path: "documents/pricing.md",
+    content:
+      "Acme pricing: the Pro plan is $49 per seat per month, with an annual billing discount.",
+    title: "Pricing",
+  });
+  await indexSharedDoc({
+    tenantKey: tenantB,
+    path: "documents/onboarding.md",
+    content: "New hire onboarding: set up the laptop, VPN, and building badge on day one.",
+    title: "Onboarding",
+  });
+
+  const query = "how much does the pro plan cost";
+  const aHits = await buildTenantKnowledgeWorkspace(tenantA).search(query, {
+    mode: "vector",
+    topK: 5,
+  });
+  const bHits = await buildTenantKnowledgeWorkspace(tenantB).search(query, {
+    mode: "vector",
+    topK: 5,
+  });
+
+  const aFound = aHits.length > 0 && mentionsPricing(aHits);
+  const bIsolated = !mentionsPricing(bHits);
+
+  console.log("\n=== VERDICT ===");
+  console.log(
+    `tenant A finds its own pricing doc : ${aFound ? "YES" : "NO"} (${aHits.length} hits)`,
+  );
+  console.log(
+    `tenant B isolated from A's doc     : ${bIsolated ? "YES" : "NO"} (${bHits.length} hits)`,
+  );
+  const ok = aFound && bIsolated;
+  console.log(
+    `→ per-workspace knowledge search   : ${ok ? "PROVEN (index + non-init search + isolation)" : "NOT PROVEN"}`,
+  );
+
+  // Cleanup: drop both probe indexes.
+  const vector = getKnowledgeVector();
+  for (const t of [tenantA, tenantB]) {
+    await vector.deleteIndex({ indexName: knowledgeIndexName(t) }).catch(() => {});
+  }
+  process.exit(ok ? 0 : 1);
+}
+
+main().catch((e) => {
+  console.error("probe failed:", e);
+  process.exit(1);
+});
diff --git a/packages/agents/scripts/knowledge-reindex.ts b/packages/agents/scripts/knowledge-reindex.ts
new file mode 100644
index 00000000..409067f5
--- /dev/null
+++ b/packages/agents/scripts/knowledge-reindex.ts
@@ -0,0 +1,87 @@
+/**
+ * Backfill the knowledge indexes (foreman-aqjx).
+ *
+ * Embeds every SHARED knowledge document into its workspace's vector index so
+ * docs saved before save_document started indexing (or on a fresh DB) become
+ * searchable. Self-host/local only — walks the on-disk per-tenant Workspace
+ * dirs under FOREMAN_WORKSPACE_PATH. Cloud/S3 backfill is a follow-up.
+ *
+ * Run with local Supabase creds (NOT under `infisical run`, which injects cloud
+ * DB creds that override .env.local):
+ *
+ *   npx tsx --env-file=.env.local scripts/knowledge-reindex.ts
+ */
+import { readdir, readFile, stat } from "node:fs/promises";
+import path from "node:path";
+import { indexSharedDoc } from "../src/mastra/agents/workspace";
+
+const WORKSPACE_PATH = process.env.FOREMAN_WORKSPACE_PATH ?? "./data/workspace";
+
+/** documents/q3-launch-plan.md → "Q3 Launch Plan" (fallback title, no manifest read). */
+function titleFromSlug(slug: string): string {
+  return (
+    slug
+      .split("-")
+      .filter(Boolean)
+      .map((w) => w.charAt(0).toUpperCase() + w.slice(1))
+      .join(" ") || "Document"
+  );
+}
+
+async function listDirs(dir: string): Promise<string[]> {
+  try {
+    const entries = await readdir(dir, { withFileTypes: true });
+    return entries.filter((e) => e.isDirectory()).map((e) => e.name);
+  } catch {
+    return [];
+  }
+}
+
+async function main() {
+  const tenants = await listDirs(WORKSPACE_PATH);
+  if (tenants.length === 0) {
+    console.log(`No workspace dirs under ${WORKSPACE_PATH}. Nothing to reindex.`);
+    return;
+  }
+
+  let total = 0;
+  for (const tenantKey of tenants) {
+    // Only the SHARED `documents/` tier is indexed (v1). Personal `_private/…`
+    // docs are skipped — they'd become searchable by teammates in the shared
+    // per-workspace index (personal search is a per-user-index follow-up).
+    const docsDir = path.join(WORKSPACE_PATH, tenantKey, "documents");
+    let files: string[];
+    try {
+      files = (await readdir(docsDir)).filter((f) => f.endsWith(".md"));
+    } catch {
+      continue; // no documents/ dir for this tenant
+    }
+    for (const file of files) {
+      const abs = path.join(docsDir, file);
+      const s = await stat(abs).catch(() => null);
+      if (!s?.isFile()) continue;
+      const content = await readFile(abs, "utf8");
+      const relPath = `documents/${file}`;
+      try {
+        await indexSharedDoc({
+          tenantKey,
+          path: relPath,
+          content,
+          title: titleFromSlug(file.replace(/\.md$/, "")),
+        });
+        total++;
+        console.log(`  indexed ${tenantKey}/${relPath}`);
+      } catch (err) {
+        console.error(`  FAILED ${tenantKey}/${relPath}:`, (err as Error).message);
+      }
+    }
+  }
+  console.log(`\nReindexed ${total} shared document(s) across ${tenants.length} workspace(s).`);
+}
+
+main()
+  .then(() => process.exit(0))
+  .catch((e) => {
+    console.error(e);
+    process.exit(1);
+  });
diff --git a/packages/agents/scripts/probe-connections.ts b/packages/agents/scripts/probe-connections.ts
new file mode 100644
index 00000000..8ea177cd
--- /dev/null
+++ b/packages/agents/scripts/probe-connections.ts
@@ -0,0 +1,52 @@
+/**
+ * Read-only probe: what's connected on this Zapier account + what instant
+ * (webhook/hook) triggers are available for an end-to-end inbox test.
+ * Run: cd packages/agents && npx tsx scripts/probe-connections.ts
+ */
+import { createZapierSdk } from "@zapier/zapier-sdk/experimental";
+
+const sdk = createZapierSdk();
+
+async function main() {
+  console.log("=== Connections (owner: me) ===");
+  try {
+    const conns = await sdk.listConnections({ owner: "me", maxItems: 50 });
+    if (conns.data.length === 0) console.log("  (none)");
+    for (const c of conns.data) {
+      console.log(`  app=${c.app_key ?? "?"}  title="${c.title ?? c.label ?? ""}"  id=${c.id}`);
+    }
+    console.log(`  → ${conns.data.length} connection(s)`);
+  } catch (e) {
+    console.log("  listConnections error:", (e as Error).message);
+  }
+
+  console.log("\n=== Apps matching 'webhook' ===");
+  try {
+    const apps = await sdk.listApps({ search: "webhook", maxItems: 6 });
+    for (const a of apps.data) {
+      console.log(`  key=${a.key}  impl=${a.implementation_id}  "${a.title}"`);
+    }
+  } catch (e) {
+    console.log("  listApps error:", (e as Error).message);
+  }
+
+  // Webhooks-by-Zapier triggers (the canonical instant trigger for testing).
+  for (const appKey of ["webhook", "WebHookAPI", "webhooks"]) {
+    console.log(`\n=== Triggers for app '${appKey}' ===`);
+    try {
+      const trigs = await sdk.listTriggers({ app: appKey });
+      if (trigs.data.length === 0) console.log("  (none)");
+      for (const t of trigs.data) {
+        console.log(`  key=${t.key}  "${t.title}"  type=${t.action_type ?? "?"}`);
+      }
+      break; // first one that resolves wins
+    } catch (e) {
+      console.log(`  ${appKey}: ${(e as Error).message}`);
+    }
+  }
+}
+
+main().catch((e) => {
+  console.error(e);
+  process.exit(1);
+});
diff --git a/packages/agents/scripts/probe-webhook-inbox.ts b/packages/agents/scripts/probe-webhook-inbox.ts
new file mode 100644
index 00000000..72f52f70
--- /dev/null
+++ b/packages/agents/scripts/probe-webhook-inbox.ts
@@ -0,0 +1,98 @@
+/**
+ * Probe: find the real ingest URL for a Webhooks-by-Zapier "Catch Hook"
+ * trigger-inbox, then prove instant delivery. Tries candidate account-id segments
+ * (the classic catch URL uses the numeric/public account id, not the user UUID),
+ * POSTs, and leases up to ~40s per candidate. Cleans up.
+ * Run: cd packages/agents && npx tsx scripts/probe-webhook-inbox.ts
+ */
+import { createZapierSdk } from "@zapier/zapier-sdk/experimental";
+
+const sdk = createZapierSdk();
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+const CODE = "foremansmokehook";
+
+async function leaseUntil(inboxId: string, capMs: number) {
+  const start = Date.now();
+  let i = 0;
+  while (Date.now() - start < capMs) {
+    i++;
+    const { data: lease } = await sdk.leaseTriggerInboxMessages({
+      inbox: inboxId,
+      leaseLimit: 5,
+      leaseSeconds: 30,
+    });
+    console.log(
+      `    lease ${i} (${Math.round((Date.now() - start) / 1000)}s): msgs=${lease.results.length} inbox=${lease.inbox_attributes.status}`,
+    );
+    if (lease.results.length) {
+      console.log("    ✓ MESSAGE:", JSON.stringify(lease.results[0], null, 2));
+      if (lease.lease_id) {
+        await sdk.ackTriggerInboxMessages({
+          inbox: inboxId,
+          lease: lease.lease_id,
+          messages: lease.results.map((m) => m.id),
+        });
+      }
+      return true;
+    }
+    await sleep(4000);
+  }
+  return false;
+}
+
+async function main() {
+  // Account-id candidates from a connection (the user-profile id is a UUID and
+  // didn't route; catch URLs historically use the numeric/public account id).
+  const conns = await sdk.listConnections({ owner: "me", maxItems: 1 });
+  const c = conns.data[0] as Record<string, unknown> | undefined;
+  console.log("first connection account fields:", {
+    account_id: c?.account_id,
+    account_public_id: c?.account_public_id,
+    public_id: c?.public_id,
+  });
+  const candidates = [c?.account_public_id, c?.account_id, process.env.ZAPIER_ACCOUNT_ID].filter(
+    Boolean,
+  ) as string[];
+
+  let inboxId: string | undefined;
+  try {
+    const { data: inbox } = await sdk.ensureTriggerInbox({
+      key: "foreman-hook-probe",
+      app: "webhook",
+      action: "hook_v2",
+      inputs: { _zap_static_hook_code: CODE },
+    });
+    inboxId = inbox.id;
+    await sleep(1500);
+    const { data: got } = await sdk.getTriggerInbox({ inbox: inbox.id });
+    console.log(`inbox ${inbox.id} status=${got.status}`);
+
+    for (const acct of candidates) {
+      const url = `https://hooks.zapier.com/hooks/catch/${acct}/${CODE}/`;
+      console.log(`\n→ candidate account ${acct}\n  POST ${url}`);
+      const res = await fetch(url, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ hello: "foreman-smoke", acct }),
+      });
+      console.log(`  POST → ${res.status}`);
+      const delivered = await leaseUntil(inbox.id, 24_000);
+      if (delivered) {
+        console.log(`\n✓✓ WORKING URL: ${url}`);
+        break;
+      }
+    }
+  } catch (e) {
+    console.error("ERR:", (e as Error).message);
+  } finally {
+    if (inboxId) {
+      await sdk.deleteTriggerInbox({ inbox: inboxId }).catch(() => {});
+      console.log(`\ndeleted inbox ${inboxId}`);
+    }
+  }
+}
+
+main().catch((e) => {
+  console.error(e);
+  process.exit(1);
+});
diff --git a/packages/agents/scripts/qdna-preview-probe.ts b/packages/agents/scripts/qdna-preview-probe.ts
new file mode 100644
index 00000000..313e041e
--- /dev/null
+++ b/packages/agents/scripts/qdna-preview-probe.ts
@@ -0,0 +1,107 @@
+/**
+ * foreman-qdna verification probe. Exercises the REAL preview-builder path
+ * headlessly: build the agent, generate a component from a sample brief, and
+ * check two things the qdna note left "pending live build":
+ *   1. does Haiku actually invoke the shadcn `skill` tool at build time?
+ *   2. does the generated component type-check (the "TS-error drop" signal)?
+ *
+ * Writes the output to the preview-template's generated.tsx and runs the same
+ * typecheckPreview() the preview_app self-heal loop uses. Does NOT spawn Vite.
+ *
+ * Run:  infisical run --projectId e56e0da5-6460-4bab-bdd6-2fd12ac5447b --env dev \
+ *         --recursive --silent -- npx tsx scripts/qdna-preview-probe.ts
+ */
+import { writeFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { typecheckPreview } from "../src/lib/preview/serve";
+import { createPreviewBuilderAgent } from "../src/mastra/agents/preview-builder";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const GENERATED = path.join(here, "..", "preview-template", "src", "generated.tsx");
+
+/** Same extraction the preview_app tool uses. */
+function extractComponent(raw: string): string {
+  let text = raw.trim();
+  if (text.startsWith("```")) {
+    text = text
+      .replace(/^```[a-zA-Z]*\s*\n?/, "")
+      .replace(/\n?```\s*$/, "")
+      .trim();
+  }
+  const match = text.match(/^(import\s|export\s+default\b)/m);
+  if (match && match.index !== undefined && match.index > 0) text = text.slice(match.index).trim();
+  return text;
+}
+
+const BRIEF =
+  "Build this:\n\nA SaaS sales dashboard. Three KPI cards (Monthly Revenue, New Customers, " +
+  "Churn Rate) each with a trend badge; a monthly revenue bar chart; and a recent-orders table " +
+  "(customer, plan, amount, status). Invent realistic, internally-consistent sample data.";
+
+const toolCalls: string[] = [];
+
+async function main() {
+  const agent = createPreviewBuilderAgent();
+  const res = await agent.generate(BRIEF, {
+    // Capture every tool the builder calls during generation.
+    onStepFinish: (step: unknown) => {
+      const s = step as {
+        toolCalls?: Array<{ toolName?: string; payload?: { toolName?: string } }>;
+      };
+      for (const tc of s?.toolCalls ?? [])
+        toolCalls.push(tc.toolName ?? tc.payload?.toolName ?? "?");
+    },
+  });
+
+  // Belt-and-suspenders: also read tool calls off the result if the callback shape differs.
+  const r = res as unknown as {
+    text?: string;
+    toolCalls?: Array<{ toolName?: string }>;
+    steps?: Array<{ toolCalls?: Array<{ toolName?: string }> }>;
+  };
+  if (toolCalls.length === 0) {
+    for (const tc of r.toolCalls ?? []) toolCalls.push(tc.toolName ?? "?");
+    for (const st of r.steps ?? [])
+      for (const tc of st.toolCalls ?? []) toolCalls.push(tc.toolName ?? "?");
+  }
+
+  let tsx = extractComponent(r.text ?? "");
+  await writeFile(GENERATED, tsx, "utf8");
+  let check = await typecheckPreview();
+  const firstTryOk = check.ok;
+
+  // Mirror preview_app's self-heal loop: feed real tsc errors back, up to 2×.
+  let heals = 0;
+  for (let attempt = 1; !check.ok && attempt <= 2; attempt++) {
+    const fixPrompt =
+      `The component you just wrote fails to compile with these TypeScript errors:\n\n${check.errors}\n\n` +
+      "Return the CORRECTED, COMPLETE component following the exact same import rules. Output only the .tsx, nothing else.";
+    const fixed = extractComponent((await agent.generate(fixPrompt)).text ?? "");
+    if (!fixed) break;
+    tsx = fixed;
+    heals = attempt;
+    await writeFile(GENERATED, tsx, "utf8");
+    check = await typecheckPreview();
+  }
+
+  const skillInvoked = toolCalls.some((t) => t === "skill" || t.startsWith("skill"));
+  console.log("─".repeat(60));
+  console.log("QDNA PREVIEW PROBE");
+  console.log("tool calls        :", toolCalls.length ? toolCalls.join(", ") : "(none captured)");
+  console.log("skill tool invoked:", skillInvoked ? "YES ✓" : "NO ✗");
+  console.log("tsx length        :", tsx.length, "chars");
+  console.log("first-try compile :", firstTryOk ? "PASS ✓" : "FAIL (needed self-heal)");
+  console.log(
+    "final compile     :",
+    check.ok ? `PASS ✓ (after ${heals} self-heal${heals === 1 ? "" : "s"})` : "FAIL ✗",
+  );
+  if (!check.ok) console.log(`errors:\n${check.errors}`);
+  console.log("─".repeat(60));
+  process.exit(0);
+}
+
+main().catch((e) => {
+  console.error("probe failed:", e);
+  process.exit(1);
+});
diff --git a/packages/agents/scripts/reindex-embeddings.ts b/packages/agents/scripts/reindex-embeddings.ts
new file mode 100644
index 00000000..a178a0ef
--- /dev/null
+++ b/packages/agents/scripts/reindex-embeddings.ts
@@ -0,0 +1,84 @@
+/**
+ * Migration: drop the embedding vector indexes so they get recreated at the
+ * dimension the CODE currently uses (see EMBEDDING_DIMENSION in
+ * src/lib/catalog/vector.ts and src/lib/rag/index.ts).
+ *
+ * WHY: PgVector indexes are fixed-dimension. ensureIndex()/ensureCatalogIndex()
+ * only CREATE an index when it's missing — they never resize an existing one.
+ * After switching the embedder (e.g. OpenAI 1536d -> fastembed 384d), any env
+ * whose `catalog_vectors` / `action_history` indexes already exist at the old
+ * dimension will reject the new vectors with a dimension mismatch. This drops
+ * them so the running app recreates them at the new dimension on next use.
+ *
+ * SAFE BY DEFAULT: dry-run (reports current dimensions, changes nothing) unless
+ * you pass --yes. Destructive: dropping action_history discards historical
+ * semantic-recall embeddings (they rebuild as new actions run). catalog_vectors
+ * is fully restored by `npm run catalog:embed` afterwards.
+ *
+ * Usage (run with the TARGET env's DATABASE_URL in the environment):
+ *   npx tsx scripts/reindex-embeddings.ts            # dry-run: report only
+ *   npx tsx scripts/reindex-embeddings.ts --yes      # drop the indexes
+ *   # then, to repopulate the catalog at the new dimension:
+ *   npm run catalog:embed
+ */
+import { config } from "dotenv";
+
+config({ path: ".env.local" });
+config(); // .env fallback
+
+import { Client } from "pg";
+
+const INDEXES = ["catalog_vectors", "action_history"] as const;
+const apply = process.argv.slice(2).includes("--yes");
+
+async function main() {
+  const connectionString = process.env.DATABASE_URL;
+  if (!connectionString) {
+    console.error("DATABASE_URL is not set. Aborting.");
+    process.exit(1);
+  }
+
+  const client = new Client({ connectionString });
+  await client.connect();
+
+  console.log("=== Embedding index re-index ===");
+  console.log(`  Mode: ${apply ? "APPLY (will drop indexes)" : "dry-run (report only)"}`);
+  console.log();
+
+  for (const idx of INDEXES) {
+    // PgVector stores each index as a table of the same name; the embedding
+    // column is the lone `vector` type column. format_type exposes its dim.
+    const dim = await client.query(
+      `SELECT format_type(a.atttypid, a.atttypmod) AS type
+         FROM pg_attribute a
+         JOIN pg_class c ON c.oid = a.attrelid
+        WHERE c.relname = $1 AND a.atttypid = 'vector'::regtype`,
+      [idx],
+    );
+    const current = dim.rows[0]?.type ?? "(table does not exist)";
+    console.log(`  ${idx}: ${current}`);
+
+    if (apply) {
+      await client.query(`DROP TABLE IF EXISTS "${idx}" CASCADE`);
+      console.log(`    -> dropped (will be recreated at the code's current dimension on next use)`);
+    }
+  }
+
+  await client.end();
+
+  console.log();
+  if (apply) {
+    console.log("Done. Next steps:");
+    console.log("  1. (Re)start the agents server so the new embedder/dimension is live.");
+    console.log("  2. Run `npm run catalog:embed` to repopulate catalog_vectors.");
+    console.log("  3. action_history recreates empty and rebuilds as new actions run.");
+  } else {
+    console.log("Dry run only — no changes made. Re-run with --yes to drop the indexes.");
+  }
+  process.exit(0);
+}
+
+main().catch((err) => {
+  console.error("Re-index failed:", err);
+  process.exit(1);
+});
diff --git a/packages/agents/scripts/scheduler-poc.ts b/packages/agents/scripts/scheduler-poc.ts
new file mode 100644
index 00000000..01f5aa9b
--- /dev/null
+++ b/packages/agents/scripts/scheduler-poc.ts
@@ -0,0 +1,92 @@
+/**
+ * foreman-bhb5.1 POC: prove Mastra's native WorkflowScheduler actually fires a
+ * cron workflow against local Postgres — the one thing the type research couldn't
+ * confirm (does startWorkers() run + does a schedule fire locally). Throwaway.
+ *
+ * No LLM key, no Infisical (so no cloud-Supabase override) — local DB only:
+ *   npx tsx --env-file=.env.local scripts/scheduler-poc.ts
+ */
+import { Mastra } from "@mastra/core";
+import "@mastra/core/workflows/evented";
+import { createStep, createWorkflow } from "@mastra/core/workflows";
+import { PostgresStore } from "@mastra/pg";
+import { z } from "zod";
+
+let fired = 0;
+const tick = createStep({
+  id: "tick",
+  inputSchema: z.object({}),
+  outputSchema: z.object({ n: z.number() }),
+  execute: async () => {
+    fired += 1;
+    console.log(`  [poc] workflow FIRED #${fired} @ ${new Date().toISOString()}`);
+    return { n: fired };
+  },
+});
+
+const wf = createWorkflow({
+  id: "poc-cron",
+  inputSchema: z.object({}),
+  outputSchema: z.object({ n: z.number() }),
+  schedule: { cron: "* * * * *", timezone: "UTC" }, // every minute at :00
+})
+  .then(tick)
+  .commit();
+
+async function main() {
+  const connectionString = process.env.DATABASE_URL;
+  if (!connectionString) throw new Error("DATABASE_URL missing (need .env.local)");
+  const storage = new PostgresStore({ id: "poc-pg", connectionString });
+
+  const mastra = new Mastra({ storage, workflows: { "poc-cron": wf } });
+
+  console.log(`start @ ${new Date().toISOString()}`);
+  await mastra.startWorkers();
+  console.log(`scheduler defined after startWorkers(): ${Boolean(mastra.scheduler)}`);
+
+  // Confirm the schedule row was written.
+  try {
+    const schedules = (await storage.getStore("schedules")) as {
+      listSchedules?: () => Promise<unknown[]>;
+    };
+    const rows = (await schedules.listSchedules?.()) ?? [];
+    console.log(`mastra_schedules rows: ${rows.length}`);
+  } catch (e) {
+    console.log(`listSchedules probe: ${(e as Error).message}`);
+  }
+
+  // Wait up to ~135s to catch at least one top-of-minute fire.
+  for (let i = 0; i < 27; i++) {
+    await new Promise((r) => setTimeout(r, 5000));
+    if (fired >= 1) break;
+  }
+
+  console.log("\n=== VERDICT ===");
+  console.log(`scheduler ran      : ${mastra.scheduler ? "YES ✓" : "NO ✗"}`);
+  console.log(`workflow fired     : ${fired >= 1 ? `YES ✓ (${fired}×)` : "NO ✗ (timed out)"}`);
+  console.log(
+    `→ native scheduler : ${mastra.scheduler && fired >= 1 ? "PROVEN locally" : "NOT PROVEN — see above"}`,
+  );
+
+  // Clean up the poc schedule so it doesn't linger / re-fire.
+  try {
+    const s = (await storage.getStore("schedules")) as {
+      listSchedules?: () => Promise<Array<{ id: string }>>;
+      deleteSchedule?: (id: string) => Promise<void>;
+    };
+    for (const row of (await s.listSchedules?.()) ?? []) {
+      if (String(row.id).includes("poc-cron")) await s.deleteSchedule?.(row.id);
+    }
+    console.log("cleaned up poc schedule");
+  } catch (e) {
+    console.log(`cleanup note: ${(e as Error).message}`);
+  }
+
+  await mastra.stopWorkers();
+  process.exit(mastra.scheduler && fired >= 1 ? 0 : 1);
+}
+
+main().catch((e) => {
+  console.error("poc failed:", e);
+  process.exit(1);
+});
diff --git a/packages/agents/scripts/sdk-surface-sweep.ts b/packages/agents/scripts/sdk-surface-sweep.ts
index 6edd4631..4fb5f2f3 100644
--- a/packages/agents/scripts/sdk-surface-sweep.ts
+++ b/packages/agents/scripts/sdk-surface-sweep.ts
@@ -23,7 +23,7 @@
  * local. Run from packages/agents:
  *   npx tsx scripts/sdk-surface-sweep.ts
  */
-import { readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 
 // ---- Foreman's own categorization (mirror of zapier-sdk-tools.ts) ----
 const APPROVAL_REQUIRED = new Set([
@@ -113,10 +113,16 @@ function methodNames(obj: any): string[] {
 
 async function main() {
   // 1) Installed version straight off disk (exports map blocks require()).
-  const pkgPath = new URL(
+  //    The package may be deduped to the workspace root, so try the nested
+  //    copy first, then the hoisted root node_modules.
+  const pkgCandidates = [
     "../node_modules/@zapier/zapier-sdk/package.json",
-    import.meta.url,
-  ).pathname.replace(/^\/([A-Za-z]:)/, "$1");
+    "../../../node_modules/@zapier/zapier-sdk/package.json",
+  ].map((p) => new URL(p, import.meta.url).pathname.replace(/^\/([A-Za-z]:)/, "$1"));
+  const pkgPath = pkgCandidates.find((p) => existsSync(p));
+  if (!pkgPath) {
+    throw new Error(`@zapier/zapier-sdk/package.json not found in: ${pkgCandidates.join(", ")}`);
+  }
   const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
   h(`@zapier/zapier-sdk SURFACE SWEEP — installed v${pkg.version}`);
   console.log("dependencies:", JSON.stringify(pkg.dependencies));
@@ -183,7 +189,6 @@ async function main() {
       try {
         const reg = sdk.getRegistry(v);
         const fns = reg?.functions ?? [];
-        const names = fns.map((f: any) => f.name).sort();
         console.log(
           `  [${label}] getRegistry(${v ? JSON.stringify(v) : "undefined"}) -> ${fns.length} functions`,
         );
diff --git a/packages/agents/scripts/show-logs.mjs b/packages/agents/scripts/show-logs.mjs
index 52d66d39..a279dda6 100644
--- a/packages/agents/scripts/show-logs.mjs
+++ b/packages/agents/scripts/show-logs.mjs
@@ -6,12 +6,13 @@
 import { createRequire } from "node:module";
 
 const require = createRequire(import.meta.url);
-const { Client } = require("C:/Users/HamCh/code/foreman/node_modules/pg");
+const { Client } = require("pg");
 
 const arg = process.argv[2] || "10";
 const watch = arg === "watch";
 const minutes = watch ? 1 : parseInt(arg, 10);
-const connStr = "postgres://postgres:postgres@127.0.0.1:54422/postgres";
+// Local Supabase default; override with DATABASE_URL for other setups.
+const connStr = process.env.DATABASE_URL ?? "postgres://postgres:postgres@127.0.0.1:54422/postgres";
 
 async function fetchSince(client, since) {
   const r = await client.query(
diff --git a/packages/agents/scripts/trigger-inbox-spike.ts b/packages/agents/scripts/trigger-inbox-spike.ts
index 67333a0c..01119c11 100644
--- a/packages/agents/scripts/trigger-inbox-spike.ts
+++ b/packages/agents/scripts/trigger-inbox-spike.ts
@@ -177,7 +177,7 @@ async function main() {
           .replace(/[^a-z0-9]+/gi, "-")}`
       : "";
     const { data: inbox } = await (sdk as any).ensureTriggerInbox({
-      name: `foreman-spike-${args.app}-${pick.key}${inputHint}`,
+      key: `foreman-spike-${args.app}-${pick.key}${inputHint}`,
       app: args.app,
       action: pick.key,
       ...(connection ? { connection } : {}),
diff --git a/packages/agents/skills/shadcn/SKILL.md b/packages/agents/skills/shadcn/SKILL.md
new file mode 100644
index 00000000..db0f8cbf
--- /dev/null
+++ b/packages/agents/skills/shadcn/SKILL.md
@@ -0,0 +1,139 @@
+---
+name: shadcn
+description: Authoritative rules for writing a single React (TSX) component from Foreman's pre-installed shadcn/ui registry — exact import map, the ChartContainer/ChartConfig and DataTable/ColumnDef contracts, react-hook-form+zod forms, and the specific type-error pitfalls to avoid. Load this BEFORE writing any preview component (dashboard, chart, table, report, form, or small tool).
+---
+
+# Writing shadcn/ui components for the Foreman live preview
+
+You write ONE self-contained React component that is rendered inside a warm Vite + React 19 + Tailwind v4 + shadcn/ui app. **Every component is already installed** — you never run a CLI, never add dependencies, never write CSS or a registry file. You import the real components and compose them. Your only job is correct, type-checking TSX that uses the design system idiomatically.
+
+The single most common failure is **importing a name that is not a real export, or passing a prop/variant that doesn't exist** — that fails `tsc` and triggers a rebuild. The rules below exist to prevent exactly that.
+
+## Output contract (never break these)
+
+- Emit ONLY the raw contents of one `.tsx` file. No markdown fences, no prose before or after.
+- Exactly one component as the **default export**, taking **no props**: `export default function Dashboard() { … }`.
+- No CSS imports, no `<style>` tag, no raw `<script>`, no runtime `fetch`, no `import` of any package outside the allowed set below.
+- Prefer real, internally-consistent inline data. NEVER render an empty chart/table or a "No data" placeholder — invent believable sample data if none is given. If you can't fill a section, omit it.
+- **Imports must match usage exactly.** Before you finish, check that every name you render (each component, icon, hook, helper) is imported, and every import is actually used. A used-but-unimported name and an imported-but-unused name are the two most common `tsc` failures here — scan your imports against your JSX one last time.
+
+## Import map — which name comes from which module
+
+Import each component from `@/components/ui/<name>` using its **exact** export names. Getting the module right is what prevents "has no exported member" errors.
+
+| Module (`@/components/ui/…`) | Exact exports you'll use |
+| --- | --- |
+| `card` | `Card, CardHeader, CardTitle, CardDescription, CardAction, CardContent, CardFooter` |
+| `badge` | `Badge` — variants: `default \| secondary \| destructive \| outline` only |
+| `button` | `Button` — variants: `default \| destructive \| outline \| secondary \| ghost \| link`; sizes: `default \| sm \| lg \| icon` |
+| `table` | `Table, TableHeader, TableBody, TableFooter, TableHead, TableRow, TableCell, TableCaption` |
+| `data-table` | `DataTable, DataTableColumnHeader` (custom — sortable/filterable/paginated) |
+| `chart` | `ChartContainer, ChartTooltip, ChartTooltipContent, ChartLegend, ChartLegendContent` + `type ChartConfig` |
+| `tabs` | `Tabs, TabsList, TabsTrigger, TabsContent` |
+| `select` | `Select, SelectTrigger, SelectValue, SelectContent, SelectItem, SelectGroup, SelectLabel` |
+| `tooltip` | `Tooltip, TooltipTrigger, TooltipContent, TooltipProvider` |
+| `dropdown-menu` | `DropdownMenu, DropdownMenuTrigger, DropdownMenuContent, DropdownMenuItem, DropdownMenuLabel, DropdownMenuSeparator` |
+| `input` / `label` / `textarea` / `checkbox` / `switch` / `slider` / `progress` / `separator` / `skeleton` / `avatar` | `Input` / `Label` / `Textarea` / `Checkbox` / `Switch` / `Slider` / `Progress` / `Separator` / `Skeleton` / `Avatar, AvatarImage, AvatarFallback` |
+| `sonner` | `Toaster` (render `<Toaster />` once; call `toast()` from the `sonner` package, not from here) |
+
+Full registry available (import any by `@/components/ui/<name>`):
+`accordion, alert, alert-dialog, aspect-ratio, avatar, badge, breadcrumb, button, button-group, calendar, card, carousel, chart, checkbox, collapsible, combobox, command, context-menu, data-table, dialog, drawer, dropdown-menu, empty, field, hover-card, input, input-group, input-otp, item, kbd, label, menubar, native-select, navigation-menu, pagination, popover, progress, radio-group, resizable, scroll-area, select, separator, sheet, skeleton, slider, sonner, spinner, switch, table, tabs, textarea, toggle, toggle-group, tooltip`.
+
+If you are unsure of a component's exact export names, stick to the components in the import map above, or pick a simpler component you're sure of. **Never guess an export name** — a wrong guess fails the type-check.
+
+## Allowed direct library imports
+
+These are the ONLY packages you may import — and import **only the specific names you actually use**. An unused import or variable fails `tsc` under `noUnusedLocals`.
+
+**React:** the template uses React 19's automatic JSX runtime, so you do **NOT** import React to write JSX. Import hooks by name only when you use them (`import { useState } from "react"`). Never write `import * as React from "react"` unless you actually reference `React.` somewhere — a bare, unused React import is the single most common type error here.
+
+```ts
+import { useState } from "react"; // ONLY if you use a hook — omit entirely otherwise
+import { BarChart, Bar, CartesianGrid, XAxis, YAxis } from "recharts"; // only the pieces you render
+import { type ColumnDef } from "@tanstack/react-table";
+import { useForm, Controller } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { z } from "zod";
+import { format } from "date-fns";
+import { toast } from "sonner";
+import { TrendingUp } from "lucide-react"; // only icons you actually render
+import { cn } from "@/lib/utils";
+```
+
+`lucide-react` icon names are **PascalCase and must exist** (e.g. `TrendingUp`, `ArrowUpRight`, `DollarSign`). A misspelled icon is a missing export → type error.
+
+## Charts — the ChartContainer / ChartConfig contract
+
+shadcn charts wrap recharts. Two rules prevent both the type error and the "chart renders empty" bug:
+
+1. `ChartContainer` MUST have an **explicit height** class. Without it the chart collapses to 0px.
+2. `ChartContainer` already renders a `ResponsiveContainer` internally — **do NOT wrap the chart in your own `ResponsiveContainer`** (double container → 0-height).
+3. `ChartConfig` keys MUST match each series' `dataKey`. Reference each series color as `var(--color-KEY)`; define the palette with `var(--chart-1)`..`var(--chart-5)`.
+
+```tsx
+const chartConfig = {
+  revenue: { label: "Revenue", color: "var(--chart-1)" },
+} satisfies ChartConfig;
+
+<ChartContainer config={chartConfig} className="h-[280px] w-full">
+  <BarChart data={data} accessibilityLayer>
+    <CartesianGrid vertical={false} />
+    <XAxis dataKey="month" tickLine={false} axisLine={false} tickMargin={8} />
+    <YAxis tickLine={false} axisLine={false} width={48} />
+    <ChartTooltip content={<ChartTooltipContent />} />
+    <Bar dataKey="revenue" fill="var(--color-revenue)" radius={6} />
+  </BarChart>
+</ChartContainer>
+```
+
+## Tables — the DataTable / ColumnDef contract
+
+For tabular/list data prefer `DataTable` (sortable, filterable, paginated). Define a `Row` type so `accessorKey` is type-checked against it — this is what catches typos at compile time.
+
+```tsx
+type Row = { id: string; name: string; amount: number; status: "paid" | "due" };
+
+const columns: ColumnDef<Row>[] = [
+  { accessorKey: "name", header: "Name" },
+  {
+    accessorKey: "amount",
+    header: ({ column }) => <DataTableColumnHeader column={column} title="Amount" />,
+    cell: ({ row }) => <span className="tabular-nums">${row.original.amount.toLocaleString()}</span>,
+  },
+  { accessorKey: "status", header: "Status",
+    cell: ({ row }) => <Badge variant="secondary">{row.original.status}</Badge> },
+];
+
+<DataTable columns={columns} data={rows} filterColumn="name" />
+```
+
+`filterColumn` must equal one of the `accessorKey`s. For a tiny static table the plain `Table` primitives are fine.
+
+## Forms — react-hook-form + zod
+
+Use `Controller` for shadcn inputs that don't forward a ref the way `register` expects (`Select`, `Switch`, `Checkbox`, `Slider`, `RadioGroup`). Type the form from the schema.
+
+```tsx
+const schema = z.object({ email: z.string().email(), plan: z.enum(["free", "pro"]) });
+type Values = z.infer<typeof schema>;
+
+const form = useForm<Values>({ resolver: zodResolver(schema), defaultValues: { email: "", plan: "free" } });
+```
+
+## Pitfalls that fail `tsc` (avoid every one)
+
+- Importing a name from the wrong module (e.g. `TableHead` from `card`, `Toaster` from anywhere but `sonner`).
+- A `Badge`/`Button` `variant` or `Button` `size` that isn't in the lists above.
+- `ChartConfig` keys that don't match the chart's `dataKey`s; missing `satisfies ChartConfig`.
+- `ColumnDef<Row>` with an `accessorKey` that isn't a key of `Row`; or omitting the `Row` type so everything is `any`.
+- Wrapping a `ChartContainer` child in your own `ResponsiveContainer`.
+- A misspelled `lucide-react` icon (no such export).
+- An **unused import or variable** — a bare `import * as React` you never reference, an icon or recharts piece you imported but didn't render, a `const` you never use. Fails `tsc` under `noUnusedLocals`. Import only what you use.
+- Importing a CSS file, a `<style>` tag, a runtime `fetch`, or any package not listed above.
+
+## Layout & polish
+
+- Header: an `<h1>` (`text-2xl font-semibold tracking-tight`) + a muted one-line subtitle (`text-sm text-muted-foreground`).
+- KPI row: responsive grid of `Card`s (`grid gap-4 sm:grid-cols-2 lg:grid-cols-3`). In each, `CardHeader` → `CardDescription` (small muted label) + a big `CardTitle` value (`text-3xl font-semibold tabular-nums`); a calm `Badge variant="secondary"` with a small lucide trend icon in `CardAction`. Use `tabular-nums` on every figure.
+- Charts in `Card`s below in a grid that stacks on small screens (`grid gap-4 lg:grid-cols-2`). Generous spacing (`gap-4`/`gap-6`, `p-6`); wrap everything in `<div className="space-y-6">`.
+- Stay calm and professional: lean on the shadcn tokens (`bg-card`, `text-muted-foreground`, `border`). Do NOT add loud colored borders or bars — the design system is already polished; don't re-skin it.
diff --git a/packages/agents/src/cron-driver-server.ts b/packages/agents/src/cron-driver-server.ts
deleted file mode 100644
index d3e1ad08..00000000
--- a/packages/agents/src/cron-driver-server.ts
+++ /dev/null
@@ -1,34 +0,0 @@
-/**
- * Standalone entrypoint for the trigger drivers. Run with:
- *   node --env-file=.env.local src/cron-driver-server.ts
- *
- * Keeps a long-lived process that ticks once per minute and fires due
- * `workflow_trigger` rows: the cron driver (schedule matches) and the poll
- * driver (Zapier read actions returning new records). Only run a single
- * instance — there is no distributed lock.
- */
-import { getMastra } from "./mastra";
-import { zapierPollProvider } from "./mastra/signals/zapier-poll-provider";
-import { startCronDriver } from "./workflows/cron-driver";
-import { startPollDriver } from "./workflows/poll-driver";
-
-// Build the Mastra instance here so the foreman agent is constructed in THIS
-// worker process — that connects the SignalProviders (poll/channel) and gives
-// them the notification storage notify() needs. Without it, runDuePolls() fires
-// workflows fine but notifyOwner() is a silent no-op (no connected agent). The
-// provider has no pollInterval, so constructing the agent here doesn't start a
-// second poll loop. (foreman notify-wiring)
-getMastra();
-console.log(`[trigger-driver] poll provider connected: ${zapierPollProvider.isConnected}`);
-
-const stopCron = startCronDriver();
-const stopPoll = startPollDriver();
-
-const shutdown = (sig: string) => {
-  console.log(`[trigger-driver] received ${sig}, shutting down`);
-  stopCron();
-  stopPoll();
-  process.exit(0);
-};
-process.on("SIGINT", () => shutdown("SIGINT"));
-process.on("SIGTERM", () => shutdown("SIGTERM"));
diff --git a/packages/agents/src/discord/bot.ts b/packages/agents/src/discord/bot.ts
index e2468a40..eb97228e 100644
--- a/packages/agents/src/discord/bot.ts
+++ b/packages/agents/src/discord/bot.ts
@@ -5,7 +5,6 @@ import { Chat } from "chat";
 import { redeemChannelLinkCode, registerChannelUser } from "../lib/identity";
 import { requestUserContext } from "../lib/request-user-context";
 import { getMastra } from "../mastra";
-import { matchAndFireChannelTriggers } from "../workflows/channel-trigger";
 
 let _bot: Chat<{ discord: ReturnType<typeof createDiscordAdapter> }> | undefined;
 let _discordAdapter: ReturnType<typeof createDiscordAdapter> | undefined;
@@ -92,7 +91,7 @@ export async function getDiscordBot() {
         );
         if (result.ok) {
           await thread.post(
-            "Your Discord account is now linked to Foreman! 🎉 Try sending me a message — I can take actions across 9,000+ apps for you.",
+            "Your Discord account is now linked to Foreman! 🎉 Try sending me a message — I can take actions across 10,000+ apps for you.",
           );
         } else if (result.error === "expired") {
           await thread.post(
@@ -119,14 +118,6 @@ export async function getDiscordBot() {
   bot.onDirectMessage(async (thread, message) => {
     if (!message.text) return;
     if (message.text.trim().startsWith("/link")) return;
-    const fired = await matchAndFireChannelTriggers({
-      channel: "discord",
-      text: message.text,
-      from: message.author.userId,
-      dedupeKey: message.id,
-      room: thread.channelId,
-    });
-    if (fired > 0) return;
     await thread.startTyping().catch(() => {});
     const reply = await generateStreamedReply(
       thread,
@@ -141,14 +132,6 @@ export async function getDiscordBot() {
   // Handle @-mentions in channels
   bot.onNewMention(async (thread, message) => {
     if (!message.text) return;
-    const fired = await matchAndFireChannelTriggers({
-      channel: "discord",
-      text: message.text,
-      from: message.author.userId,
-      dedupeKey: message.id,
-      room: thread.id,
-    });
-    if (fired > 0) return;
     await thread.subscribe();
     await thread.startTyping().catch(() => {});
     try {
diff --git a/packages/agents/src/gchat/bot.ts b/packages/agents/src/gchat/bot.ts
index f1e413b6..813ae37f 100644
--- a/packages/agents/src/gchat/bot.ts
+++ b/packages/agents/src/gchat/bot.ts
@@ -5,7 +5,6 @@ import { Chat } from "chat";
 import { registerChannelUser } from "../lib/identity";
 import { requestUserContext } from "../lib/request-user-context";
 import { getMastra } from "../mastra";
-import { matchAndFireChannelTriggers } from "../workflows/channel-trigger";
 
 let _bot: Chat<{ gchat: ReturnType<typeof createGoogleChatAdapter> }> | undefined;
 let _gchatAdapter: ReturnType<typeof createGoogleChatAdapter> | undefined;
@@ -58,14 +57,6 @@ export async function getGoogleChatBot() {
   bot.onDirectMessage(async (thread, message) => {
     if (!message.text) return;
     try {
-      const fired = await matchAndFireChannelTriggers({
-        channel: "gchat",
-        text: message.text,
-        from: message.author.userId,
-        dedupeKey: message.id,
-        room: thread.channelId,
-      });
-      if (fired > 0) return;
       console.log("[gchat] DM from", message.author.userId, ":", message.text);
       await thread.startTyping().catch(() => {});
       const reply = await generateReply(
@@ -85,14 +76,6 @@ export async function getGoogleChatBot() {
   bot.onNewMention(async (thread, message) => {
     if (!message.text) return;
     try {
-      const fired = await matchAndFireChannelTriggers({
-        channel: "gchat",
-        text: message.text,
-        from: message.author.userId,
-        dedupeKey: message.id,
-        room: thread.id,
-      });
-      if (fired > 0) return;
       console.log("[gchat] Mention from", message.author.userId, ":", message.text);
       await thread.subscribe();
       await thread.startTyping().catch(() => {});
diff --git a/packages/agents/src/github/bot.ts b/packages/agents/src/github/bot.ts
index ede14729..8ac0243a 100644
--- a/packages/agents/src/github/bot.ts
+++ b/packages/agents/src/github/bot.ts
@@ -5,7 +5,6 @@ import { Chat } from "chat";
 import { registerChannelUser } from "../lib/identity";
 import { requestUserContext } from "../lib/request-user-context";
 import { getMastra } from "../mastra";
-import { matchAndFireChannelTriggers } from "../workflows/channel-trigger";
 
 let _bot: Chat<{ github: ReturnType<typeof createGitHubAdapter> }> | undefined;
 let _githubAdapter: ReturnType<typeof createGitHubAdapter> | undefined;
@@ -19,7 +18,7 @@ export async function getGitHubBot() {
   if (_bot) return _bot;
 
   const github = createGitHubAdapter({
-    botUserId: process.env.GITHUB_BOT_USER_ID,
+    botUserId: process.env.GITHUB_BOT_USER_ID ? Number(process.env.GITHUB_BOT_USER_ID) : undefined,
   });
   _githubAdapter = github;
 
@@ -61,14 +60,6 @@ export async function getGitHubBot() {
   bot.onDirectMessage(async (thread, message) => {
     if (!message.text) return;
     try {
-      const fired = await matchAndFireChannelTriggers({
-        channel: "github",
-        text: message.text,
-        from: message.author.userId,
-        dedupeKey: message.id,
-        room: thread.channelId,
-      });
-      if (fired > 0) return;
       console.log("[github] DM from", message.author.userId, ":", message.text);
       await thread.startTyping().catch(() => {});
       const reply = await generateReply(
@@ -88,14 +79,6 @@ export async function getGitHubBot() {
   bot.onNewMention(async (thread, message) => {
     if (!message.text) return;
     try {
-      const fired = await matchAndFireChannelTriggers({
-        channel: "github",
-        text: message.text,
-        from: message.author.userId,
-        dedupeKey: message.id,
-        room: thread.id,
-      });
-      if (fired > 0) return;
       console.log("[github] Mention from", message.author.userId, ":", message.text);
       await thread.subscribe();
       await thread.startTyping().catch(() => {});
diff --git a/packages/agents/src/inbox-worker-server.ts b/packages/agents/src/inbox-worker-server.ts
new file mode 100644
index 00000000..9e1adf2a
--- /dev/null
+++ b/packages/agents/src/inbox-worker-server.ts
@@ -0,0 +1,36 @@
+/**
+ * Standalone entrypoint for the trigger-inbox worker (foreman-l7xq M3). Run with:
+ *   npm run start:inbox-worker   (npx tsx --env-file=.env.local src/inbox-worker-server.ts)
+ *
+ * Long-lived process: every cycle it leases each active inbox-triggered
+ * automation's trigger-inbox, dedups (claimInboxMessage), fires the durable via
+ * triggerWorkflow, records the run, and acks. Single instance only — there is no
+ * distributed lock (matches the removed cron-driver-server). Cadence via
+ * FOREMAN_INBOX_WORKER_INTERVAL_MS (default 60000).
+ */
+import { startInboxWorker } from "./lib/automations/worker";
+import { getMastra } from "./mastra";
+
+// Construct the agent in THIS process so the experimental SDK / registry init
+// happens here (mirrors how cron-driver-server built Mastra in-worker).
+const mastra = getMastra();
+
+// Run Mastra's workers here (foreman-bhb5): the WorkflowScheduler that fires
+// cron schedules (daily-digest / run-automation) + the evented workflow executor
+// that runs them. This dedicated long-lived process is the natural home; the CAS
+// on mastra_schedules makes it safe even if the web server also runs them.
+mastra.startWorkers().catch((err) => {
+  console.error("[inbox-worker] startWorkers failed:", err);
+});
+
+const intervalMs = Number(process.env.FOREMAN_INBOX_WORKER_INTERVAL_MS) || 60_000;
+console.log(`[inbox-worker] starting · interval ${intervalMs}ms`);
+const stop = startInboxWorker(intervalMs);
+
+const shutdown = (sig: string) => {
+  console.log(`[inbox-worker] received ${sig}, shutting down`);
+  stop();
+  process.exit(0);
+};
+process.on("SIGINT", () => shutdown("SIGINT"));
+process.on("SIGTERM", () => shutdown("SIGTERM"));
diff --git a/packages/agents/src/lib/automations/digest-narrator.ts b/packages/agents/src/lib/automations/digest-narrator.ts
new file mode 100644
index 00000000..2d508a36
--- /dev/null
+++ b/packages/agents/src/lib/automations/digest-narrator.ts
@@ -0,0 +1,49 @@
+/**
+ * LLM narrative layer for the daily digest (foreman-bhb5). Wraps the deterministic
+ * digest (digest.ts) with a short prose summary. The narrator is a first-class
+ * registry agent — its model comes from `AGENT_MODELS.digest` (env override
+ * `DIGEST_MODEL`, fast-tier default), exactly like the other agents. No bespoke
+ * feature flag: narration is a step of the digest workflow. It still fails soft to
+ * null so a narrator error never breaks the (already-recorded) digest.
+ */
+import { Agent } from "@mastra/core/agent";
+import { AGENT_MODELS } from "../providers/models";
+import {
+  type AutomationDigest,
+  buildDigestNarrativePrompt,
+  DIGEST_NARRATOR_INSTRUCTIONS,
+} from "./digest";
+
+/** One-shot LLM call producing the narrative text. Overridable in tests. */
+export type NarrativeGenerator = (instructions: string, prompt: string) => Promise<string>;
+
+const defaultGenerator: NarrativeGenerator = async (instructions, prompt) => {
+  const agent = new Agent({
+    id: "digest-narrator",
+    name: "digest-narrator",
+    instructions,
+    model: AGENT_MODELS.digest,
+  });
+  const result = await agent.generate(prompt);
+  return result.text ?? "";
+};
+
+/**
+ * Produce a prose summary of a digest, or null on failure. Never throws — a
+ * narrator failure (no provider key, rate limit, empty output) must not stop the
+ * digest from being recorded.
+ */
+export async function narrateDigest(
+  digest: AutomationDigest,
+  generate: NarrativeGenerator = defaultGenerator,
+): Promise<string | null> {
+  try {
+    const text = (
+      await generate(DIGEST_NARRATOR_INSTRUCTIONS, buildDigestNarrativePrompt(digest))
+    ).trim();
+    return text.length > 0 ? text : null;
+  } catch (err) {
+    console.error("[digest-narrator] narrative generation failed:", err);
+    return null;
+  }
+}
diff --git a/packages/agents/src/lib/automations/digest.ts b/packages/agents/src/lib/automations/digest.ts
new file mode 100644
index 00000000..f4d5980c
--- /dev/null
+++ b/packages/agents/src/lib/automations/digest.ts
@@ -0,0 +1,147 @@
+/**
+ * Daily digest synthesis (foreman-ufo3.2). Pure + deterministic: given the
+ * workspace's recent automation runs, produce a prioritized summary of "what
+ * mattered" — failures first (need a fix), then approvals waiting on a human,
+ * then in-flight retries, with the successes counted. No LLM, no clock coupling.
+ *
+ * A digest is stored as the `output` of a `finished` automation_run on the digest
+ * automation (no new table); the `kind` discriminator lets the inbox find the
+ * latest one. An optional LLM narrative layer can wrap this later (foreman-ufo3.3).
+ */
+
+export const DIGEST_KIND = "automation_digest" as const;
+
+/** One run as fed to the synthesizer (normalized from an automation_run + its automation name). */
+export interface DigestInputRun {
+  automationId: string;
+  automationName: string;
+  status: string;
+  error?: unknown;
+  createdAt: string;
+}
+
+/** A run surfaced in the digest (failure / waiting / retrying lists). */
+export interface DigestRunRef {
+  automationId: string;
+  automationName: string;
+  createdAt: string;
+  error?: string | null;
+}
+
+export interface AutomationDigest {
+  kind: typeof DIGEST_KIND;
+  periodStart: string;
+  periodEnd: string;
+  totals: {
+    total: number;
+    finished: number;
+    failed: number;
+    waiting: number;
+    retrying: number;
+    other: number;
+  };
+  /** Most important first: failures, then waiting-on-approval, then retrying. */
+  failures: DigestRunRef[];
+  waiting: DigestRunRef[];
+  retrying: DigestRunRef[];
+  headline: string;
+  /** Optional LLM prose summary (foreman-ufo3, opt-in). Null when disabled or on failure. */
+  narrative: string | null;
+}
+
+/** Pull a short error string out of a run's `error` json (a {message} or a DurableRunDetail). */
+function errorText(error: unknown): string | null {
+  if (error == null) return null;
+  if (typeof error === "string") return error;
+  if (typeof error !== "object") return null;
+  const e = error as Record<string, unknown>;
+  if (typeof e.message === "string") return e.message;
+  const le = e.lastError as { title?: unknown } | undefined;
+  if (le && typeof le.title === "string") return le.title;
+  return null;
+}
+
+function ref(run: DigestInputRun): DigestRunRef {
+  return {
+    automationId: run.automationId,
+    automationName: run.automationName,
+    createdAt: run.createdAt,
+    error: errorText(run.error),
+  };
+}
+
+// Most-recent-first within each bucket.
+function byNewest(a: DigestInputRun, b: DigestInputRun): number {
+  return a.createdAt < b.createdAt ? 1 : a.createdAt > b.createdAt ? -1 : 0;
+}
+
+/**
+ * Aggregate recent runs into a prioritized digest. Deterministic and pure — the
+ * caller passes the period boundaries (ISO). Runs outside the period should
+ * already be filtered out by the query; this counts whatever it's given.
+ */
+export function buildDigest(
+  runs: DigestInputRun[],
+  periodStart: string,
+  periodEnd: string,
+): AutomationDigest {
+  const sorted = [...runs].sort(byNewest);
+  const failures = sorted.filter((r) => r.status === "failed").map(ref);
+  const waiting = sorted.filter((r) => r.status === "waiting").map(ref);
+  const retrying = sorted.filter((r) => r.status === "retrying").map(ref);
+  const finished = sorted.filter((r) => r.status === "finished").length;
+  const other = sorted.length - failures.length - waiting.length - retrying.length - finished;
+
+  const totals = {
+    total: sorted.length,
+    finished,
+    failed: failures.length,
+    waiting: waiting.length,
+    retrying: retrying.length,
+    other,
+  };
+
+  // Headline leads with the most important nonzero signal.
+  const parts: string[] = [`${totals.total} run${totals.total === 1 ? "" : "s"}`];
+  if (totals.failed) parts.push(`${totals.failed} failed`);
+  if (totals.waiting) parts.push(`${totals.waiting} waiting for approval`);
+  if (totals.retrying) parts.push(`${totals.retrying} retrying`);
+  if (totals.finished) parts.push(`${totals.finished} ok`);
+  const headline =
+    totals.total === 0 ? "No automation activity in the last day" : parts.join(" · ");
+
+  return {
+    kind: DIGEST_KIND,
+    periodStart,
+    periodEnd,
+    totals,
+    failures,
+    waiting,
+    retrying,
+    headline,
+    narrative: null,
+  };
+}
+
+/** Instructions for the digest narrator LLM — kept next to the shape it summarizes. */
+export const DIGEST_NARRATOR_INSTRUCTIONS =
+  "You write a short daily digest for a user's automation activity. Given a JSON " +
+  "summary of the last day's automation runs, write 1–3 plain sentences a busy " +
+  "operator can skim: lead with what needs attention (failures, then approvals " +
+  "waiting, then retries), then a one-line reassurance about what ran fine. Name " +
+  "specific automations and error reasons when present. Be concrete and calm — no " +
+  "preamble, no bullet lists, no markdown, no emojis. If nothing ran, say so in one line.";
+
+/**
+ * The prompt fed to the narrator LLM — a compact JSON view of the structured
+ * digest. Pure + deterministic so it's unit-testable and the LLM call stays thin.
+ */
+export function buildDigestNarrativePrompt(digest: AutomationDigest): string {
+  const compact = {
+    totals: digest.totals,
+    failures: digest.failures.map((f) => ({ automation: f.automationName, error: f.error })),
+    waiting: digest.waiting.map((w) => ({ automation: w.automationName })),
+    retrying: digest.retrying.map((r) => ({ automation: r.automationName })),
+  };
+  return `Summarize this automation activity for the last day:\n${JSON.stringify(compact, null, 2)}`;
+}
diff --git a/packages/agents/src/lib/automations/inbox-priority.ts b/packages/agents/src/lib/automations/inbox-priority.ts
new file mode 100644
index 00000000..90e41c1b
--- /dev/null
+++ b/packages/agents/src/lib/automations/inbox-priority.ts
@@ -0,0 +1,127 @@
+/**
+ * Inbox prioritization scoring (foreman-6r9y). Pure + deterministic: given an
+ * automation's live trigger-inbox state and its recent messages, produce an
+ * importance/urgency score, a coarse level, and human-readable reasons. No SDK,
+ * no hidden clock — the caller passes `now` (defaults to Date.now()) so the
+ * staleness signal is testable.
+ *
+ * Signals (all read from fields Zapier/Foreman actually expose):
+ *   - trigger_failed automation status ......... the trigger itself is broken (critical)
+ *   - inbox paused / not active ................ deliveries are halted, needs a human
+ *   - messages carrying error_message .......... processing is failing
+ *   - messages redelivered (lease_count > 1) ... stuck / repeatedly retried
+ *   - stale pending messages (oldest age) ...... backlog aging out
+ *   - possible_duplicate_data .................. noise only (surfaced, not scored up)
+ */
+
+export interface ScorableMessage {
+  created_at: string;
+  status: string;
+  message_attributes: {
+    lease_count: number;
+    error_message: string | null;
+    possible_duplicate_data: boolean;
+  };
+}
+
+export interface InboxPriorityInput {
+  /** Foreman automation.status — "trigger_failed" means the subscription broke. */
+  automationStatus: string;
+  enabled: boolean;
+  /** Live trigger-inbox status ("active"/"paused"/…) or null when unavailable. */
+  inboxStatus: string | null;
+  inboxPausedReason: string | null;
+  messages: ScorableMessage[];
+  /** Injected for deterministic tests; defaults to Date.now(). */
+  now?: number;
+}
+
+export type InboxPriorityLevel = "high" | "medium" | "low";
+
+export interface InboxPriority {
+  score: number;
+  level: InboxPriorityLevel;
+  reasons: string[];
+}
+
+const HIGH_THRESHOLD = 40;
+const MEDIUM_THRESHOLD = 15;
+const STALE_MS = 60 * 60 * 1000; // pending older than 1h starts adding urgency
+const HOUR_MS = 60 * 60 * 1000;
+
+// A message in one of these states is done — it neither ages nor adds backlog.
+const TERMINAL_MESSAGE_STATUS = new Set([
+  "processed",
+  "acked",
+  "done",
+  "completed",
+  "succeeded",
+  "success",
+]);
+
+function plural(n: number, word: string): string {
+  return `${n} ${word}${n === 1 ? "" : "s"}`;
+}
+
+/**
+ * Score one automation's inbox for the "what needs attention" ranking. Higher =
+ * more urgent. The reasons array is the human-facing explanation of the score.
+ */
+export function scoreInboxEntry(input: InboxPriorityInput): InboxPriority {
+  const now = input.now ?? Date.now();
+  const reasons: string[] = [];
+  let score = 0;
+
+  if (input.automationStatus === "trigger_failed") {
+    score += 50;
+    reasons.push("trigger is failing");
+  }
+
+  if ((input.inboxStatus && input.inboxStatus !== "active") || input.inboxPausedReason) {
+    score += 20;
+    reasons.push(
+      input.inboxPausedReason ? `inbox paused: ${input.inboxPausedReason}` : "inbox not active",
+    );
+  }
+
+  const errored = input.messages.filter((m) => m.message_attributes.error_message).length;
+  if (errored > 0) {
+    score += Math.min(errored, 5) * 15;
+    reasons.push(`${plural(errored, "message")} errored`);
+  }
+
+  const stuck = input.messages.filter((m) => m.message_attributes.lease_count > 1).length;
+  if (stuck > 0) {
+    score += Math.min(stuck, 5) * 10;
+    reasons.push(`${plural(stuck, "message")} stuck (redelivered)`);
+  }
+
+  const pending = input.messages.filter(
+    (m) => !TERMINAL_MESSAGE_STATUS.has(m.status.toLowerCase()),
+  );
+  if (pending.length > 0) {
+    score += Math.min(pending.length, 10) * 3;
+    reasons.push(`${plural(pending.length, "pending message")}`);
+
+    const oldest = pending.reduce((min, m) => {
+      const t = Date.parse(m.created_at);
+      return Number.isNaN(t) ? min : Math.min(min, t);
+    }, now);
+    const ageMs = now - oldest;
+    if (ageMs > STALE_MS) {
+      const hours = Math.floor(ageMs / HOUR_MS);
+      score += Math.min(hours, 24) * 2;
+      reasons.push(`oldest pending ~${hours}h old`);
+    }
+  }
+
+  const dupes = input.messages.filter((m) => m.message_attributes.possible_duplicate_data).length;
+  if (dupes > 0) reasons.push(`${plural(dupes, "possible duplicate")}`);
+
+  if (!input.enabled) reasons.push("automation disabled");
+
+  const level: InboxPriorityLevel =
+    score >= HIGH_THRESHOLD ? "high" : score >= MEDIUM_THRESHOLD ? "medium" : "low";
+
+  return { score, level, reasons };
+}
diff --git a/packages/agents/src/lib/automations/schedules.ts b/packages/agents/src/lib/automations/schedules.ts
new file mode 100644
index 00000000..911bd3ce
--- /dev/null
+++ b/packages/agents/src/lib/automations/schedules.ts
@@ -0,0 +1,82 @@
+/**
+ * Imperative Mastra schedule management for automations (foreman-bhb5). Replaces
+ * the custom `runDueSchedules` worker + `schedule.ts`. When a user creates a
+ * scheduled/digest automation, we register a row in Mastra's schedules storage
+ * (`SchedulesPG`) targeting a workflow with per-automation `inputData`; Mastra's
+ * `WorkflowScheduler` then fires it on cron (CAS-deduped across instances). On
+ * delete we remove the row.
+ *
+ * `getMastra` is imported lazily to avoid a static cycle
+ * (service → mastra/index → agents → tools → service).
+ */
+import { computeNextFireAt, validateCron } from "@mastra/core/workflows";
+
+/** Workflow a schedule fires: the digest synthesizer, or the durable runner. */
+export type ScheduleTargetWorkflow = "daily-digest" | "run-automation";
+
+/** Stable schedule id for an automation — one schedule per automation. */
+export function scheduleIdFor(automationId: string): string {
+  return `foreman-auto-${automationId}`;
+}
+
+async function getSchedulesStore() {
+  const { getMastra } = await import("../../mastra");
+  return (await getMastra().getStorage()?.getStore("schedules")) ?? null;
+}
+
+/** Throw early on an invalid cron so create_automation surfaces it to the agent. */
+export function assertValidCron(cron: string, timezone?: string): void {
+  validateCron(cron, timezone);
+}
+
+/**
+ * Register (or replace) an automation's cron schedule. Deletes any existing row
+ * first so an edit is idempotent. Returns false if the schedules store is
+ * unavailable (e.g. storage not configured).
+ */
+export async function registerAutomationSchedule(opts: {
+  automationId: string;
+  workspaceId: string | null;
+  workflow: ScheduleTargetWorkflow;
+  cron: string;
+  timezone?: string;
+}): Promise<boolean> {
+  validateCron(opts.cron, opts.timezone);
+  const store = await getSchedulesStore();
+  if (!store) return false;
+
+  const id = scheduleIdFor(opts.automationId);
+  try {
+    await store.deleteSchedule(id);
+  } catch {
+    // No existing row — fine.
+  }
+
+  const now = Date.now();
+  await store.createSchedule({
+    id,
+    target: {
+      type: "workflow",
+      workflowId: opts.workflow,
+      inputData: { workspaceId: opts.workspaceId, automationId: opts.automationId },
+    },
+    cron: opts.cron,
+    timezone: opts.timezone,
+    status: "active",
+    nextFireAt: computeNextFireAt(opts.cron, { timezone: opts.timezone }),
+    createdAt: now,
+    updatedAt: now,
+  });
+  return true;
+}
+
+/** Remove an automation's schedule (best-effort; no-op if absent). */
+export async function unregisterAutomationSchedule(automationId: string): Promise<void> {
+  const store = await getSchedulesStore();
+  if (!store) return;
+  try {
+    await store.deleteSchedule(scheduleIdFor(automationId));
+  } catch {
+    // Already gone — fine.
+  }
+}
diff --git a/packages/agents/src/lib/automations/service.ts b/packages/agents/src/lib/automations/service.ts
new file mode 100644
index 00000000..f099f217
--- /dev/null
+++ b/packages/agents/src/lib/automations/service.ts
@@ -0,0 +1,478 @@
+import { randomUUID } from "node:crypto";
+import {
+  cancelDurableRun,
+  deleteAutomation as deleteZapierWorkflow,
+  deployAutomation,
+  getTriggerRunStatus,
+  postCallback,
+  resolveCallbackUrl,
+  setAutomationEnabled,
+  triggerAutomation,
+} from "../durable";
+import type { DeployResult } from "../durable/deploy";
+import { resolveActiveWorkspace } from "../identity";
+import { getInbox, listInboxMessages } from "../trigger-inbox";
+import { type ExperimentalZapierSdk, getExperimentalSdkForUser } from "../zapier/sdk";
+import type { AutomationDigest } from "./digest";
+import { type InboxPriority, scoreInboxEntry } from "./inbox-priority";
+import {
+  assertValidCron,
+  registerAutomationSchedule,
+  unregisterAutomationSchedule,
+} from "./schedules";
+import type { AutomationRow, AutomationRunRow } from "./store";
+import * as store from "./store";
+
+/** A cron schedule for an automation (foreman-bhb5) — Mastra owns the firing. */
+export interface CronSchedule {
+  /** 5-, 6-, or 7-part cron expression (validated by Mastra). */
+  cron: string;
+  /** Optional IANA timezone; defaults to the host tz. */
+  timezone?: string;
+}
+
+import type { InboxTriggerSpec } from "./types";
+
+/**
+ * Automation orchestration (foreman-l7xq M2). Composes the durable deploy/run
+ * layer (M1) with workspace-scoped persistence (store), so the agent tools and
+ * the web routes share one code path. Workspace is resolved from the user's
+ * active workspace when a caller doesn't pass one explicitly.
+ */
+
+function statusFor(deployed: DeployResult): string {
+  if (deployed.triggerClaimFailed) return "trigger_claim_failed";
+  return deployed.enabled ? "active" : "disabled";
+}
+
+export interface ProvisionInput {
+  userId: string;
+  /** Explicit workspace (web route); falls back to the user's active workspace. */
+  workspaceId?: string | null;
+  name: string;
+  description?: string;
+  /** The durable workflow source. Optional only for a digest (no durable runs). */
+  source?: string;
+  connections?: Record<string, string | number>;
+  /** Trigger-inbox subscription that fires this automation; omit for manual. The
+   *  worker (M3) arms the inbox idempotently on its next cycle. */
+  trigger?: InboxTriggerSpec;
+  /** Cron schedule that fires this automation (foreman-bhb5). Mutually exclusive
+   *  with `trigger`; Mastra's WorkflowScheduler owns the firing. */
+  schedule?: CronSchedule;
+  /** With `schedule`, makes this a daily digest — synthesized by the daily-digest workflow, no durable. */
+  digest?: boolean;
+  enabled?: boolean;
+  isPrivate?: boolean;
+}
+
+export interface ProvisionResult extends DeployResult {
+  /** The Foreman automation id (the workspace-scoped record). */
+  id: string;
+}
+
+/** Deploy a durable automation to Zapier and persist it as a workspace resource. */
+export async function provisionAutomation(input: ProvisionInput): Promise<ProvisionResult> {
+  const workspaceId = input.workspaceId ?? (await resolveActiveWorkspace(input.userId));
+
+  // Validate the cron up front (throws) so the agent sees a clear error; persist
+  // the schedule on the trigger json for display/inspection.
+  if (input.schedule) assertValidCron(input.schedule.cron, input.schedule.timezone);
+  const scheduleTrigger = input.schedule
+    ? { schedule: input.schedule, ...(input.digest ? { digest: true } : {}) }
+    : null;
+
+  // A digest has no durable — the daily-digest workflow synthesizes it. Persist it
+  // with a unique sentinel workflow id (never sent to Zapier) so the shared
+  // automation schema stays uniform without a nullable-column migration, then
+  // register a Mastra schedule that fires the digest workflow on cron.
+  if (input.schedule && input.digest) {
+    const id = await store.createAutomation({
+      userId: input.userId,
+      workspaceId: workspaceId ?? null,
+      name: input.name,
+      description: input.description ?? null,
+      zapierWorkflowId: `foreman:digest:${randomUUID()}`,
+      zapierVersionId: null,
+      source: input.source ?? "",
+      connections: input.connections,
+      trigger: scheduleTrigger,
+      enabled: input.enabled ?? true,
+      status: "active",
+      editorUrl: null,
+      triggerUrl: null,
+    });
+    await registerAutomationSchedule({
+      automationId: id,
+      workspaceId: workspaceId ?? null,
+      workflow: "daily-digest",
+      cron: input.schedule.cron,
+      timezone: input.schedule.timezone,
+    });
+    return {
+      id,
+      workflowId: "",
+      versionId: "",
+      enabled: input.enabled ?? true,
+      isPrivate: true,
+      editorUrl: "",
+      triggerUrl: "",
+      triggerClaimFailed: false,
+      disabledReason: null,
+    };
+  }
+
+  const sdk = await getExperimentalSdkForUser(input.userId);
+
+  // Deploy as a manual durable (no Zapier-claimed trigger). Triggering is either
+  // the inbox worker (event) or Mastra's scheduler (cron) — Foreman owns the firing.
+  const deployed = await deployAutomation({
+    sdk,
+    name: input.name,
+    description: input.description,
+    source: input.source ?? "",
+    connections: input.connections,
+    enabled: input.enabled,
+    isPrivate: input.isPrivate,
+  });
+
+  const id = await store.createAutomation({
+    userId: input.userId,
+    workspaceId: workspaceId ?? null,
+    name: input.name,
+    description: input.description ?? null,
+    zapierWorkflowId: deployed.workflowId,
+    zapierVersionId: deployed.versionId,
+    source: input.source ?? "",
+    connections: input.connections,
+    // A schedule wins over an event trigger; otherwise persist the event spec.
+    trigger: scheduleTrigger ?? (input.trigger ? { ...input.trigger } : null),
+    enabled: deployed.enabled,
+    status: statusFor(deployed),
+    editorUrl: deployed.editorUrl,
+    triggerUrl: deployed.triggerUrl,
+  });
+
+  // A scheduled durable fires via Mastra's scheduler → the run-automation workflow.
+  if (input.schedule) {
+    await registerAutomationSchedule({
+      automationId: id,
+      workspaceId: workspaceId ?? null,
+      workflow: "run-automation",
+      cron: input.schedule.cron,
+      timezone: input.schedule.timezone,
+    });
+  }
+
+  return { id, ...deployed };
+}
+
+export async function listForUser(userId: string): Promise<AutomationRow[]> {
+  const workspaceId = (await resolveActiveWorkspace(userId)) ?? undefined;
+  return store.listAutomations(workspaceId);
+}
+
+export async function inspectForUser(
+  userId: string,
+  automationId: string,
+  maxRuns = 20,
+): Promise<{ automation: AutomationRow; runs: AutomationRunRow[] } | null> {
+  const workspaceId = (await resolveActiveWorkspace(userId)) ?? undefined;
+  const automation = await store.getAutomation(workspaceId, automationId);
+  if (!automation) return null;
+  const runs = await store.listRuns(workspaceId, automationId, maxRuns);
+  return { automation, runs };
+}
+
+export interface InboxView {
+  /** Live trigger-inbox state, or null if the worker hasn't armed it yet. */
+  inbox: Awaited<ReturnType<typeof getInbox>> | null;
+  /** Recent leased/queued messages (metadata + lease_count / possible_duplicate_data). */
+  messages: Awaited<ReturnType<typeof listInboxMessages>>;
+}
+
+/** Live trigger-inbox view for an automation (the inbox-visibility panel). Null if not found. */
+export async function getInboxView(
+  userId: string,
+  automationId: string,
+): Promise<InboxView | null> {
+  const workspaceId = (await resolveActiveWorkspace(userId)) ?? undefined;
+  const automation = await store.getAutomation(workspaceId, automationId);
+  if (!automation) return null;
+  if (!automation.trigger_inbox_id) return { inbox: null, messages: [] };
+
+  const sdk = await getExperimentalSdkForUser(userId);
+  const [inbox, messages] = await Promise.all([
+    getInbox(sdk, automation.trigger_inbox_id),
+    listInboxMessages(sdk, automation.trigger_inbox_id, 20),
+  ]);
+  return { inbox, messages };
+}
+
+export interface WorkspaceInboxEntry {
+  automation: Pick<AutomationRow, "id" | "name" | "enabled" | "trigger" | "status">;
+  /** Which workspace member owns this automation (foreman-6r9y teammate aggregation). */
+  owner: { userId: string; isSelf: boolean };
+  inbox: InboxView["inbox"];
+  messages: InboxView["messages"];
+  /** Importance/urgency ranking for the "what needs attention" view (foreman-6r9y). */
+  priority: InboxPriority;
+}
+
+export interface WorkspaceInboxResult {
+  entries: WorkspaceInboxEntry[];
+  /** The workspace's most recent daily digest, if one has run (foreman-ufo3.2). */
+  digest: AutomationDigest | null;
+}
+
+/**
+ * Workspace-wide trigger inbox: every automation's live inbox + recent messages
+ * in ONE call (the web /inbox page's source), ranked by how much attention each
+ * needs, plus the latest daily digest. Automations are a shared workspace
+ * resource, so this already spans every member — but each trigger inbox lives
+ * under its OWNER's Zapier identity, so we read each inbox with the owner's SDK
+ * (reading a teammate's inbox with the requester's SDK 403s). One SDK is resolved
+ * per distinct owner and cached; an un-connected owner or a per-inbox failure
+ * degrades to an empty entry rather than failing the whole view. Entries come
+ * back sorted highest-priority first.
+ */
+export async function getWorkspaceInbox(userId: string): Promise<WorkspaceInboxResult> {
+  const workspaceId = (await resolveActiveWorkspace(userId)) ?? undefined;
+  const digest = workspaceId
+    ? ((await store.getLatestDigest(workspaceId)) as AutomationDigest | null)
+    : null;
+  const automations = await store.listAutomations(workspaceId);
+  const withInbox = automations.filter((a): a is AutomationRow & { trigger_inbox_id: string } =>
+    Boolean(a.trigger_inbox_id),
+  );
+  if (withInbox.length === 0) return { entries: [], digest };
+
+  // Resolve one experimental SDK per distinct owner (cached; null = can't read).
+  const sdkByOwner = new Map<string, Promise<ExperimentalZapierSdk | null>>();
+  const sdkFor = (ownerId: string): Promise<ExperimentalZapierSdk | null> => {
+    let p = sdkByOwner.get(ownerId);
+    if (!p) {
+      p = getExperimentalSdkForUser(ownerId).catch(() => null);
+      sdkByOwner.set(ownerId, p);
+    }
+    return p;
+  };
+
+  const entries = await Promise.all(
+    withInbox.map(async (a): Promise<WorkspaceInboxEntry> => {
+      const automation = {
+        id: a.id,
+        name: a.name,
+        enabled: a.enabled,
+        trigger: a.trigger,
+        status: a.status,
+      };
+      const owner = { userId: a.user_id, isSelf: a.user_id === userId };
+
+      let inbox: InboxView["inbox"] = null;
+      let messages: InboxView["messages"] = [];
+      const sdk = await sdkFor(a.user_id);
+      if (sdk) {
+        try {
+          [inbox, messages] = await Promise.all([
+            getInbox(sdk, a.trigger_inbox_id),
+            listInboxMessages(sdk, a.trigger_inbox_id, 20),
+          ]);
+        } catch {
+          inbox = null;
+          messages = [];
+        }
+      }
+
+      const priority = scoreInboxEntry({
+        automationStatus: a.status,
+        enabled: a.enabled,
+        inboxStatus: inbox?.status ?? null,
+        inboxPausedReason: inbox?.paused_reason ?? null,
+        messages,
+      });
+
+      return { automation, owner, inbox, messages, priority };
+    }),
+  );
+
+  // Rank: most-needs-attention first. Stable for equal scores (Array.sort keeps
+  // the listAutomations updated_at order on ties).
+  entries.sort((x, y) => y.priority.score - x.priority.score);
+  return { entries, digest };
+}
+
+export interface RunResult {
+  runId: string;
+  triggerId: string;
+  status: string;
+  durableRunId: string | null;
+}
+
+/** Manually fire an automation by its Foreman id; records the run. Returns null if not found. */
+export async function runAutomationById(
+  userId: string,
+  automationId: string,
+  runInput?: Record<string, unknown>,
+): Promise<RunResult | null> {
+  const workspaceId = (await resolveActiveWorkspace(userId)) ?? undefined;
+  const automation = await store.getAutomation(workspaceId, automationId);
+  if (!automation) return null;
+
+  const sdk = await getExperimentalSdkForUser(userId);
+  const { triggerId } = await triggerAutomation({
+    sdk,
+    workflowId: automation.zapier_workflow_id,
+    input: runInput,
+  });
+  const run = await getTriggerRunStatus(sdk, triggerId);
+
+  const runId = await store.recordRun({
+    automationId,
+    workspaceId: workspaceId ?? null,
+    triggerId,
+    durableRunId: run.durableRunId,
+    status: run.status,
+    input: runInput,
+  });
+
+  return { runId, triggerId, status: run.status, durableRunId: run.durableRunId };
+}
+
+const TERMINAL_RUN = new Set(["finished", "failed", "cancelled"]);
+
+export interface CancelRunResult {
+  cancelled: boolean;
+  status: string;
+}
+
+/**
+ * Cancel a running automation run (foreman-y4kc). Workspace-scoped: returns null if
+ * the run isn't in the caller's workspace. Already-terminal runs are a no-op. A run
+ * that hasn't linked its durable yet is cancelled locally (so reconcile stops
+ * chasing it); otherwise cancelDurableRun stops it on Zapier and we record the
+ * resulting status.
+ */
+export async function cancelRunForUser(
+  userId: string,
+  runId: string,
+): Promise<CancelRunResult | null> {
+  const workspaceId = (await resolveActiveWorkspace(userId)) ?? undefined;
+  const run = await store.getRun(workspaceId, runId);
+  if (!run) return null;
+  if (TERMINAL_RUN.has(run.status)) return { cancelled: false, status: run.status };
+
+  if (!run.durable_run_id) {
+    await store.updateRun(run.id, { status: "cancelled" });
+    return { cancelled: true, status: "cancelled" };
+  }
+
+  const sdk = await getExperimentalSdkForUser(userId);
+  const status = await cancelDurableRun(sdk, run.durable_run_id);
+  await store.updateRun(run.id, { status });
+  return { cancelled: status === "cancelled", status };
+}
+
+export interface CallbackResponseInput {
+  /** Payload to POST to the gate — resumes the durable (approve). */
+  payload?: unknown;
+  /** Cancel the whole run instead of resuming (hard deny). */
+  cancel?: boolean;
+  /** Which gate, when the durable has more than one open callback. */
+  callbackName?: string;
+}
+
+export interface CallbackResponseResult {
+  ok: boolean;
+  action: "resumed" | "cancelled" | "none";
+  /** HTTP status of the callback POST (resume only). */
+  status?: number;
+  /** Why it couldn't act, when ok=false. */
+  reason?: string;
+}
+
+/**
+ * Respond to a durable's human-approval gate (foreman-zfnj). Approve = POST the
+ * payload to the callback URL (resolved server-side and never exposed to the
+ * client); hard-deny = cancel the run. The run stays "waiting" in Foreman until
+ * reconcile advances it (the durable leaves "waiting" once the callback lands).
+ * Returns null if the run isn't in the caller's workspace.
+ */
+export async function respondToCallbackForUser(
+  userId: string,
+  runId: string,
+  input: CallbackResponseInput,
+): Promise<CallbackResponseResult | null> {
+  const workspaceId = (await resolveActiveWorkspace(userId)) ?? undefined;
+  const run = await store.getRun(workspaceId, runId);
+  if (!run) return null;
+  if (run.status !== "waiting" || !run.durable_run_id) {
+    return { ok: false, action: "none", reason: "run is not waiting on a callback" };
+  }
+
+  const sdk = await getExperimentalSdkForUser(userId);
+
+  if (input.cancel) {
+    const status = await cancelDurableRun(sdk, run.durable_run_id);
+    await store.updateRun(run.id, { status });
+    return { ok: status === "cancelled", action: "cancelled" };
+  }
+
+  const cb = await resolveCallbackUrl(sdk, run.durable_run_id, input.callbackName);
+  if (!cb) {
+    return { ok: false, action: "none", reason: "no open callback URL for this run" };
+  }
+  const res = await postCallback(cb.url, input.payload ?? {});
+  return { ok: res.ok, action: "resumed", status: res.status };
+}
+
+export interface UpdateInput {
+  name?: string;
+  description?: string | null;
+  enabled?: boolean;
+}
+
+/** Rename / re-describe / enable-disable an automation, syncing the enabled flag to Zapier. */
+export async function updateAutomationForUser(
+  userId: string,
+  automationId: string,
+  patch: UpdateInput,
+): Promise<boolean> {
+  const workspaceId = (await resolveActiveWorkspace(userId)) ?? undefined;
+  const automation = await store.getAutomation(workspaceId, automationId);
+  if (!automation) return false;
+
+  let status = automation.status;
+  if (patch.enabled !== undefined && patch.enabled !== automation.enabled) {
+    const sdk = await getExperimentalSdkForUser(userId);
+    const enabled = await setAutomationEnabled(sdk, automation.zapier_workflow_id, patch.enabled);
+    status = enabled ? "active" : "disabled";
+  }
+
+  return store.updateAutomation(workspaceId, automationId, {
+    name: patch.name,
+    description: patch.description,
+    enabled: patch.enabled,
+    status: patch.enabled !== undefined ? status : undefined,
+  });
+}
+
+/** Delete the automation (workspace-scoped) and best-effort remove its Zapier workflow. */
+export async function removeAutomationForUser(
+  userId: string,
+  automationId: string,
+): Promise<boolean> {
+  const workspaceId = (await resolveActiveWorkspace(userId)) ?? undefined;
+  const removed = await store.deleteAutomation(workspaceId, automationId);
+  if (!removed) return false;
+  // Remove its Mastra cron schedule (no-op if it wasn't scheduled).
+  await unregisterAutomationSchedule(automationId);
+  try {
+    const sdk = await getExperimentalSdkForUser(userId);
+    await deleteZapierWorkflow(sdk, removed.zapier_workflow_id);
+  } catch {
+    // The Foreman record is gone; Zapier cleanup is best-effort (the workflow can
+    // be reaped separately). Don't fail the delete on a Zapier hiccup.
+  }
+  return true;
+}
diff --git a/packages/agents/src/lib/automations/store.ts b/packages/agents/src/lib/automations/store.ts
new file mode 100644
index 00000000..a87523c7
--- /dev/null
+++ b/packages/agents/src/lib/automations/store.ts
@@ -0,0 +1,421 @@
+import { randomUUID } from "node:crypto";
+import { getSupabase } from "../db";
+
+/**
+ * Automation persistence (foreman-l7xq M2). A SHARED workspace resource — all
+ * reads/writes are scoped by workspace_id ("shared resources, private chats").
+ * Zapier remains the execution store; these rows are Foreman's index of the
+ * workspace's automations + their run history (and the idempotency store the
+ * inbox worker uses in M3). Service-role access only (matches artifact).
+ */
+
+export interface AutomationRow {
+  id: string;
+  user_id: string;
+  workspace_id: string | null;
+  name: string;
+  description: string | null;
+  zapier_workflow_id: string;
+  zapier_version_id: string | null;
+  source: string;
+  connections: Record<string, string | number>;
+  trigger: Record<string, unknown> | null;
+  trigger_inbox_id: string | null;
+  enabled: boolean;
+  status: string;
+  editor_url: string | null;
+  trigger_url: string | null;
+  created_at: string;
+  updated_at: string;
+}
+
+export interface AutomationRunRow {
+  id: string;
+  automation_id: string;
+  workspace_id: string | null;
+  inbox_message_id: string | null;
+  trigger_id: string | null;
+  durable_run_id: string | null;
+  workflow_version_id: string | null;
+  status: string;
+  input: unknown;
+  output: unknown;
+  error: unknown;
+  created_at: string;
+  updated_at: string;
+}
+
+export interface CreateAutomationInput {
+  userId: string;
+  workspaceId: string | null;
+  name: string;
+  description?: string | null;
+  zapierWorkflowId: string;
+  zapierVersionId?: string | null;
+  source: string;
+  connections?: Record<string, string | number>;
+  trigger?: Record<string, unknown> | null;
+  triggerInboxId?: string | null;
+  enabled?: boolean;
+  status?: string;
+  editorUrl?: string | null;
+  triggerUrl?: string | null;
+}
+
+export async function createAutomation(input: CreateAutomationInput): Promise<string> {
+  const supabase = getSupabase();
+  const id = randomUUID();
+  const now = new Date().toISOString();
+  const { error } = await supabase.from("automation").insert({
+    id,
+    user_id: input.userId,
+    workspace_id: input.workspaceId,
+    name: input.name,
+    description: input.description ?? null,
+    zapier_workflow_id: input.zapierWorkflowId,
+    zapier_version_id: input.zapierVersionId ?? null,
+    source: input.source,
+    connections: input.connections ?? {},
+    trigger: (input.trigger ?? null) as never,
+    trigger_inbox_id: input.triggerInboxId ?? null,
+    enabled: input.enabled ?? false,
+    status: input.status ?? "active",
+    editor_url: input.editorUrl ?? null,
+    trigger_url: input.triggerUrl ?? null,
+    created_at: now,
+    updated_at: now,
+  });
+  if (error) throw new Error(`createAutomation failed: ${error.message}`);
+  return id;
+}
+
+export async function listAutomations(workspaceId: string | undefined): Promise<AutomationRow[]> {
+  if (!workspaceId) return [];
+  const supabase = getSupabase();
+  const { data } = await supabase
+    .from("automation")
+    .select("*")
+    .eq("workspace_id", workspaceId)
+    .order("updated_at", { ascending: false });
+  return (data ?? []) as unknown as AutomationRow[];
+}
+
+export async function getAutomation(
+  workspaceId: string | undefined,
+  id: string,
+): Promise<AutomationRow | null> {
+  if (!workspaceId) return null;
+  const supabase = getSupabase();
+  const { data } = await supabase
+    .from("automation")
+    .select("*")
+    .eq("workspace_id", workspaceId)
+    .eq("id", id)
+    .maybeSingle();
+  return (data as unknown as AutomationRow) ?? null;
+}
+
+/**
+ * All enabled, inbox-triggered automations across workspaces — the worker's work
+ * list (M3). Inbox-triggered = the trigger jsonb carries an app + action.
+ */
+export async function listActiveInboxAutomations(): Promise<AutomationRow[]> {
+  const supabase = getSupabase();
+  const { data } = await supabase
+    .from("automation")
+    .select("*")
+    .eq("enabled", true)
+    .not("trigger", "is", null);
+  const rows = (data ?? []) as unknown as AutomationRow[];
+  return rows.filter((r) => {
+    const t = r.trigger as { app?: unknown; action?: unknown } | null;
+    return !!t && typeof t.app === "string" && typeof t.action === "string";
+  });
+}
+
+/** Reverse lookup used by the inbox worker (M3) to resolve a Zapier workflow to its automation. */
+export async function getAutomationByZapierWorkflowId(
+  zapierWorkflowId: string,
+): Promise<AutomationRow | null> {
+  const supabase = getSupabase();
+  const { data } = await supabase
+    .from("automation")
+    .select("*")
+    .eq("zapier_workflow_id", zapierWorkflowId)
+    .maybeSingle();
+  return (data as unknown as AutomationRow) ?? null;
+}
+
+export interface AutomationPatch {
+  name?: string;
+  description?: string | null;
+  enabled?: boolean;
+  status?: string;
+  zapierVersionId?: string | null;
+  source?: string;
+  connections?: Record<string, string | number>;
+  trigger?: Record<string, unknown> | null;
+  triggerInboxId?: string | null;
+  editorUrl?: string | null;
+  triggerUrl?: string | null;
+}
+
+export async function updateAutomation(
+  workspaceId: string | undefined,
+  id: string,
+  patch: AutomationPatch,
+): Promise<boolean> {
+  if (!workspaceId) return false;
+  const row: Record<string, unknown> = { updated_at: new Date().toISOString() };
+  if (patch.name !== undefined) row.name = patch.name;
+  if (patch.description !== undefined) row.description = patch.description;
+  if (patch.enabled !== undefined) row.enabled = patch.enabled;
+  if (patch.status !== undefined) row.status = patch.status;
+  if (patch.zapierVersionId !== undefined) row.zapier_version_id = patch.zapierVersionId;
+  if (patch.source !== undefined) row.source = patch.source;
+  if (patch.connections !== undefined) row.connections = patch.connections;
+  if (patch.trigger !== undefined) row.trigger = patch.trigger;
+  if (patch.triggerInboxId !== undefined) row.trigger_inbox_id = patch.triggerInboxId;
+  if (patch.editorUrl !== undefined) row.editor_url = patch.editorUrl;
+  if (patch.triggerUrl !== undefined) row.trigger_url = patch.triggerUrl;
+
+  const supabase = getSupabase();
+  const { data } = await supabase
+    .from("automation")
+    .update(row as never)
+    .eq("workspace_id", workspaceId)
+    .eq("id", id)
+    .select("id")
+    .maybeSingle();
+  return !!data;
+}
+
+/** Delete the automation row (workspace-scoped) and return it so the caller can clean up Zapier. */
+export async function deleteAutomation(
+  workspaceId: string | undefined,
+  id: string,
+): Promise<AutomationRow | null> {
+  if (!workspaceId) return null;
+  const supabase = getSupabase();
+  const { data } = await supabase
+    .from("automation")
+    .delete()
+    .eq("workspace_id", workspaceId)
+    .eq("id", id)
+    .select("*")
+    .maybeSingle();
+  return (data as unknown as AutomationRow) ?? null;
+}
+
+// ─── Runs ───
+
+export interface RecordRunInput {
+  automationId: string;
+  workspaceId: string | null;
+  inboxMessageId?: string | null;
+  triggerId?: string | null;
+  durableRunId?: string | null;
+  workflowVersionId?: string | null;
+  status?: string;
+  input?: unknown;
+  output?: unknown;
+  error?: unknown;
+}
+
+export async function recordRun(input: RecordRunInput): Promise<string> {
+  const supabase = getSupabase();
+  const id = randomUUID();
+  const now = new Date().toISOString();
+  const { error } = await supabase.from("automation_run").insert({
+    id,
+    automation_id: input.automationId,
+    workspace_id: input.workspaceId,
+    inbox_message_id: input.inboxMessageId ?? null,
+    trigger_id: input.triggerId ?? null,
+    durable_run_id: input.durableRunId ?? null,
+    workflow_version_id: input.workflowVersionId ?? null,
+    status: input.status ?? "initialized",
+    input: (input.input ?? null) as never,
+    output: (input.output ?? null) as never,
+    error: (input.error ?? null) as never,
+    created_at: now,
+    updated_at: now,
+  });
+  if (error) throw new Error(`recordRun failed: ${error.message}`);
+  return id;
+}
+
+/**
+ * Idempotently claim a trigger-inbox message for an automation (M3 dedup). Inserts
+ * a run keyed by (automation_id, inbox_message_id); a duplicate delivery hits the
+ * unique index and returns null — the worker then skips it instead of re-running.
+ */
+export async function claimInboxMessage(input: {
+  automationId: string;
+  workspaceId: string | null;
+  inboxMessageId: string;
+}): Promise<string | null> {
+  const supabase = getSupabase();
+  const id = randomUUID();
+  const now = new Date().toISOString();
+  const { data, error } = await supabase
+    .from("automation_run")
+    .insert({
+      id,
+      automation_id: input.automationId,
+      workspace_id: input.workspaceId,
+      inbox_message_id: input.inboxMessageId,
+      status: "initialized",
+      created_at: now,
+      updated_at: now,
+    })
+    .select("id")
+    .maybeSingle();
+  if (error) {
+    if (error.code === "23505") return null; // unique violation → already claimed
+    throw new Error(`claimInboxMessage failed: ${error.message}`);
+  }
+  return data ? id : null;
+}
+
+export interface RunPatch {
+  status?: string;
+  durableRunId?: string | null;
+  triggerId?: string | null;
+  workflowVersionId?: string | null;
+  output?: unknown;
+  error?: unknown;
+}
+
+export async function updateRun(id: string, patch: RunPatch): Promise<void> {
+  const row: Record<string, unknown> = { updated_at: new Date().toISOString() };
+  if (patch.status !== undefined) row.status = patch.status;
+  if (patch.durableRunId !== undefined) row.durable_run_id = patch.durableRunId;
+  if (patch.triggerId !== undefined) row.trigger_id = patch.triggerId;
+  if (patch.workflowVersionId !== undefined) row.workflow_version_id = patch.workflowVersionId;
+  if (patch.output !== undefined) row.output = patch.output;
+  if (patch.error !== undefined) row.error = patch.error;
+  const supabase = getSupabase();
+  const { error } = await supabase
+    .from("automation_run")
+    .update(row as never)
+    .eq("id", id);
+  if (error) throw new Error(`updateRun failed: ${error.message}`);
+}
+
+/** Fetch a single run, workspace-scoped (the cancel route's authorization read). */
+export async function getRun(
+  workspaceId: string | undefined,
+  runId: string,
+): Promise<AutomationRunRow | null> {
+  if (!workspaceId) return null;
+  const supabase = getSupabase();
+  const { data } = await supabase
+    .from("automation_run")
+    .select("*")
+    .eq("workspace_id", workspaceId)
+    .eq("id", runId)
+    .maybeSingle();
+  return (data as unknown as AutomationRunRow) ?? null;
+}
+
+export async function listRuns(
+  workspaceId: string | undefined,
+  automationId: string,
+  limit = 20,
+): Promise<AutomationRunRow[]> {
+  if (!workspaceId) return [];
+  const supabase = getSupabase();
+  const { data } = await supabase
+    .from("automation_run")
+    .select("*")
+    .eq("workspace_id", workspaceId)
+    .eq("automation_id", automationId)
+    .order("created_at", { ascending: false })
+    .limit(limit);
+  return (data ?? []) as unknown as AutomationRunRow[];
+}
+
+/**
+ * Recent runs across the whole workspace since `sinceIso` — the digest's input
+ * (foreman-ufo3.2). Optionally excludes one automation (the digest excludes its
+ * own runs so it never summarizes itself).
+ */
+export async function listRecentRunsForWorkspace(
+  workspaceId: string,
+  sinceIso: string,
+  opts: { excludeAutomationId?: string; limit?: number } = {},
+): Promise<AutomationRunRow[]> {
+  const supabase = getSupabase();
+  let q = supabase
+    .from("automation_run")
+    .select("*")
+    .eq("workspace_id", workspaceId)
+    .gte("created_at", sinceIso)
+    .order("created_at", { ascending: false })
+    .limit(opts.limit ?? 500);
+  if (opts.excludeAutomationId) q = q.neq("automation_id", opts.excludeAutomationId);
+  const { data } = await q;
+  return (data ?? []) as unknown as AutomationRunRow[];
+}
+
+/**
+ * The workspace's most recent digest (foreman-ufo3.2) — the latest finished
+ * digest run's `output`, found via the `kind` discriminator in the output json.
+ * Returns the raw summary object (validated/typed by the caller) or null.
+ */
+export async function getLatestDigest(workspaceId: string): Promise<unknown | null> {
+  const supabase = getSupabase();
+  const { data } = await supabase
+    .from("automation_run")
+    .select("output, created_at")
+    .eq("workspace_id", workspaceId)
+    .eq("output->>kind", "automation_digest")
+    .order("created_at", { ascending: false })
+    .limit(1)
+    .maybeSingle();
+  return (data as { output?: unknown } | null)?.output ?? null;
+}
+
+/**
+ * automation_run.status vocabulary:
+ *   initialized → claimed (claimInboxMessage), not yet fired
+ *   started     → durable triggered + executing (dispatch sets this; the durable's
+ *                 own run is the authority — its trigger run status stays "started"
+ *                 the whole time, so we reconcile against getDurableRun, not it)
+ *   retrying    → a step is mid-retry (foreman-jc12); top-level durable status is
+ *                 still "started" but execution.detail carries last_error + the ops.
+ *                 Non-terminal — reconcile keeps polling until it clears/finishes.
+ *   waiting     → paused on a human-approval callback (foreman-rm8z; execution.status
+ *                 = waiting). Non-terminal — resumes when the callback is delivered.
+ *   finished    → durable completed (reconcile)
+ *   failed      → durable failed, or a dispatch error (reconcile / dispatch catch)
+ *   cancelled   → user cancelled a running durable (foreman-y4kc). Terminal.
+ */
+export const TERMINAL_RUN_STATUSES = ["finished", "failed", "cancelled"] as const;
+const NON_TERMINAL_RUN_STATUSES = ["initialized", "started", "retrying", "waiting"];
+
+/**
+ * Non-terminal runs across all automations — the reconcile work list
+ * (foreman-480k). Includes "initialized" rows with no trigger_id (a worker that
+ * crashed between claim and dispatch) so the reconcile's stuck-run cap can fail
+ * them; normal rows clear within the same cycle, so these are only crash debris.
+ */
+export async function listPendingRuns(limit = 200): Promise<AutomationRunRow[]> {
+  const supabase = getSupabase();
+  const { data } = await supabase
+    .from("automation_run")
+    .select("*")
+    .in("status", NON_TERMINAL_RUN_STATUSES)
+    .order("created_at", { ascending: true })
+    .limit(limit);
+  return (data ?? []) as unknown as AutomationRunRow[];
+}
+
+/** Resolve a set of automations by id (the reconcile needs each run's owner for SDK auth). */
+export async function getAutomationsByIds(ids: string[]): Promise<AutomationRow[]> {
+  if (ids.length === 0) return [];
+  const supabase = getSupabase();
+  const { data } = await supabase.from("automation").select("*").in("id", ids);
+  return (data ?? []) as unknown as AutomationRow[];
+}
diff --git a/packages/agents/src/lib/automations/types.ts b/packages/agents/src/lib/automations/types.ts
new file mode 100644
index 00000000..cc2a05cc
--- /dev/null
+++ b/packages/agents/src/lib/automations/types.ts
@@ -0,0 +1,22 @@
+/**
+ * Shared automation types (foreman-l7xq). The trigger model is the trigger-inbox
+ * (the locked design — Foreman owns the lease/ack loop): an automation's trigger
+ * is an inbox subscription, and the M3 worker leases it and fires the durable via
+ * triggerWorkflow. The durable itself deploys as a manual workflow.
+ */
+
+export interface InboxTriggerSpec {
+  /** Zapier app key/slug, e.g. "github" or "google-sheets". */
+  app: string;
+  /** Trigger key, e.g. "new_issue" / "new_row". */
+  action: string;
+  /** Connection id backing the trigger. */
+  connection?: string | number | null;
+  /** Trigger input fields, e.g. { repo: "owner/name" }. */
+  inputs?: Record<string, unknown>;
+}
+
+/** Stable trigger-inbox key for an automation — keyed on its Foreman id (ensureTriggerInbox is idempotent on key). */
+export function inboxKeyFor(automationId: string): string {
+  return `foreman-auto-${automationId}`;
+}
diff --git a/packages/agents/src/lib/automations/worker.ts b/packages/agents/src/lib/automations/worker.ts
new file mode 100644
index 00000000..9ef082f4
--- /dev/null
+++ b/packages/agents/src/lib/automations/worker.ts
@@ -0,0 +1,341 @@
+import { getDurableRunStatus, getTriggerRunStatus, triggerAutomation } from "../durable";
+import {
+  ackMessages,
+  ensureInbox,
+  type LeasedMessage,
+  leaseMessages,
+  releaseMessages,
+} from "../trigger-inbox";
+import { type ExperimentalZapierSdk, getExperimentalSdkForUser } from "../zapier/sdk";
+import type { AutomationRow } from "./store";
+import * as store from "./store";
+import { type InboxTriggerSpec, inboxKeyFor } from "./types";
+
+/**
+ * Trigger-inbox poll worker (foreman-l7xq M3). Replaces the removed
+ * cron-driver-server. Each cycle, for every active inbox-triggered automation:
+ * ensure its inbox (idempotent), lease a batch, dedup + dispatch each message to
+ * the durable via triggerWorkflow, record the run, then ack (done) / release
+ * (retry). Dedup is a DB constraint (claimInboxMessage) so an at-least-once
+ * redelivery can't double-fire. Single instance only — no distributed lock.
+ */
+
+type Sdk = ExperimentalZapierSdk;
+
+function inboxSpecOf(automation: AutomationRow): InboxTriggerSpec | null {
+  const t = automation.trigger as Partial<InboxTriggerSpec> | null;
+  if (!t || typeof t.app !== "string" || typeof t.action !== "string") return null;
+  return { app: t.app, action: t.action, connection: t.connection ?? null, inputs: t.inputs };
+}
+
+export type DispatchOutcome = "processed" | "skipped" | "failed";
+
+/**
+ * Opt-in event-level dedup (foreman-b8k2). Off by default: `possible_duplicate_data`
+ * is Zapier's HEURISTIC that the underlying event may be a re-delivery under a NEW
+ * message id (which our message-id claim can't catch), so skipping it risks dropping
+ * a real event. Flip this on for a known-flaky trigger; regardless, the inbox view
+ * always badges these messages so an operator can spot the pattern first.
+ */
+function skipPossibleDuplicates(): boolean {
+  return process.env.FOREMAN_SKIP_POSSIBLE_DUPLICATES === "true";
+}
+
+/**
+ * Claim (dedup) a single leased message and, if fresh, fire the durable and record
+ * the run. Returns "skipped" when the message was already claimed (redelivery) or
+ * dropped as a possible duplicate event (b8k2), "failed" when the trigger errored
+ * (caller releases it for retry).
+ */
+export async function dispatchMessage(opts: {
+  sdk: Sdk;
+  automation: AutomationRow;
+  message: LeasedMessage;
+}): Promise<DispatchOutcome> {
+  const { sdk, automation, message } = opts;
+
+  // Drop possible-duplicate events before claiming so they're acked, not re-run
+  // (foreman-b8k2). Only when explicitly enabled — see skipPossibleDuplicates().
+  if (skipPossibleDuplicates() && message.message_attributes.possible_duplicate_data) {
+    return "skipped";
+  }
+
+  const runId = await store.claimInboxMessage({
+    automationId: automation.id,
+    workspaceId: automation.workspace_id,
+    inboxMessageId: message.id,
+  });
+  if (!runId) return "skipped"; // already claimed — at-least-once redelivery
+
+  try {
+    const { triggerId } = await triggerAutomation({
+      sdk,
+      workflowId: automation.zapier_workflow_id,
+      input: message.payload,
+    });
+    // Fire-and-record. Do NOT poll for terminal status here: the durable may run
+    // for seconds to days (waits/callbacks), and the trigger run's own status is
+    // pinned at "started" anyway. reconcilePendingRuns() resolves the real
+    // durable_run_id + finished/failed on a later pass.
+    await store.updateRun(runId, { status: "started", triggerId });
+    return "processed";
+  } catch (err) {
+    await store.updateRun(runId, {
+      status: "failed",
+      error: { message: err instanceof Error ? err.message : String(err) },
+    });
+    return "failed";
+  }
+}
+
+export interface AutomationCycleResult {
+  automationId: string;
+  inboxId: string | null;
+  inboxStatus: string | null;
+  processed: number;
+  skipped: number;
+  failed: number;
+}
+
+export async function runInboxCycleForAutomation(opts: {
+  sdk: Sdk;
+  automation: AutomationRow;
+  leaseLimit?: number;
+  leaseSeconds?: number;
+}): Promise<AutomationCycleResult> {
+  const { sdk, automation, leaseLimit = 25, leaseSeconds = 60 } = opts;
+  const result: AutomationCycleResult = {
+    automationId: automation.id,
+    inboxId: null,
+    inboxStatus: null,
+    processed: 0,
+    skipped: 0,
+    failed: 0,
+  };
+
+  const spec = inboxSpecOf(automation);
+  if (!spec) return result; // not inbox-triggered
+
+  const inbox = await ensureInbox({
+    sdk,
+    key: inboxKeyFor(automation.id),
+    app: spec.app,
+    action: spec.action,
+    connection: spec.connection,
+    inputs: spec.inputs,
+  });
+  result.inboxId = inbox.id;
+  result.inboxStatus = inbox.status;
+
+  // Keep the automation row in sync with its inbox subscription (foreman-dwf8):
+  // persist the inbox id the first time we arm it, AND reflect a failed/recovered
+  // subscription in the automation status. An inbox that can't subscribe (missing/
+  // expired connection, bad inputs) goes "initialization_failure" — without this the
+  // automation looks enabled in the UI but silently never fires.
+  const patch: Parameters<typeof store.updateAutomation>[2] = {};
+  if (automation.trigger_inbox_id !== inbox.id) patch.triggerInboxId = inbox.id;
+  if (inbox.status === "initialization_failure") {
+    if (automation.status !== "trigger_failed") patch.status = "trigger_failed";
+  } else if (automation.status === "trigger_failed") {
+    patch.status = "active"; // subscription recovered — clear the failed flag
+  }
+  if (Object.keys(patch).length > 0) {
+    await store.updateAutomation(automation.workspace_id ?? undefined, automation.id, patch);
+  }
+
+  const lease = await leaseMessages({ sdk, inbox: inbox.id, leaseLimit, leaseSeconds });
+  if (!lease.lease_id || lease.results.length === 0) return result;
+
+  const processed: string[] = [];
+  const skipped: string[] = [];
+  const failed: string[] = [];
+  for (const message of lease.results) {
+    const outcome = await dispatchMessage({ sdk, automation, message });
+    if (outcome === "processed") processed.push(message.id);
+    else if (outcome === "skipped") skipped.push(message.id);
+    else failed.push(message.id);
+  }
+
+  // Ack what we handled or intentionally skipped; release failures to retry.
+  const done = [...processed, ...skipped];
+  if (done.length) {
+    await ackMessages({ sdk, inbox: inbox.id, lease: lease.lease_id, messages: done });
+  }
+  if (failed.length) {
+    await releaseMessages({ sdk, inbox: inbox.id, lease: lease.lease_id, messages: failed });
+  }
+
+  result.processed = processed.length;
+  result.skipped = skipped.length;
+  result.failed = failed.length;
+  return result;
+}
+
+/** One full cycle across all active inbox-triggered automations (cross-workspace). */
+export async function runInboxCycle(): Promise<AutomationCycleResult[]> {
+  const automations = await store.listActiveInboxAutomations();
+  const results: AutomationCycleResult[] = [];
+  for (const automation of automations) {
+    try {
+      const sdk = await getExperimentalSdkForUser(automation.user_id);
+      results.push(await runInboxCycleForAutomation({ sdk, automation }));
+    } catch (err) {
+      // One automation's failure (e.g. an unconnected owner) must not stop the cycle.
+      console.error(`[inbox-worker] automation ${automation.id} cycle failed:`, err);
+      results.push({
+        automationId: automation.id,
+        inboxId: automation.trigger_inbox_id,
+        inboxStatus: "error",
+        processed: 0,
+        skipped: 0,
+        failed: 0,
+      });
+    }
+  }
+  return results;
+}
+
+/**
+ * How long a run may stay non-terminal WITHOUT a linked, running durable before we
+ * give up and mark it failed. This caps the genuinely-stuck cases (trigger never
+ * spawned a durable; worker crashed before dispatch; owner connection lost) — it
+ * does NOT cap a run whose durable IS linked and still running, because durables
+ * can legitimately run for days (waits / human-approval callbacks).
+ */
+const STUCK_RUN_TIMEOUT_MS = Number(process.env.FOREMAN_RUN_STUCK_TIMEOUT_MS) || 900_000; // 15 min
+
+/**
+ * Advance fired-but-not-terminal runs to their real terminal status, and fail
+ * genuinely-stuck ones. The durable run is the authority: trigger_id →
+ * (getTriggerRun) durable_run_id → (getDurableRun) started → finished/failed. The
+ * trigger run's own status never advances, so we follow the chain. Safe every
+ * cycle — only non-terminal rows are touched, only changes are written.
+ */
+export async function reconcilePendingRuns(): Promise<{ checked: number; updated: number }> {
+  const pending = await store.listPendingRuns();
+  if (pending.length === 0) return { checked: 0, updated: 0 };
+
+  const automationIds = [...new Set(pending.map((r) => r.automation_id))];
+  const automations = await store.getAutomationsByIds(automationIds);
+  const byId = new Map(automations.map((a) => [a.id, a]));
+
+  let updated = 0;
+  const failRun = async (id: string, reason: string) => {
+    await store.updateRun(id, { status: "failed", error: { message: reason } });
+    updated++;
+  };
+
+  for (const run of pending) {
+    const automation = byId.get(run.automation_id);
+    if (!automation) continue;
+    const tooOld = Date.now() - new Date(run.created_at).getTime() > STUCK_RUN_TIMEOUT_MS;
+
+    // Claimed but never dispatched (worker crashed between claim and fire).
+    if (!run.trigger_id) {
+      if (tooOld) await failRun(run.id, "stuck: claimed but never dispatched");
+      continue;
+    }
+    if (!automation.user_id) continue;
+
+    try {
+      const sdk = await getExperimentalSdkForUser(automation.user_id);
+
+      // Resolve the durable run id (it lags the trigger by a few seconds).
+      let durableRunId = run.durable_run_id;
+      if (!durableRunId) {
+        const tr = await getTriggerRunStatus(sdk, run.trigger_id);
+        durableRunId = tr.durableRunId;
+      }
+      if (!durableRunId) {
+        // Should link within seconds. If it never has, the trigger failed to spawn.
+        if (tooOld) await failRun(run.id, "stuck: durable run never linked");
+        continue;
+      }
+
+      const dr = await getDurableRunStatus(sdk, durableRunId);
+      // "cancelled" is terminal too (foreman-y4kc) — otherwise reconcile would flip a
+      // just-cancelled durable back to "started".
+      const terminal =
+        dr.status === "finished" || dr.status === "failed" || dr.status === "cancelled";
+
+      // Resolve the run's next status + the payload we surface as `error`:
+      //   terminal  → finished/failed/cancelled, with the durable's own output/error
+      //   waiting   → paused on a human-approval callback (foreman-rm8z); surface the
+      //               callback gate(s) so the UI shows "waiting for approval"
+      //   retrying  → a step is mid-retry (foreman-jc12): top-level status is still
+      //               "started" but execution.detail carries last_error + the ops;
+      //               surface that so the run doesn't look like a stalled "started"
+      //   started   → executing cleanly; clear any stale detail
+      let status: string;
+      let nextError: unknown;
+      if (terminal) {
+        status = dr.status;
+        nextError = dr.error ?? null;
+      } else if (dr.detail?.waiting) {
+        status = "waiting";
+        nextError = dr.detail;
+      } else if (dr.detail) {
+        status = "retrying";
+        nextError = dr.detail;
+      } else {
+        status = "started";
+        nextError = null;
+      }
+
+      // A linked-but-still-running durable is left alone — NO age cap (durables can
+      // run for days via waits/callbacks). Write on any real change, including the
+      // retry detail evolving (retry_count / next_retry_at) while status stays
+      // "retrying". Both are plain JSON so a stringify compare is enough.
+      const errorChanged = JSON.stringify(nextError ?? null) !== JSON.stringify(run.error ?? null);
+      if (status !== run.status || durableRunId !== run.durable_run_id || errorChanged) {
+        await store.updateRun(run.id, {
+          status,
+          durableRunId,
+          error: nextError,
+          ...(terminal ? { output: dr.output } : {}),
+        });
+        if (terminal) updated++;
+      }
+    } catch (err) {
+      // Owner disconnected / transient SDK error — give up only after the timeout.
+      if (tooOld) {
+        await failRun(
+          run.id,
+          `stuck: reconcile gave up — ${err instanceof Error ? err.message : String(err)}`,
+        );
+      } else {
+        console.error(`[inbox-worker] reconcile run ${run.id} failed (will retry):`, err);
+      }
+    }
+  }
+  return { checked: pending.length, updated };
+}
+
+/** Start the worker on an interval. Returns a stop handle. Run a single instance. */
+export function startInboxWorker(intervalMs = 60_000): () => void {
+  let running = false;
+  const tick = async () => {
+    if (running) return; // never overlap cycles
+    running = true;
+    try {
+      const results = await runInboxCycle();
+      const rec = await reconcilePendingRuns();
+      if (results.length || rec.updated) {
+        const t = results.reduce(
+          (a, r) => ({ p: a.p + r.processed, s: a.s + r.skipped, f: a.f + r.failed }),
+          { p: 0, s: 0, f: 0 },
+        );
+        console.log(
+          `[inbox-worker] ${results.length} automations · processed ${t.p} · skipped ${t.s} · failed ${t.f} · reconciled ${rec.updated}/${rec.checked}`,
+        );
+      }
+    } catch (err) {
+      console.error("[inbox-worker] cycle error:", err);
+    } finally {
+      running = false;
+    }
+  };
+  const handle = setInterval(tick, intervalMs);
+  void tick(); // run once immediately
+  return () => clearInterval(handle);
+}
diff --git a/packages/agents/src/lib/background.ts b/packages/agents/src/lib/background.ts
index e55154e3..5b48b174 100644
--- a/packages/agents/src/lib/background.ts
+++ b/packages/agents/src/lib/background.ts
@@ -1,22 +1,39 @@
+import { READ_ONLY_TOOL_IDS } from "./zapier-sdk-tools";
+
 /**
- * Gated background-execution config for agent tools (foreman-7am4).
+ * Agent-level background-execution opt-in for read-only tools (foreman-7am4).
  *
- * Returns `{ background: { enabled: true } }` when FOREMAN_BACKGROUND_TOOLS=1,
- * else `{}` — spread into a tool's createTool() config to opt it into Mastra
- * background execution.
+ * Spread `backgroundTasks: backgroundToolsConfig()` onto the Foreman agent to run
+ * its read-only tools (the Zapier reads + search_history) as Mastra background
+ * tasks: the agentic loop dispatches them and — via `/chat`'s `streamUntilIdle` —
+ * folds the result back into the SAME response instead of blocking on a slow read.
  *
- * Apply ONLY to simple-schema custom tools. Live verification showed that
- * backgrounding the generated Zapier SDK tools hangs `mastra dev`: enabling
- * background makes Mastra inject a `_background` field into the tool's input
- * schema, and Studio's `toJSONSchema` introspection over the Zapier tools'
- * (pathologically complex) zod schemas then loops forever — the same failure the
- * lazy-init-zapier regression test guards. `mastra build` is unaffected (no
- * Studio introspection), but the dev playground is. Simple schemas (e.g.
- * search_history's 3 fields) inject + introspect fine.
+ * Why agent-level (not the tool's own `background` config): Foreman resolves tools
+ * lazily (`tools: () => buildForemanTools()`, required to avoid the createZapierSdk
+ * startup hang). Under that DynamicArgument resolver the per-tool `background`
+ * field never reaches the background-task manager, so tools run synchronously;
+ * the agent-level `backgroundTasks.tools` map DOES drive dispatch. Verified live:
+ * with this, search_history emits background-task-running → -completed and its
+ * result injects on the continuation turn.
  *
- * Read at call time so tests can toggle the flag. OFF by default — this changes
- * live tool dispatch and is alpha-unverified end-to-end, so it ships inert.
+ * Write/destructive tools are intentionally excluded (READ_ONLY_TOOL_IDS only) so
+ * the proposal/approval flow stays synchronous. `waitTimeoutMs` caps how long the
+ * loop waits before moving on; a task that outlives it injects on a later turn.
+ *
+ * No env gate — the old `toJSONSchema` infinite-loop hang is fixed on the current
+ * Mastra alpha. (Enabling background does make Studio introspect those schemas at
+ * `mastra dev` startup, but that's a dev-playground cost only; production runs no
+ * Studio.)
  */
-export function backgroundIfEnabled(): { background?: { enabled: true } } {
-  return process.env.FOREMAN_BACKGROUND_TOOLS === "1" ? { background: { enabled: true } } : {};
+const BACKGROUND_WAIT_TIMEOUT_MS = 30_000;
+
+/** Custom (non-Zapier) read-only tools that should also run in the background. */
+const CUSTOM_BACKGROUND_TOOL_IDS = ["search_history"];
+
+export function backgroundToolsConfig() {
+  const ids = [...READ_ONLY_TOOL_IDS, ...CUSTOM_BACKGROUND_TOOL_IDS];
+  return {
+    tools: Object.fromEntries(ids.map((id) => [id, { enabled: true }])),
+    waitTimeoutMs: BACKGROUND_WAIT_TIMEOUT_MS,
+  };
 }
diff --git a/packages/agents/src/lib/catalog/vector.ts b/packages/agents/src/lib/catalog/vector.ts
index c60033f2..0713fc13 100644
--- a/packages/agents/src/lib/catalog/vector.ts
+++ b/packages/agents/src/lib/catalog/vector.ts
@@ -1,12 +1,13 @@
 import { createHash } from "node:crypto";
-import { ModelRouterEmbeddingModel } from "@mastra/core/llm";
+import { fastembed } from "@mastra/fastembed";
 import { PgVector } from "@mastra/pg";
 import { embedMany } from "ai";
 import { getEnv } from "../env";
 
 const INDEX_NAME = "catalog_vectors";
-const EMBEDDING_MODEL = "openai/text-embedding-3-small";
-const EMBEDDING_DIMENSION = 1536;
+// Local ONNX embedder (bge-small, 384-dim) — no OpenAI key/quota needed,
+// matching the agent-memory embedder so local dev is fully self-contained.
+const EMBEDDING_DIMENSION = 384;
 
 let _vector: PgVector | undefined;
 
@@ -21,19 +22,28 @@ function getVector(): PgVector {
 }
 
 function getEmbedder() {
-  return new ModelRouterEmbeddingModel(EMBEDDING_MODEL);
+  return fastembed;
 }
 
 export async function ensureCatalogIndex(): Promise<void> {
   const vector = getVector();
   try {
     const indexes = await vector.listIndexes();
-    if (!indexes.includes(INDEX_NAME)) {
-      await vector.createIndex({
-        indexName: INDEX_NAME,
-        dimension: EMBEDDING_DIMENSION,
-      });
+    if (indexes.includes(INDEX_NAME)) {
+      // Dimension guard (foreman-hcim): an index built before the 1536->384
+      // embedder switch silently rejects 384-d upserts. Drop a wrong-dimension
+      // index so it recreates; the catalog must then be re-seeded (catalog:seed).
+      const stats = await vector.describeIndex({ indexName: INDEX_NAME }).catch(() => undefined);
+      if (!stats || stats.dimension === EMBEDDING_DIMENSION) return;
+      console.warn(
+        `[catalog] ${INDEX_NAME} index is ${stats.dimension}-d but embedder is ${EMBEDDING_DIMENSION}-d — dropping & recreating (re-seed required).`,
+      );
+      await vector.deleteIndex({ indexName: INDEX_NAME });
     }
+    await vector.createIndex({
+      indexName: INDEX_NAME,
+      dimension: EMBEDDING_DIMENSION,
+    });
   } catch {
     // Index creation may fail if tables already exist in a different format.
     // The upsert call will create the index implicitly if needed.
diff --git a/packages/agents/src/lib/conversations/share.ts b/packages/agents/src/lib/conversations/share.ts
new file mode 100644
index 00000000..1fe369fa
--- /dev/null
+++ b/packages/agents/src/lib/conversations/share.ts
@@ -0,0 +1,139 @@
+import { randomBytes, randomUUID } from "node:crypto";
+import { getSupabase } from "../db";
+
+/**
+ * Public share tokens for chat conversations (foreman-mk25). Mirrors the
+ * dashboard_share / document_share capability model: whoever holds a valid,
+ * unexpired `share_token` can read that chat on a logged-out page — no auth, no
+ * account.
+ *
+ * Unlike dashboards/documents (SHARED workspace resources), a chat is
+ * OWNER-scoped: only the owner mints/revokes a link for their own chat, so
+ * create/revoke gate on `user_id` (a solo user with no teammates can still share
+ * their chat). Token resolution returns just the conversation's thread id; the
+ * route loads the messages from Mastra Memory by that thread id (recall is not
+ * resourceId-gated, so the unauthenticated read works) — keeping this lib free of
+ * the mastra index to avoid a circular import (same pattern as documents/share).
+ * Revoking = delete the row; the chat is untouched, so a leaked token can be cut
+ * independently of the chat's private/workspace visibility.
+ */
+
+export interface CreateShareResult {
+  token: string;
+  expiresAt: string | null;
+}
+
+/**
+ * Mint a public share token for a chat the caller OWNS. Verifies ownership before
+ * minting (so the route can 404 without leaking existence). `expiresInDays` is
+ * optional — omit for a link that never expires.
+ */
+export async function createShare(
+  userId: string,
+  conversationId: string,
+  opts: { expiresInDays?: number } = {},
+): Promise<CreateShareResult | null> {
+  const supabase = getSupabase();
+
+  // Only the owner can share their chat.
+  const { data: owned } = await supabase
+    .from("conversation")
+    .select("id, workspace_id")
+    .eq("id", conversationId)
+    .eq("user_id", userId)
+    .maybeSingle();
+  if (!owned) return null;
+
+  const token = randomBytes(24).toString("base64url");
+  const now = new Date();
+  const expiresAt =
+    opts.expiresInDays && opts.expiresInDays > 0
+      ? new Date(now.getTime() + opts.expiresInDays * 86_400_000).toISOString()
+      : null;
+
+  const { error } = await supabase.from("conversation_share").insert({
+    id: randomUUID(),
+    conversation_id: conversationId,
+    workspace_id: owned.workspace_id ?? null,
+    user_id: userId,
+    share_token: token,
+    expires_at: expiresAt,
+    created_at: now.toISOString(),
+  });
+  if (error) throw new Error(`createShare failed: ${error.message}`);
+
+  return { token, expiresAt };
+}
+
+/**
+ * Revoke a share, scoped to the owner so only the chat's owner can cut its link.
+ * Returns true if a row was deleted.
+ */
+export async function revokeShare(userId: string, token: string): Promise<boolean> {
+  const { data } = await getSupabase()
+    .from("conversation_share")
+    .delete()
+    .eq("user_id", userId)
+    .eq("share_token", token)
+    .select("id");
+  return (data?.length ?? 0) > 0;
+}
+
+/** The existing share token for a chat, or null if it isn't shared (UI signal). */
+export async function getConversationShareToken(
+  userId: string,
+  conversationId: string,
+): Promise<{ token: string; expiresAt: string | null } | null> {
+  const { data } = await getSupabase()
+    .from("conversation_share")
+    .select("share_token, expires_at")
+    .eq("user_id", userId)
+    .eq("conversation_id", conversationId)
+    .order("created_at", { ascending: false })
+    .limit(1)
+    .maybeSingle();
+  if (!data) return null;
+  return { token: data.share_token, expiresAt: data.expires_at };
+}
+
+export interface SharedConversationRef {
+  conversationId: string;
+  threadId: string | null;
+  /** The owner's explicit title (trimmed), or null to fall back to the thread title. */
+  title: string | null;
+  createdAt: string;
+}
+
+/**
+ * Resolve a public share token to its chat reference. Returns null when the token
+ * is unknown, expired, or the chat no longer exists. No auth — the token is the
+ * capability. The route loads the messages from Mastra Memory by `threadId` (recall
+ * is not resourceId-gated), so this lib stays free of the mastra index.
+ */
+export async function getSharedConversation(token: string): Promise<SharedConversationRef | null> {
+  const supabase = getSupabase();
+  const { data: share } = await supabase
+    .from("conversation_share")
+    .select("conversation_id, expires_at")
+    .eq("share_token", token)
+    .maybeSingle();
+  if (!share) return null;
+
+  if (share.expires_at && Date.parse(share.expires_at) <= Date.now()) {
+    return null; // expired — treat as not found
+  }
+
+  const { data: conv } = await supabase
+    .from("conversation")
+    .select("id, title, mastra_thread_id, created_at")
+    .eq("id", share.conversation_id)
+    .maybeSingle();
+  if (!conv) return null;
+
+  return {
+    conversationId: conv.id,
+    threadId: conv.mastra_thread_id ?? null,
+    title: conv.title?.trim() || null,
+    createdAt: conv.created_at,
+  };
+}
diff --git a/packages/agents/src/lib/dashboards/artifact.ts b/packages/agents/src/lib/dashboards/artifact.ts
new file mode 100644
index 00000000..7d5cbf6a
--- /dev/null
+++ b/packages/agents/src/lib/dashboards/artifact.ts
@@ -0,0 +1,100 @@
+import { randomUUID } from "node:crypto";
+import { getSupabase } from "../db";
+import { getSnapshotById, type SnapshotRecord } from "./snapshot";
+import { type DashboardSpec, dashboardSpecSchema } from "./spec";
+
+/**
+ * Artifact persistence — a stored, viewable agent output. Dashboards are the
+ * first `kind`; the spec is validated by zod before write (the safety boundary).
+ * Records are NOT duplicated here: an artifact references the snapshot it was
+ * built from (snapshot_id), and reads resolve the records from that snapshot.
+ */
+
+export interface SaveArtifactInput {
+  userId: string;
+  workspaceId?: string | null;
+  kind?: string;
+  title: string;
+  spec: DashboardSpec;
+  snapshotId?: string | null;
+  sourceConfig?: unknown;
+}
+
+export interface ArtifactWithData {
+  id: string;
+  kind: string;
+  title: string;
+  spec: DashboardSpec;
+  records: SnapshotRecord[];
+  rowCount: number;
+  updatedAt: string;
+}
+
+export async function saveArtifact(input: SaveArtifactInput): Promise<string> {
+  const supabase = getSupabase();
+  const id = randomUUID();
+  const now = new Date().toISOString();
+  // Validate before persisting — never store an invalid spec.
+  const spec = dashboardSpecSchema.parse(input.spec);
+
+  const { error } = await supabase.from("artifact").insert({
+    id,
+    user_id: input.userId,
+    workspace_id: input.workspaceId ?? null,
+    kind: input.kind ?? "dashboard",
+    title: input.title,
+    spec: JSON.stringify(spec),
+    snapshot_id: input.snapshotId ?? null,
+    source_config: input.sourceConfig != null ? JSON.stringify(input.sourceConfig) : null,
+    visibility: "private",
+    version: 1,
+    created_at: now,
+    updated_at: now,
+  });
+  if (error) throw new Error(`saveArtifact failed: ${error.message}`);
+  return id;
+}
+
+/**
+ * Load an artifact with the records it renders, scoped to the workspace (a SHARED
+ * resource — any workspace member can view it). Returns null if the artifact
+ * doesn't exist in this workspace. The spec is re-validated on read so a
+ * corrupt/legacy row can't reach the renderer.
+ */
+export async function getArtifactWithData(
+  workspaceId: string | undefined,
+  id: string,
+): Promise<ArtifactWithData | null> {
+  if (!workspaceId) return null;
+  const supabase = getSupabase();
+  const { data } = await supabase
+    .from("artifact")
+    .select("id, kind, title, spec, snapshot_id, updated_at")
+    .eq("workspace_id", workspaceId)
+    .eq("id", id)
+    .maybeSingle();
+  if (!data) return null;
+
+  let spec: DashboardSpec;
+  try {
+    spec = dashboardSpecSchema.parse(JSON.parse(data.spec));
+  } catch {
+    return null;
+  }
+
+  let records: SnapshotRecord[] = [];
+  if (data.snapshot_id) {
+    const snap = await getSnapshotById(workspaceId, data.snapshot_id);
+    if (snap) records = snap.records;
+  }
+
+  return {
+    id: data.id,
+    kind: data.kind,
+    title: data.title,
+    spec,
+    records,
+    rowCount: records.length,
+    updatedAt: data.updated_at,
+  };
+}
diff --git a/packages/agents/src/lib/dashboards/share.ts b/packages/agents/src/lib/dashboards/share.ts
new file mode 100644
index 00000000..f4a25f61
--- /dev/null
+++ b/packages/agents/src/lib/dashboards/share.ts
@@ -0,0 +1,114 @@
+import { randomBytes, randomUUID } from "node:crypto";
+import { getSupabase } from "../db";
+import { type ArtifactWithData, getArtifactWithData } from "./artifact";
+
+/**
+ * Public share tokens for dashboard artifacts (Phase 3).
+ *
+ * A token is an unguessable capability: whoever holds a valid, unexpired
+ * `share_token` can view that artifact's spec + records on the logged-out share
+ * page. The row carries the owner's `user_id`, so the public read resolves the
+ * (owner-scoped) records without the viewer being authenticated. Revoking a
+ * share = delete its row; the artifact itself is untouched.
+ */
+
+export interface CreateShareResult {
+  token: string;
+  expiresAt: string | null;
+}
+
+/**
+ * Mint a public share token for a workspace dashboard. Any member of the
+ * workspace can share it (dashboards are a SHARED resource); `userId` is recorded
+ * only as the share's creator. Returns null if the artifact doesn't exist in this
+ * workspace (so the route can 404 without leaking existence). `expiresInDays` is
+ * optional — omit for a link that never expires.
+ */
+export async function createShare(
+  workspaceId: string | undefined,
+  userId: string,
+  artifactId: string,
+  opts: { expiresInDays?: number } = {},
+): Promise<CreateShareResult | null> {
+  if (!workspaceId) return null;
+  const supabase = getSupabase();
+
+  // Verify the artifact belongs to this workspace before minting a token.
+  const { data: owned } = await supabase
+    .from("artifact")
+    .select("id")
+    .eq("workspace_id", workspaceId)
+    .eq("id", artifactId)
+    .maybeSingle();
+  if (!owned) return null;
+
+  const token = randomBytes(24).toString("base64url");
+  const now = new Date();
+  const expiresAt =
+    opts.expiresInDays && opts.expiresInDays > 0
+      ? new Date(now.getTime() + opts.expiresInDays * 86_400_000).toISOString()
+      : null;
+
+  const { error } = await supabase.from("dashboard_share").insert({
+    id: randomUUID(),
+    artifact_id: artifactId,
+    workspace_id: workspaceId,
+    user_id: userId,
+    share_token: token,
+    expires_at: expiresAt,
+    created_at: now.toISOString(),
+  });
+  if (error) throw new Error(`createShare failed: ${error.message}`);
+
+  // Reflect the shared state on the artifact (a UI signal only — access stays
+  // gated on the token, so this is best-effort and non-fatal).
+  await supabase
+    .from("artifact")
+    .update({ visibility: "link" })
+    .eq("id", artifactId)
+    .eq("workspace_id", workspaceId);
+
+  return { token, expiresAt };
+}
+
+/**
+ * Revoke a share, scoped to the workspace so a member can revoke any of the
+ * workspace's shared dashboards. Returns true if a row was deleted.
+ */
+export async function revokeShare(
+  workspaceId: string | undefined,
+  token: string,
+): Promise<boolean> {
+  if (!workspaceId) return false;
+  const supabase = getSupabase();
+  const { data } = await supabase
+    .from("dashboard_share")
+    .delete()
+    .eq("workspace_id", workspaceId)
+    .eq("share_token", token)
+    .select("id");
+  return (data?.length ?? 0) > 0;
+}
+
+/**
+ * Resolve a public share token to its artifact + data. Returns null when the
+ * token is unknown, expired, or the artifact no longer exists. No auth — the
+ * token is the capability.
+ */
+export async function getSharedArtifact(token: string): Promise<ArtifactWithData | null> {
+  const supabase = getSupabase();
+  const { data: share } = await supabase
+    .from("dashboard_share")
+    .select("artifact_id, workspace_id, expires_at")
+    .eq("share_token", token)
+    .maybeSingle();
+  if (!share) return null;
+
+  if (share.expires_at && Date.parse(share.expires_at) <= Date.now()) {
+    return null; // expired — treat as not found
+  }
+
+  // The share row carries the artifact's workspace, so the (workspace-scoped)
+  // records still resolve for an unauthenticated viewer — the token is the grant.
+  return getArtifactWithData(share.workspace_id ?? undefined, share.artifact_id);
+}
diff --git a/packages/agents/src/lib/dashboards/snapshot.ts b/packages/agents/src/lib/dashboards/snapshot.ts
new file mode 100644
index 00000000..70e04a54
--- /dev/null
+++ b/packages/agents/src/lib/dashboards/snapshot.ts
@@ -0,0 +1,238 @@
+import { randomUUID } from "node:crypto";
+import { getSupabase } from "../db";
+
+export type SnapshotRecord = Record<string, unknown>;
+
+export interface SaveSnapshotInput {
+  userId: string;
+  workspaceId?: string | null;
+  appKey: string;
+  /** the source/query config used to pull this data (provenance + refresh basis) */
+  sourceConfig: unknown;
+  /** the pulled records */
+  records: SnapshotRecord[];
+  /** the trigger that produced this snapshot, if any */
+  triggerId?: string | null;
+}
+
+export interface Snapshot {
+  id: string;
+  appKey: string;
+  sourceConfig: unknown;
+  records: SnapshotRecord[];
+  rowCount: number;
+  refreshedAt: string;
+}
+
+/**
+ * Append a new snapshot row — one row per refresh (NEVER an upsert) so history is
+ * preserved for trend charts. JSON payloads are stored as text, matching the other
+ * Foreman core tables (e.g. workflow.parameters, action_proposal.inputs).
+ */
+export async function saveSnapshot(input: SaveSnapshotInput): Promise<string> {
+  const supabase = getSupabase();
+  const id = randomUUID();
+  const now = new Date().toISOString();
+  const rowCount = Array.isArray(input.records) ? input.records.length : 0;
+
+  const { error } = await supabase.from("app_data_snapshot").insert({
+    id,
+    user_id: input.userId,
+    workspace_id: input.workspaceId ?? null,
+    app_key: input.appKey,
+    source_config: JSON.stringify(input.sourceConfig ?? {}),
+    records: JSON.stringify(input.records ?? []),
+    row_count: rowCount,
+    trigger_id: input.triggerId ?? null,
+    refreshed_at: now,
+    created_at: now,
+  });
+  if (error) throw new Error(`saveSnapshot failed: ${error.message}`);
+
+  // Bound the append-only table after each append — best-effort, so a prune
+  // hiccup never fails a refresh. Prune is workspace-scoped; without a workspace
+  // it's a no-op (a workspace-less snapshot is invisible to the dashboards reads).
+  try {
+    await pruneSnapshots(input.workspaceId ?? undefined, input.appKey);
+  } catch (e) {
+    console.error("[saveSnapshot] prune failed (non-fatal):", (e as Error).message);
+  }
+
+  return id;
+}
+
+/** How many snapshots to keep per (workspace, app_key). Count-based, not
+ * time-based: a time window (e.g. 90d) doesn't bound growth for frequent polls,
+ * whereas a hard count does. Set generously so the history endpoint (limit ≤ 500)
+ * still has data for trend charts. */
+const DEFAULT_KEEP_LAST = 200;
+/** Cap deletions per call so a one-time backfill drains over several refreshes
+ * instead of building a giant `.in(...)` URL that PostgREST would reject. */
+const MAX_PRUNE_BATCH = 200;
+
+/**
+ * Retention: keep the newest `keepLast` snapshots per (workspace, app_key) and
+ * delete older ones. NEVER deletes a snapshot a dashboard artifact is pinned to —
+ * `getArtifactWithData` resolves records by `snapshot_id`, so pruning a
+ * referenced row would blank that dashboard. Returns the number deleted.
+ * Snapshots are a SHARED workspace resource, so retention is per workspace.
+ */
+export async function pruneSnapshots(
+  workspaceId: string | undefined,
+  appKey: string,
+  opts: { keepLast?: number } = {},
+): Promise<number> {
+  if (!workspaceId) return 0;
+  const keepLast = opts.keepLast ?? DEFAULT_KEEP_LAST;
+  const supabase = getSupabase();
+
+  // Newest-first ids only (cheap; covered by the (workspace_id, app_key,
+  // refreshed_at) index). Fast path: nothing beyond the window.
+  const { data: rows } = await supabase
+    .from("app_data_snapshot")
+    .select("id")
+    .eq("workspace_id", workspaceId)
+    .eq("app_key", appKey)
+    .order("refreshed_at", { ascending: false });
+  if (!rows || rows.length <= keepLast) return 0;
+
+  // Everything past the newest `keepLast` is a candidate; drain oldest-first in
+  // bounded batches.
+  const candidates = rows
+    .slice(keepLast)
+    .map((r) => r.id)
+    .slice(-MAX_PRUNE_BATCH);
+
+  // Exclude snapshots a dashboard artifact still references.
+  const { data: referenced } = await supabase
+    .from("artifact")
+    .select("snapshot_id")
+    .eq("workspace_id", workspaceId)
+    .in("snapshot_id", candidates);
+  const pinned = new Set((referenced ?? []).map((r) => r.snapshot_id as string));
+  const toDelete = candidates.filter((id) => !pinned.has(id));
+  if (toDelete.length === 0) return 0;
+
+  const { error } = await supabase
+    .from("app_data_snapshot")
+    .delete()
+    .eq("workspace_id", workspaceId)
+    .in("id", toDelete);
+  if (error) throw new Error(`pruneSnapshots failed: ${error.message}`);
+  return toDelete.length;
+}
+
+/** Latest snapshot for a workspace's app source, or null if none exists yet. */
+export async function getLatestSnapshot(
+  workspaceId: string | undefined,
+  appKey: string,
+): Promise<Snapshot | null> {
+  if (!workspaceId) return null;
+  const supabase = getSupabase();
+  const { data } = await supabase
+    .from("app_data_snapshot")
+    .select("id, app_key, source_config, records, row_count, refreshed_at")
+    .eq("workspace_id", workspaceId)
+    .eq("app_key", appKey)
+    .order("refreshed_at", { ascending: false })
+    .limit(1)
+    .maybeSingle();
+  return data ? rowToSnapshot(data) : null;
+}
+
+export interface SnapshotApp {
+  appKey: string;
+  refreshedAt: string;
+  rowCount: number;
+}
+
+/**
+ * The apps that have snapshot data in this workspace, newest-refreshed first
+ * (one entry per app, its latest refresh). Used to pick a sensible default app
+ * for the Apps page instead of hardcoding one, and to power an app switcher.
+ */
+export async function listSnapshotApps(workspaceId: string | undefined): Promise<SnapshotApp[]> {
+  if (!workspaceId) return [];
+  const supabase = getSupabase();
+  const { data } = await supabase
+    .from("app_data_snapshot")
+    .select("app_key, refreshed_at, row_count")
+    .eq("workspace_id", workspaceId)
+    .order("refreshed_at", { ascending: false })
+    .limit(500);
+  // Rows are newest-first; first occurrence of each app_key is its latest refresh,
+  // and the resulting order is by each app's most-recent refresh (newest first).
+  const seen = new Map<string, SnapshotApp>();
+  for (const r of data ?? []) {
+    if (!seen.has(r.app_key)) {
+      seen.set(r.app_key, {
+        appKey: r.app_key,
+        refreshedAt: r.refreshed_at,
+        rowCount: r.row_count,
+      });
+    }
+  }
+  return [...seen.values()];
+}
+
+/** A specific snapshot by id, scoped to the workspace. Null if not found. */
+export async function getSnapshotById(
+  workspaceId: string | undefined,
+  id: string,
+): Promise<Snapshot | null> {
+  if (!workspaceId) return null;
+  const supabase = getSupabase();
+  const { data } = await supabase
+    .from("app_data_snapshot")
+    .select("id, app_key, source_config, records, row_count, refreshed_at")
+    .eq("workspace_id", workspaceId)
+    .eq("id", id)
+    .maybeSingle();
+  return data ? rowToSnapshot(data) : null;
+}
+
+/** Historical snapshots (newest first) for trend charts; optionally only since a timestamp. */
+export async function getSnapshotHistory(
+  workspaceId: string | undefined,
+  appKey: string,
+  opts: { since?: string; limit?: number } = {},
+): Promise<Snapshot[]> {
+  if (!workspaceId) return [];
+  const supabase = getSupabase();
+  let query = supabase
+    .from("app_data_snapshot")
+    .select("id, app_key, source_config, records, row_count, refreshed_at")
+    .eq("workspace_id", workspaceId)
+    .eq("app_key", appKey)
+    .order("refreshed_at", { ascending: false })
+    .limit(opts.limit ?? 100);
+  if (opts.since) query = query.gte("refreshed_at", opts.since);
+  const { data } = await query;
+  return (data ?? []).map(rowToSnapshot);
+}
+
+function rowToSnapshot(row: {
+  id: string;
+  app_key: string;
+  source_config: string;
+  records: string;
+  row_count: number;
+  refreshed_at: string;
+}): Snapshot {
+  return {
+    id: row.id,
+    appKey: row.app_key,
+    sourceConfig: safeParse(row.source_config),
+    records: (safeParse(row.records) as SnapshotRecord[]) ?? [],
+    rowCount: row.row_count,
+    refreshedAt: row.refreshed_at,
+  };
+}
+
+function safeParse(value: string): unknown {
+  try {
+    return JSON.parse(value);
+  } catch {
+    return null;
+  }
+}
diff --git a/packages/agents/src/lib/dashboards/spec.ts b/packages/agents/src/lib/dashboards/spec.ts
new file mode 100644
index 00000000..295c9671
--- /dev/null
+++ b/packages/agents/src/lib/dashboards/spec.ts
@@ -0,0 +1,135 @@
+import { z } from "zod";
+
+/**
+ * Dashboard spec — a constrained, JSON-serializable description of a dashboard
+ * that the agent produces and the web DashboardRenderer composes from installed
+ * shadcn/recharts/react-data-grid components. No code execution.
+ *
+ * This zod schema is the SAFETY BOUNDARY: every spec is validated here before it
+ * is stored or rendered (in-app and, later, on public share pages). Labels are
+ * length-capped, block counts are bounded, objects are .strict() (no extra
+ * keys), and there are no html/url/onClick/template fields anywhere.
+ *
+ * Keep this in lockstep with the TS types in
+ * packages/web/src/lib/dashboards-client.ts (the renderer's contract).
+ */
+
+const label = z.string().min(1).max(200);
+const field = z.string().min(1).max(200);
+
+const kpiBlock = z
+  .object({
+    type: z.literal("kpi"),
+    label,
+    field: field.optional(),
+    agg: z.enum(["count", "sum", "avg", "min", "max"]),
+  })
+  .strict();
+
+const chartBlock = z
+  .object({
+    type: z.literal("chart"),
+    chartType: z.enum(["bar", "line"]),
+    label,
+    xField: field,
+    yField: field.optional(),
+    agg: z.enum(["count", "sum"]),
+  })
+  .strict();
+
+const tableBlock = z
+  .object({
+    type: z.literal("table"),
+    label: label.optional(),
+    columns: z.array(field).min(1).max(50),
+  })
+  .strict();
+
+export const dashboardBlockSchema = z.discriminatedUnion("type", [
+  kpiBlock,
+  chartBlock,
+  tableBlock,
+]);
+
+export const dashboardSpecSchema = z
+  .object({
+    title: label,
+    blocks: z.array(dashboardBlockSchema).min(1).max(20),
+  })
+  .strict();
+
+export type DashboardSpec = z.infer<typeof dashboardSpecSchema>;
+
+type SnapshotRecord = Record<string, unknown>;
+
+function isNumeric(v: unknown): v is number {
+  return typeof v === "number" && Number.isFinite(v);
+}
+
+/**
+ * Derive a sensible default dashboard spec from a set of records: KPIs (row
+ * count + sum/avg of the first numeric field), a bar chart (first numeric grouped
+ * by the first categorical, else counts by the first categorical), and a table of
+ * all columns. Mirrors defaultSpecFromRecords in the web client so the in-app and
+ * agent-generated specs stay consistent.
+ */
+export function buildDefaultSpec(
+  appKey: string,
+  records: SnapshotRecord[],
+  titleOverride?: string,
+): DashboardSpec {
+  const title = titleOverride?.trim() || `${appKey} overview`;
+  const blocks: z.infer<typeof dashboardBlockSchema>[] = [];
+
+  const sample = records[0] ?? {};
+  const columns = Object.keys(sample);
+  const numericFields = columns.filter((c) => records.some((r) => isNumeric(r[c])));
+  const categoricalFields = columns.filter(
+    (c) => !numericFields.includes(c) && records.some((r) => typeof r[c] === "string"),
+  );
+
+  blocks.push({ type: "kpi", label: "Total records", agg: "count" });
+  if (numericFields[0]) {
+    blocks.push({
+      type: "kpi",
+      label: `Total ${numericFields[0]}`,
+      field: numericFields[0],
+      agg: "sum",
+    });
+    blocks.push({
+      type: "kpi",
+      label: `Avg ${numericFields[0]}`,
+      field: numericFields[0],
+      agg: "avg",
+    });
+  }
+
+  if (categoricalFields[0]) {
+    blocks.push(
+      numericFields[0]
+        ? {
+            type: "chart",
+            chartType: "bar",
+            label: `${numericFields[0]} by ${categoricalFields[0]}`,
+            xField: categoricalFields[0],
+            yField: numericFields[0],
+            agg: "sum",
+          }
+        : {
+            type: "chart",
+            chartType: "bar",
+            label: `Count by ${categoricalFields[0]}`,
+            xField: categoricalFields[0],
+            agg: "count",
+          },
+    );
+  }
+
+  if (columns.length > 0) {
+    blocks.push({ type: "table", label: "Records", columns });
+  }
+
+  // Validate our own output — cheap insurance that the builder never emits an
+  // invalid spec, and the same gate any agent-authored spec must pass.
+  return dashboardSpecSchema.parse({ title, blocks });
+}
diff --git a/packages/agents/src/lib/db/database.types.ts b/packages/agents/src/lib/db/database.types.ts
index 10fab1be..0561f0a1 100644
--- a/packages/agents/src/lib/db/database.types.ts
+++ b/packages/agents/src/lib/db/database.types.ts
@@ -194,6 +194,53 @@ export type Database = {
         };
         Relationships: [];
       };
+      app_data_snapshot: {
+        Row: {
+          app_key: string;
+          created_at: string;
+          id: string;
+          records: string;
+          refreshed_at: string;
+          row_count: number;
+          source_config: string;
+          trigger_id: string | null;
+          user_id: string;
+          workspace_id: string | null;
+        };
+        Insert: {
+          app_key: string;
+          created_at: string;
+          id: string;
+          records: string;
+          refreshed_at: string;
+          row_count?: number;
+          source_config: string;
+          trigger_id?: string | null;
+          user_id: string;
+          workspace_id?: string | null;
+        };
+        Update: {
+          app_key?: string;
+          created_at?: string;
+          id?: string;
+          records?: string;
+          refreshed_at?: string;
+          row_count?: number;
+          source_config?: string;
+          trigger_id?: string | null;
+          user_id?: string;
+          workspace_id?: string | null;
+        };
+        Relationships: [
+          {
+            foreignKeyName: "app_data_snapshot_workspace_id_fk";
+            columns: ["workspace_id"];
+            isOneToOne: false;
+            referencedRelation: "workspaces";
+            referencedColumns: ["id"];
+          },
+        ];
+      };
       app_settings: {
         Row: {
           id: boolean;
@@ -212,6 +259,190 @@ export type Database = {
         };
         Relationships: [];
       };
+      artifact: {
+        Row: {
+          created_at: string;
+          id: string;
+          kind: string;
+          snapshot_id: string | null;
+          source_config: string | null;
+          spec: string;
+          title: string;
+          updated_at: string;
+          user_id: string;
+          version: number;
+          visibility: string;
+          workspace_id: string | null;
+        };
+        Insert: {
+          created_at: string;
+          id: string;
+          kind?: string;
+          snapshot_id?: string | null;
+          source_config?: string | null;
+          spec: string;
+          title: string;
+          updated_at: string;
+          user_id: string;
+          version?: number;
+          visibility?: string;
+          workspace_id?: string | null;
+        };
+        Update: {
+          created_at?: string;
+          id?: string;
+          kind?: string;
+          snapshot_id?: string | null;
+          source_config?: string | null;
+          spec?: string;
+          title?: string;
+          updated_at?: string;
+          user_id?: string;
+          version?: number;
+          visibility?: string;
+          workspace_id?: string | null;
+        };
+        Relationships: [
+          {
+            foreignKeyName: "artifact_workspace_id_fk";
+            columns: ["workspace_id"];
+            isOneToOne: false;
+            referencedRelation: "workspaces";
+            referencedColumns: ["id"];
+          },
+        ];
+      };
+      automation: {
+        Row: {
+          connections: Json;
+          created_at: string;
+          description: string | null;
+          editor_url: string | null;
+          enabled: boolean;
+          id: string;
+          name: string;
+          source: string;
+          status: string;
+          trigger: Json | null;
+          trigger_inbox_id: string | null;
+          trigger_url: string | null;
+          updated_at: string;
+          user_id: string;
+          workspace_id: string | null;
+          zapier_version_id: string | null;
+          zapier_workflow_id: string;
+        };
+        Insert: {
+          connections?: Json;
+          created_at: string;
+          description?: string | null;
+          editor_url?: string | null;
+          enabled?: boolean;
+          id: string;
+          name: string;
+          source: string;
+          status?: string;
+          trigger?: Json | null;
+          trigger_inbox_id?: string | null;
+          trigger_url?: string | null;
+          updated_at: string;
+          user_id: string;
+          workspace_id?: string | null;
+          zapier_version_id?: string | null;
+          zapier_workflow_id: string;
+        };
+        Update: {
+          connections?: Json;
+          created_at?: string;
+          description?: string | null;
+          editor_url?: string | null;
+          enabled?: boolean;
+          id?: string;
+          name?: string;
+          source?: string;
+          status?: string;
+          trigger?: Json | null;
+          trigger_inbox_id?: string | null;
+          trigger_url?: string | null;
+          updated_at?: string;
+          user_id?: string;
+          workspace_id?: string | null;
+          zapier_version_id?: string | null;
+          zapier_workflow_id?: string;
+        };
+        Relationships: [
+          {
+            foreignKeyName: "automation_workspace_id_fk";
+            columns: ["workspace_id"];
+            isOneToOne: false;
+            referencedRelation: "workspaces";
+            referencedColumns: ["id"];
+          },
+        ];
+      };
+      automation_run: {
+        Row: {
+          automation_id: string;
+          created_at: string;
+          durable_run_id: string | null;
+          error: Json | null;
+          id: string;
+          inbox_message_id: string | null;
+          input: Json | null;
+          output: Json | null;
+          status: string;
+          trigger_id: string | null;
+          updated_at: string;
+          workflow_version_id: string | null;
+          workspace_id: string | null;
+        };
+        Insert: {
+          automation_id: string;
+          created_at: string;
+          durable_run_id?: string | null;
+          error?: Json | null;
+          id: string;
+          inbox_message_id?: string | null;
+          input?: Json | null;
+          output?: Json | null;
+          status?: string;
+          trigger_id?: string | null;
+          updated_at: string;
+          workflow_version_id?: string | null;
+          workspace_id?: string | null;
+        };
+        Update: {
+          automation_id?: string;
+          created_at?: string;
+          durable_run_id?: string | null;
+          error?: Json | null;
+          id?: string;
+          inbox_message_id?: string | null;
+          input?: Json | null;
+          output?: Json | null;
+          status?: string;
+          trigger_id?: string | null;
+          updated_at?: string;
+          workflow_version_id?: string | null;
+          workspace_id?: string | null;
+        };
+        Relationships: [
+          {
+            foreignKeyName: "automation_run_automation_id_fk";
+            columns: ["automation_id"];
+            isOneToOne: false;
+            referencedRelation: "automation";
+            referencedColumns: ["id"];
+          },
+          {
+            foreignKeyName: "automation_run_workspace_id_fk";
+            columns: ["workspace_id"];
+            isOneToOne: false;
+            referencedRelation: "workspaces";
+            referencedColumns: ["id"];
+          },
+        ];
+      };
       billing_customers: {
         Row: {
           billing_email: string | null;
@@ -767,643 +998,193 @@ export type Database = {
           app_key?: string;
           connection_id?: number;
           created_at?: string;
-          user_id?: string;
-        };
-        Relationships: [
-          {
-            foreignKeyName: "connection_alias_user_id_user_id_fk";
-            columns: ["user_id"];
-            isOneToOne: false;
-            referencedRelation: "user";
-            referencedColumns: ["id"];
-          },
-        ];
-      };
-      conversation: {
-        Row: {
-          created_at: string;
-          id: string;
-          mastra_thread_id: string | null;
-          title: string | null;
-          updated_at: string;
-          user_id: string;
-          workspace_id: string | null;
-        };
-        Insert: {
-          created_at: string;
-          id: string;
-          mastra_thread_id?: string | null;
-          title?: string | null;
-          updated_at: string;
-          user_id: string;
-          workspace_id?: string | null;
-        };
-        Update: {
-          created_at?: string;
-          id?: string;
-          mastra_thread_id?: string | null;
-          title?: string | null;
-          updated_at?: string;
-          user_id?: string;
-          workspace_id?: string | null;
-        };
-        Relationships: [
-          {
-            foreignKeyName: "conversation_user_id_user_id_fk";
-            columns: ["user_id"];
-            isOneToOne: false;
-            referencedRelation: "user";
-            referencedColumns: ["id"];
-          },
-          {
-            foreignKeyName: "conversation_workspace_id_fkey";
-            columns: ["workspace_id"];
-            isOneToOne: false;
-            referencedRelation: "workspaces";
-            referencedColumns: ["id"];
-          },
-        ];
-      };
-      marketing_author_profiles: {
-        Row: {
-          avatar_url: string | null;
-          bio: string | null;
-          created_at: string;
-          display_name: string;
-          github_handle: string | null;
-          id: string;
-          slug: string;
-          twitter_handle: string | null;
-          user_id: string | null;
-          website_url: string | null;
-        };
-        Insert: {
-          avatar_url?: string | null;
-          bio?: string | null;
-          created_at?: string;
-          display_name: string;
-          github_handle?: string | null;
-          id?: string;
-          slug: string;
-          twitter_handle?: string | null;
-          user_id?: string | null;
-          website_url?: string | null;
-        };
-        Update: {
-          avatar_url?: string | null;
-          bio?: string | null;
-          created_at?: string;
-          display_name?: string;
-          github_handle?: string | null;
-          id?: string;
-          slug?: string;
-          twitter_handle?: string | null;
-          user_id?: string | null;
-          website_url?: string | null;
-        };
-        Relationships: [
-          {
-            foreignKeyName: "marketing_author_profiles_user_id_fkey";
-            columns: ["user_id"];
-            isOneToOne: false;
-            referencedRelation: "user_profiles";
-            referencedColumns: ["id"];
-          },
-        ];
-      };
-      marketing_blog_author_posts: {
-        Row: {
-          author_id: string;
-          blog_post_id: string;
-        };
-        Insert: {
-          author_id: string;
-          blog_post_id: string;
-        };
-        Update: {
-          author_id?: string;
-          blog_post_id?: string;
-        };
-        Relationships: [
-          {
-            foreignKeyName: "marketing_blog_author_posts_author_id_fkey";
-            columns: ["author_id"];
-            isOneToOne: false;
-            referencedRelation: "marketing_author_profiles";
-            referencedColumns: ["id"];
-          },
-          {
-            foreignKeyName: "marketing_blog_author_posts_blog_post_id_fkey";
-            columns: ["blog_post_id"];
-            isOneToOne: false;
-            referencedRelation: "marketing_blog_posts";
-            referencedColumns: ["id"];
-          },
-        ];
-      };
-      marketing_blog_post_tags_relationship: {
-        Row: {
-          blog_post_id: string;
-          tag_id: string;
-        };
-        Insert: {
-          blog_post_id: string;
-          tag_id: string;
-        };
-        Update: {
-          blog_post_id?: string;
-          tag_id?: string;
-        };
-        Relationships: [
-          {
-            foreignKeyName: "marketing_blog_post_tags_relationship_blog_post_id_fkey";
-            columns: ["blog_post_id"];
-            isOneToOne: false;
-            referencedRelation: "marketing_blog_posts";
-            referencedColumns: ["id"];
-          },
-          {
-            foreignKeyName: "marketing_blog_post_tags_relationship_tag_id_fkey";
-            columns: ["tag_id"];
-            isOneToOne: false;
-            referencedRelation: "marketing_tags";
-            referencedColumns: ["id"];
-          },
-        ];
-      };
-      marketing_blog_posts: {
-        Row: {
-          content: string | null;
-          cover_image: string | null;
-          created_at: string;
-          id: string;
-          is_featured: boolean;
-          json_content: Json | null;
-          media_type: string | null;
-          published_at: string | null;
-          seo_data: Json | null;
-          slug: string;
-          status: Database["public"]["Enums"]["marketing_blog_post_status"];
-          summary: string | null;
-          title: string;
-          updated_at: string;
-        };
-        Insert: {
-          content?: string | null;
-          cover_image?: string | null;
-          created_at?: string;
-          id?: string;
-          is_featured?: boolean;
-          json_content?: Json | null;
-          media_type?: string | null;
-          published_at?: string | null;
-          seo_data?: Json | null;
-          slug: string;
-          status?: Database["public"]["Enums"]["marketing_blog_post_status"];
-          summary?: string | null;
-          title: string;
-          updated_at?: string;
-        };
-        Update: {
-          content?: string | null;
-          cover_image?: string | null;
-          created_at?: string;
-          id?: string;
-          is_featured?: boolean;
-          json_content?: Json | null;
-          media_type?: string | null;
-          published_at?: string | null;
-          seo_data?: Json | null;
-          slug?: string;
-          status?: Database["public"]["Enums"]["marketing_blog_post_status"];
-          summary?: string | null;
-          title?: string;
-          updated_at?: string;
-        };
-        Relationships: [];
-      };
-      marketing_changelog: {
-        Row: {
-          content: string | null;
-          cover_image: string | null;
-          created_at: string;
-          id: string;
-          json_content: Json | null;
-          media_alt: string | null;
-          media_type: string | null;
-          media_url: string | null;
-          published_at: string | null;
-          status: Database["public"]["Enums"]["marketing_changelog_status"];
-          tags: string[] | null;
-          technical_details: string | null;
-          title: string;
-          updated_at: string;
-          version: string | null;
-          video_poster: string | null;
-        };
-        Insert: {
-          content?: string | null;
-          cover_image?: string | null;
-          created_at?: string;
-          id?: string;
-          json_content?: Json | null;
-          media_alt?: string | null;
-          media_type?: string | null;
-          media_url?: string | null;
-          published_at?: string | null;
-          status?: Database["public"]["Enums"]["marketing_changelog_status"];
-          tags?: string[] | null;
-          technical_details?: string | null;
-          title: string;
-          updated_at?: string;
-          version?: string | null;
-          video_poster?: string | null;
-        };
-        Update: {
-          content?: string | null;
-          cover_image?: string | null;
-          created_at?: string;
-          id?: string;
-          json_content?: Json | null;
-          media_alt?: string | null;
-          media_type?: string | null;
-          media_url?: string | null;
-          published_at?: string | null;
-          status?: Database["public"]["Enums"]["marketing_changelog_status"];
-          tags?: string[] | null;
-          technical_details?: string | null;
-          title?: string;
-          updated_at?: string;
-          version?: string | null;
-          video_poster?: string | null;
-        };
-        Relationships: [];
-      };
-      marketing_changelog_author_relationship: {
-        Row: {
-          author_id: string;
-          changelog_id: string;
-        };
-        Insert: {
-          author_id: string;
-          changelog_id: string;
-        };
-        Update: {
-          author_id?: string;
-          changelog_id?: string;
-        };
-        Relationships: [
-          {
-            foreignKeyName: "marketing_changelog_author_relationship_author_id_fkey";
-            columns: ["author_id"];
-            isOneToOne: false;
-            referencedRelation: "marketing_author_profiles";
-            referencedColumns: ["id"];
-          },
-          {
-            foreignKeyName: "marketing_changelog_author_relationship_changelog_id_fkey";
-            columns: ["changelog_id"];
-            isOneToOne: false;
-            referencedRelation: "marketing_changelog";
-            referencedColumns: ["id"];
-          },
-        ];
-      };
-      marketing_feedback_board_subscriptions: {
-        Row: {
-          board_id: string;
-          created_at: string;
-          id: string;
-          user_id: string;
-        };
-        Insert: {
-          board_id: string;
-          created_at?: string;
-          id?: string;
-          user_id: string;
-        };
-        Update: {
-          board_id?: string;
-          created_at?: string;
-          id?: string;
-          user_id?: string;
-        };
-        Relationships: [
-          {
-            foreignKeyName: "marketing_feedback_board_subscriptions_board_id_fkey";
-            columns: ["board_id"];
-            isOneToOne: false;
-            referencedRelation: "marketing_feedback_boards";
-            referencedColumns: ["id"];
-          },
-          {
-            foreignKeyName: "marketing_feedback_board_subscriptions_user_id_fkey";
-            columns: ["user_id"];
-            isOneToOne: false;
-            referencedRelation: "user_profiles";
-            referencedColumns: ["id"];
-          },
-        ];
-      };
-      marketing_feedback_boards: {
-        Row: {
-          color: string | null;
-          created_at: string;
-          created_by: string;
-          description: string | null;
-          id: string;
-          is_active: boolean;
-          settings: Json;
-          slug: string;
-          title: string;
-          updated_at: string;
-        };
-        Insert: {
-          color?: string | null;
-          created_at?: string;
-          created_by: string;
-          description?: string | null;
-          id?: string;
-          is_active?: boolean;
-          settings?: Json;
-          slug: string;
-          title: string;
-          updated_at?: string;
-        };
-        Update: {
-          color?: string | null;
-          created_at?: string;
-          created_by?: string;
-          description?: string | null;
-          id?: string;
-          is_active?: boolean;
-          settings?: Json;
-          slug?: string;
-          title?: string;
-          updated_at?: string;
-        };
-        Relationships: [
-          {
-            foreignKeyName: "marketing_feedback_boards_created_by_fkey";
-            columns: ["created_by"];
-            isOneToOne: false;
-            referencedRelation: "user_profiles";
-            referencedColumns: ["id"];
-          },
-        ];
-      };
-      marketing_feedback_comment_reactions: {
-        Row: {
-          comment_id: string;
-          created_at: string;
-          id: string;
-          reaction_type: Database["public"]["Enums"]["marketing_feedback_reaction_type"];
-          user_id: string;
-        };
-        Insert: {
-          comment_id: string;
-          created_at?: string;
-          id?: string;
-          reaction_type: Database["public"]["Enums"]["marketing_feedback_reaction_type"];
-          user_id: string;
-        };
-        Update: {
-          comment_id?: string;
-          created_at?: string;
-          id?: string;
-          reaction_type?: Database["public"]["Enums"]["marketing_feedback_reaction_type"];
-          user_id?: string;
-        };
-        Relationships: [
-          {
-            foreignKeyName: "marketing_feedback_comment_reactions_comment_id_fkey";
-            columns: ["comment_id"];
-            isOneToOne: false;
-            referencedRelation: "marketing_feedback_comments";
-            referencedColumns: ["id"];
-          },
+          user_id?: string;
+        };
+        Relationships: [
           {
-            foreignKeyName: "marketing_feedback_comment_reactions_user_id_fkey";
+            foreignKeyName: "connection_alias_user_id_user_id_fk";
             columns: ["user_id"];
             isOneToOne: false;
-            referencedRelation: "user_profiles";
+            referencedRelation: "user";
             referencedColumns: ["id"];
           },
         ];
       };
-      marketing_feedback_comments: {
+      conversation: {
         Row: {
-          content: string;
+          archived_at: string | null;
           created_at: string;
           id: string;
-          is_publicly_visible: boolean;
-          thread_id: string;
+          mastra_thread_id: string | null;
+          title: string | null;
           updated_at: string;
           user_id: string;
+          visibility: string;
+          workspace_id: string | null;
         };
         Insert: {
-          content: string;
-          created_at?: string;
-          id?: string;
-          is_publicly_visible?: boolean;
-          thread_id: string;
-          updated_at?: string;
+          archived_at?: string | null;
+          created_at: string;
+          id: string;
+          mastra_thread_id?: string | null;
+          title?: string | null;
+          updated_at: string;
           user_id: string;
+          visibility?: string;
+          workspace_id?: string | null;
         };
         Update: {
-          content?: string;
+          archived_at?: string | null;
           created_at?: string;
           id?: string;
-          is_publicly_visible?: boolean;
-          thread_id?: string;
+          mastra_thread_id?: string | null;
+          title?: string | null;
           updated_at?: string;
           user_id?: string;
+          visibility?: string;
+          workspace_id?: string | null;
         };
         Relationships: [
           {
-            foreignKeyName: "marketing_feedback_comments_thread_id_fkey";
-            columns: ["thread_id"];
+            foreignKeyName: "conversation_user_id_user_id_fk";
+            columns: ["user_id"];
             isOneToOne: false;
-            referencedRelation: "marketing_feedback_threads";
+            referencedRelation: "user";
             referencedColumns: ["id"];
           },
           {
-            foreignKeyName: "marketing_feedback_comments_user_id_fkey";
-            columns: ["user_id"];
+            foreignKeyName: "conversation_workspace_id_fkey";
+            columns: ["workspace_id"];
             isOneToOne: false;
-            referencedRelation: "user_profiles";
+            referencedRelation: "workspaces";
             referencedColumns: ["id"];
           },
         ];
       };
-      marketing_feedback_thread_reactions: {
+      conversation_share: {
         Row: {
+          conversation_id: string;
           created_at: string;
+          expires_at: string | null;
           id: string;
-          reaction_type: Database["public"]["Enums"]["marketing_feedback_reaction_type"];
-          thread_id: string;
+          share_token: string;
           user_id: string;
+          workspace_id: string | null;
         };
         Insert: {
-          created_at?: string;
-          id?: string;
-          reaction_type: Database["public"]["Enums"]["marketing_feedback_reaction_type"];
-          thread_id: string;
+          conversation_id: string;
+          created_at: string;
+          expires_at?: string | null;
+          id: string;
+          share_token: string;
           user_id: string;
+          workspace_id?: string | null;
         };
         Update: {
+          conversation_id?: string;
           created_at?: string;
+          expires_at?: string | null;
           id?: string;
-          reaction_type?: Database["public"]["Enums"]["marketing_feedback_reaction_type"];
-          thread_id?: string;
+          share_token?: string;
           user_id?: string;
+          workspace_id?: string | null;
         };
         Relationships: [
           {
-            foreignKeyName: "marketing_feedback_thread_reactions_thread_id_fkey";
-            columns: ["thread_id"];
+            foreignKeyName: "conversation_share_conversation_id_fk";
+            columns: ["conversation_id"];
             isOneToOne: false;
-            referencedRelation: "marketing_feedback_threads";
+            referencedRelation: "conversation";
             referencedColumns: ["id"];
           },
           {
-            foreignKeyName: "marketing_feedback_thread_reactions_user_id_fkey";
-            columns: ["user_id"];
+            foreignKeyName: "conversation_share_workspace_id_fk";
+            columns: ["workspace_id"];
             isOneToOne: false;
-            referencedRelation: "user_profiles";
+            referencedRelation: "workspaces";
             referencedColumns: ["id"];
           },
         ];
       };
-      marketing_feedback_thread_subscriptions: {
+      dashboard_share: {
         Row: {
+          artifact_id: string;
           created_at: string;
+          expires_at: string | null;
           id: string;
-          thread_id: string;
+          share_token: string;
           user_id: string;
+          workspace_id: string | null;
         };
         Insert: {
-          created_at?: string;
-          id?: string;
-          thread_id: string;
+          artifact_id: string;
+          created_at: string;
+          expires_at?: string | null;
+          id: string;
+          share_token: string;
           user_id: string;
+          workspace_id?: string | null;
         };
         Update: {
+          artifact_id?: string;
           created_at?: string;
+          expires_at?: string | null;
           id?: string;
-          thread_id?: string;
+          share_token?: string;
           user_id?: string;
+          workspace_id?: string | null;
         };
         Relationships: [
           {
-            foreignKeyName: "marketing_feedback_thread_subscriptions_thread_id_fkey";
-            columns: ["thread_id"];
-            isOneToOne: false;
-            referencedRelation: "marketing_feedback_threads";
-            referencedColumns: ["id"];
-          },
-          {
-            foreignKeyName: "marketing_feedback_thread_subscriptions_user_id_fkey";
-            columns: ["user_id"];
+            foreignKeyName: "dashboard_share_workspace_id_fk";
+            columns: ["workspace_id"];
             isOneToOne: false;
-            referencedRelation: "user_profiles";
+            referencedRelation: "workspaces";
             referencedColumns: ["id"];
           },
         ];
       };
-      marketing_feedback_threads: {
+      document_share: {
         Row: {
-          added_to_roadmap: boolean;
-          board_id: string | null;
-          content: string | null;
           created_at: string;
+          doc_path: string;
+          expires_at: string | null;
           id: string;
-          is_publicly_visible: boolean;
-          moderator_hold_category:
-            | Database["public"]["Enums"]["marketing_feedback_moderator_hold_category"]
-            | null;
-          open_for_public_discussion: boolean;
-          priority: Database["public"]["Enums"]["marketing_feedback_thread_priority"];
-          status: Database["public"]["Enums"]["marketing_feedback_thread_status"];
-          title: string;
-          type: Database["public"]["Enums"]["marketing_feedback_thread_type"];
-          updated_at: string;
+          share_token: string;
+          title: string | null;
           user_id: string;
+          workspace_id: string | null;
         };
         Insert: {
-          added_to_roadmap?: boolean;
-          board_id?: string | null;
-          content?: string | null;
-          created_at?: string;
-          id?: string;
-          is_publicly_visible?: boolean;
-          moderator_hold_category?:
-            | Database["public"]["Enums"]["marketing_feedback_moderator_hold_category"]
-            | null;
-          open_for_public_discussion?: boolean;
-          priority?: Database["public"]["Enums"]["marketing_feedback_thread_priority"];
-          status?: Database["public"]["Enums"]["marketing_feedback_thread_status"];
-          title: string;
-          type?: Database["public"]["Enums"]["marketing_feedback_thread_type"];
-          updated_at?: string;
+          created_at: string;
+          doc_path: string;
+          expires_at?: string | null;
+          id: string;
+          share_token: string;
+          title?: string | null;
           user_id: string;
+          workspace_id?: string | null;
         };
         Update: {
-          added_to_roadmap?: boolean;
-          board_id?: string | null;
-          content?: string | null;
           created_at?: string;
+          doc_path?: string;
+          expires_at?: string | null;
           id?: string;
-          is_publicly_visible?: boolean;
-          moderator_hold_category?:
-            | Database["public"]["Enums"]["marketing_feedback_moderator_hold_category"]
-            | null;
-          open_for_public_discussion?: boolean;
-          priority?: Database["public"]["Enums"]["marketing_feedback_thread_priority"];
-          status?: Database["public"]["Enums"]["marketing_feedback_thread_status"];
-          title?: string;
-          type?: Database["public"]["Enums"]["marketing_feedback_thread_type"];
-          updated_at?: string;
+          share_token?: string;
+          title?: string | null;
           user_id?: string;
+          workspace_id?: string | null;
         };
         Relationships: [
           {
-            foreignKeyName: "marketing_feedback_threads_board_id_fkey";
-            columns: ["board_id"];
-            isOneToOne: false;
-            referencedRelation: "marketing_feedback_boards";
-            referencedColumns: ["id"];
-          },
-          {
-            foreignKeyName: "marketing_feedback_threads_user_id_fkey";
-            columns: ["user_id"];
+            foreignKeyName: "document_share_workspace_id_fk";
+            columns: ["workspace_id"];
             isOneToOne: false;
-            referencedRelation: "user_profiles";
+            referencedRelation: "workspaces";
             referencedColumns: ["id"];
           },
         ];
       };
-      marketing_tags: {
-        Row: {
-          created_at: string;
-          id: string;
-          name: string;
-          slug: string;
-        };
-        Insert: {
-          created_at?: string;
-          id?: string;
-          name: string;
-          slug: string;
-        };
-        Update: {
-          created_at?: string;
-          id?: string;
-          name?: string;
-          slug?: string;
-        };
-        Relationships: [];
-      };
       mastra_agent_versions: {
         Row: {
           agentId: string;
@@ -3126,6 +2907,7 @@ export type Database = {
           name: string;
           updated_at: string;
           user_id: string;
+          workspace_id: string | null;
         };
         Insert: {
           created_at: string;
@@ -3135,6 +2917,7 @@ export type Database = {
           name: string;
           updated_at: string;
           user_id: string;
+          workspace_id?: string | null;
         };
         Update: {
           created_at?: string;
@@ -3144,6 +2927,7 @@ export type Database = {
           name?: string;
           updated_at?: string;
           user_id?: string;
+          workspace_id?: string | null;
         };
         Relationships: [
           {
@@ -3160,6 +2944,13 @@ export type Database = {
             referencedRelation: "user";
             referencedColumns: ["id"];
           },
+          {
+            foreignKeyName: "stored_agent_workspace_id_fkey";
+            columns: ["workspace_id"];
+            isOneToOne: false;
+            referencedRelation: "workspaces";
+            referencedColumns: ["id"];
+          },
         ];
       };
       stored_agent_version: {
@@ -3209,6 +3000,7 @@ export type Database = {
       user: {
         Row: {
           createdAt: string;
+          default_workspace_id: string | null;
           email: string;
           emailVerified: boolean;
           id: string;
@@ -3218,6 +3010,7 @@ export type Database = {
         };
         Insert: {
           createdAt: string;
+          default_workspace_id?: string | null;
           email: string;
           emailVerified: boolean;
           id: string;
@@ -3227,6 +3020,7 @@ export type Database = {
         };
         Update: {
           createdAt?: string;
+          default_workspace_id?: string | null;
           email?: string;
           emailVerified?: boolean;
           id?: string;
@@ -3234,7 +3028,15 @@ export type Database = {
           name?: string;
           updatedAt?: string;
         };
-        Relationships: [];
+        Relationships: [
+          {
+            foreignKeyName: "user_default_workspace_id_fkey";
+            columns: ["default_workspace_id"];
+            isOneToOne: false;
+            referencedRelation: "workspaces";
+            referencedColumns: ["id"];
+          },
+        ];
       };
       user_application_settings: {
         Row: {
@@ -3374,174 +3176,6 @@ export type Database = {
           },
         ];
       };
-      workflow: {
-        Row: {
-          cloned_from: string | null;
-          created_at: string;
-          id: string;
-          is_template: boolean;
-          name: string;
-          parameters: string;
-          source_conversation_id: string | null;
-          updated_at: string;
-          user_id: string;
-        };
-        Insert: {
-          cloned_from?: string | null;
-          created_at: string;
-          id: string;
-          is_template?: boolean;
-          name: string;
-          parameters: string;
-          source_conversation_id?: string | null;
-          updated_at: string;
-          user_id: string;
-        };
-        Update: {
-          cloned_from?: string | null;
-          created_at?: string;
-          id?: string;
-          is_template?: boolean;
-          name?: string;
-          parameters?: string;
-          source_conversation_id?: string | null;
-          updated_at?: string;
-          user_id?: string;
-        };
-        Relationships: [
-          {
-            foreignKeyName: "workflow_source_conversation_id_conversation_id_fk";
-            columns: ["source_conversation_id"];
-            isOneToOne: false;
-            referencedRelation: "conversation";
-            referencedColumns: ["id"];
-          },
-          {
-            foreignKeyName: "workflow_user_id_user_id_fk";
-            columns: ["user_id"];
-            isOneToOne: false;
-            referencedRelation: "user";
-            referencedColumns: ["id"];
-          },
-        ];
-      };
-      workflow_run: {
-        Row: {
-          completed_at: string | null;
-          created_at: string;
-          error_message: string | null;
-          fired_by: string | null;
-          id: string;
-          inputs: string;
-          status: string;
-          trigger_id: string | null;
-          workflow_id: string;
-        };
-        Insert: {
-          completed_at?: string | null;
-          created_at: string;
-          error_message?: string | null;
-          fired_by?: string | null;
-          id: string;
-          inputs: string;
-          status: string;
-          trigger_id?: string | null;
-          workflow_id: string;
-        };
-        Update: {
-          completed_at?: string | null;
-          created_at?: string;
-          error_message?: string | null;
-          fired_by?: string | null;
-          id?: string;
-          inputs?: string;
-          status?: string;
-          trigger_id?: string | null;
-          workflow_id?: string;
-        };
-        Relationships: [
-          {
-            foreignKeyName: "workflow_run_workflow_id_workflow_id_fk";
-            columns: ["workflow_id"];
-            isOneToOne: false;
-            referencedRelation: "workflow";
-            referencedColumns: ["id"];
-          },
-        ];
-      };
-      workflow_step: {
-        Row: {
-          id: string;
-          order: number;
-          proposal_template: string;
-          workflow_id: string;
-        };
-        Insert: {
-          id: string;
-          order: number;
-          proposal_template: string;
-          workflow_id: string;
-        };
-        Update: {
-          id?: string;
-          order?: number;
-          proposal_template?: string;
-          workflow_id?: string;
-        };
-        Relationships: [
-          {
-            foreignKeyName: "workflow_step_workflow_id_workflow_id_fk";
-            columns: ["workflow_id"];
-            isOneToOne: false;
-            referencedRelation: "workflow";
-            referencedColumns: ["id"];
-          },
-        ];
-      };
-      workflow_trigger: {
-        Row: {
-          config: string;
-          created_at: string;
-          enabled: boolean;
-          id: string;
-          last_dedupe_key: string | null;
-          last_fired_at: string | null;
-          type: string;
-          updated_at: string;
-          workflow_id: string;
-        };
-        Insert: {
-          config: string;
-          created_at: string;
-          enabled?: boolean;
-          id: string;
-          last_dedupe_key?: string | null;
-          last_fired_at?: string | null;
-          type: string;
-          updated_at: string;
-          workflow_id: string;
-        };
-        Update: {
-          config?: string;
-          created_at?: string;
-          enabled?: boolean;
-          id?: string;
-          last_dedupe_key?: string | null;
-          last_fired_at?: string | null;
-          type?: string;
-          updated_at?: string;
-          workflow_id?: string;
-        };
-        Relationships: [
-          {
-            foreignKeyName: "workflow_trigger_workflow_id_fk";
-            columns: ["workflow_id"];
-            isOneToOne: false;
-            referencedRelation: "workflow";
-            referencedColumns: ["id"];
-          },
-        ];
-      };
       workspace_admin_settings: {
         Row: {
           updated_at: string;
@@ -3760,14 +3394,17 @@ export type Database = {
         Row: {
           updated_at: string;
           workspace_id: string;
+          zapier_connection_mode: string;
         };
         Insert: {
           updated_at?: string;
           workspace_id: string;
+          zapier_connection_mode?: string;
         };
         Update: {
           updated_at?: string;
           workspace_id?: string;
+          zapier_connection_mode?: string;
         };
         Relationships: [
           {
@@ -3921,29 +3558,6 @@ export type Database = {
     };
     Enums: {
       app_role: "admin" | "user";
-      marketing_blog_post_status: "draft" | "published" | "archived";
-      marketing_changelog_status: "draft" | "published" | "archived";
-      marketing_feedback_moderator_hold_category:
-        | "spam"
-        | "duplicate"
-        | "off_topic"
-        | "inappropriate"
-        | "other";
-      marketing_feedback_reaction_type: "like" | "heart" | "celebrate" | "upvote";
-      marketing_feedback_thread_priority: "low" | "medium" | "high" | "urgent";
-      marketing_feedback_thread_status:
-        | "open"
-        | "under_review"
-        | "planned"
-        | "in_progress"
-        | "completed"
-        | "closed";
-      marketing_feedback_thread_type:
-        | "feature_request"
-        | "bug"
-        | "improvement"
-        | "question"
-        | "other";
       pricing_plan_interval: "day" | "week" | "month" | "year";
       subscription_status:
         | "trialing"
@@ -4087,32 +3701,6 @@ export const Constants = {
   public: {
     Enums: {
       app_role: ["admin", "user"],
-      marketing_blog_post_status: ["draft", "published", "archived"],
-      marketing_changelog_status: ["draft", "published", "archived"],
-      marketing_feedback_moderator_hold_category: [
-        "spam",
-        "duplicate",
-        "off_topic",
-        "inappropriate",
-        "other",
-      ],
-      marketing_feedback_reaction_type: ["like", "heart", "celebrate", "upvote"],
-      marketing_feedback_thread_priority: ["low", "medium", "high", "urgent"],
-      marketing_feedback_thread_status: [
-        "open",
-        "under_review",
-        "planned",
-        "in_progress",
-        "completed",
-        "closed",
-      ],
-      marketing_feedback_thread_type: [
-        "feature_request",
-        "bug",
-        "improvement",
-        "question",
-        "other",
-      ],
       pricing_plan_interval: ["day", "week", "month", "year"],
       subscription_status: [
         "trialing",
diff --git a/packages/agents/src/lib/documents/blob-store.ts b/packages/agents/src/lib/documents/blob-store.ts
new file mode 100644
index 00000000..a5374fbb
--- /dev/null
+++ b/packages/agents/src/lib/documents/blob-store.ts
@@ -0,0 +1,53 @@
+import { createHash } from "node:crypto";
+import { BlobsPG } from "@mastra/pg";
+
+/**
+ * Document content store (foreman-udji) — the *Mastra primitive* under document
+ * versioning.
+ *
+ * `BlobsPG` is Mastra's concrete `BlobStore`: content-addressable storage keyed
+ * by the SHA-256 of the content, with natural deduplication (putting identical
+ * bytes twice is a no-op). Mastra ships it for skill versioning; a blob is a
+ * blob, so we reuse it to hold every saved revision of a knowledge document.
+ *
+ * The split mirrors Mastra's own skill versioning exactly: the BlobStore holds
+ * the *content* (deduped, immutable, content-addressed) while a per-document
+ * version-tree manifest (a file in the caller's Workspace filesystem — see
+ * documents/versions.ts) records the ordered list of {version, blobHash}. That
+ * keeps the knowledge layer on Workspace files (no bespoke documents table /
+ * migration, per-tenant isolation for free) while the content lives in the
+ * shared, content-addressed blob table.
+ *
+ * Cross-tenant safety: blobs are keyed only by content hash, so two tenants with
+ * identical content share one row (dedup). A tenant can only *retrieve* a blob
+ * whose hash appears in their own manifest, so the shared table never leaks one
+ * tenant's content to another (versions.ts only ever `get`s hashes it read from
+ * the caller's manifest).
+ */
+
+/** SHA-256 hex of UTF-8 content — the BlobStore key. */
+export function hashContent(content: string): string {
+  return createHash("sha256").update(content, "utf8").digest("hex");
+}
+
+let _blobStore: Promise<BlobsPG> | null = null;
+
+/**
+ * The process-wide document blob store, memoized. Constructs a `BlobsPG` over a
+ * small dedicated pool on the same `DATABASE_URL` as the Mastra storage, and
+ * runs `init()` once (idempotent — creates the `mastra_skill_blobs` table if it
+ * doesn't exist). Returns the same promise on every call.
+ */
+export function getDocumentBlobStore(): Promise<BlobsPG> {
+  if (_blobStore) return _blobStore;
+  _blobStore = (async () => {
+    const connectionString = process.env.DATABASE_URL;
+    if (!connectionString) throw new Error("getDocumentBlobStore: DATABASE_URL is not set");
+    // The REST config variant builds and owns its own pool internally — no need
+    // to import `pg` here. Same DB as the Mastra PostgresStore.
+    const blobs = new BlobsPG({ connectionString });
+    await blobs.init();
+    return blobs;
+  })();
+  return _blobStore;
+}
diff --git a/packages/agents/src/lib/documents/share.ts b/packages/agents/src/lib/documents/share.ts
new file mode 100644
index 00000000..b9b719ca
--- /dev/null
+++ b/packages/agents/src/lib/documents/share.ts
@@ -0,0 +1,149 @@
+import { randomBytes, randomUUID } from "node:crypto";
+import { RequestContext } from "@mastra/core/request-context";
+import { resolveWorkspaceFilesystem } from "../../mastra/agents/workspace";
+import { getSupabase } from "../db";
+import { readManifest, slugFromPath } from "./versions";
+
+/**
+ * Public share tokens for knowledge documents (foreman-jz14). Mirrors the
+ * dashboard_share capability model (lib/dashboards/share.ts): whoever holds a
+ * valid, unexpired `share_token` can read that document on a logged-out page —
+ * no auth, no account. The row carries the owner's `workspace_id` so the public
+ * read resolves the document from the owner's per-tenant Workspace filesystem
+ * without the viewer being authenticated. Revoking = delete the row; the
+ * document is untouched, so a leaked token can be cut independently.
+ */
+
+export interface CreateDocumentShareResult {
+  token: string;
+  expiresAt: string | null;
+}
+
+/** Resolve a workspace's filesystem by id (same as the documents route). */
+function resolveFs(workspaceId: string) {
+  return resolveWorkspaceFilesystem(new RequestContext([["workspaceId", workspaceId]]));
+}
+
+/** documents/q3-launch-plan.md → "Q3 Launch Plan" (fallback when no manifest). */
+function titleFromSlug(slug: string): string {
+  return slug
+    .split("-")
+    .filter(Boolean)
+    .map((w) => w.charAt(0).toUpperCase() + w.slice(1))
+    .join(" ");
+}
+
+/**
+ * Mint a public share token for a document the caller owns. Verifies the file
+ * exists in the caller's workspace before minting (so the route can 404 without
+ * leaking existence). Snapshots the document title for display on the share page.
+ * `expiresInDays` is optional — omit for a link that never expires.
+ */
+export async function createDocumentShare(
+  workspaceId: string | undefined,
+  userId: string,
+  docPath: string,
+  opts: { expiresInDays?: number } = {},
+): Promise<CreateDocumentShareResult | null> {
+  if (!workspaceId) return null;
+  const slug = slugFromPath(docPath);
+  if (!slug) return null;
+
+  const fs = await resolveFs(workspaceId);
+  if (!fs || !(await fs.exists(docPath))) return null;
+
+  const manifest = await readManifest(fs, docPath).catch(() => null);
+  const title = manifest?.title || titleFromSlug(slug);
+
+  const token = randomBytes(24).toString("base64url");
+  const now = new Date();
+  const expiresAt =
+    opts.expiresInDays && opts.expiresInDays > 0
+      ? new Date(now.getTime() + opts.expiresInDays * 86_400_000).toISOString()
+      : null;
+
+  const { error } = await getSupabase().from("document_share").insert({
+    id: randomUUID(),
+    doc_path: docPath,
+    title,
+    workspace_id: workspaceId,
+    user_id: userId,
+    share_token: token,
+    expires_at: expiresAt,
+    created_at: now.toISOString(),
+  });
+  if (error) throw new Error(`createDocumentShare failed: ${error.message}`);
+
+  return { token, expiresAt };
+}
+
+/**
+ * Revoke a document share, scoped to the workspace so any member can revoke one
+ * of the workspace's shared documents. Returns true if a row was deleted.
+ */
+export async function revokeDocumentShare(
+  workspaceId: string | undefined,
+  token: string,
+): Promise<boolean> {
+  if (!workspaceId) return false;
+  const { data } = await getSupabase()
+    .from("document_share")
+    .delete()
+    .eq("workspace_id", workspaceId)
+    .eq("share_token", token)
+    .select("id");
+  return (data?.length ?? 0) > 0;
+}
+
+/** The existing share token for a document, or null if it isn't shared. */
+export async function getDocumentShareToken(
+  workspaceId: string | undefined,
+  docPath: string,
+): Promise<{ token: string; expiresAt: string | null } | null> {
+  if (!workspaceId) return null;
+  const { data } = await getSupabase()
+    .from("document_share")
+    .select("share_token, expires_at")
+    .eq("workspace_id", workspaceId)
+    .eq("doc_path", docPath)
+    .order("created_at", { ascending: false })
+    .limit(1)
+    .maybeSingle();
+  if (!data) return null;
+  return { token: data.share_token, expiresAt: data.expires_at };
+}
+
+/**
+ * Resolve a public share token to its document content. Returns null when the
+ * token is unknown, expired, or the document no longer exists. No auth — the
+ * token is the capability; the document is read from the owner's workspace fs
+ * using the trusted `workspace_id` stored on the share row.
+ */
+export async function getSharedDocument(
+  token: string,
+): Promise<{ title: string; path: string; content: string } | null> {
+  const { data: share } = await getSupabase()
+    .from("document_share")
+    .select("doc_path, title, workspace_id, expires_at")
+    .eq("share_token", token)
+    .maybeSingle();
+  if (!share?.workspace_id) return null;
+
+  if (share.expires_at && Date.parse(share.expires_at) <= Date.now()) {
+    return null; // expired — treat as not found
+  }
+
+  const fs = await resolveFs(share.workspace_id);
+  if (!fs) return null;
+  try {
+    const raw = await fs.readFile(share.doc_path);
+    const content = typeof raw === "string" ? raw : raw.toString("utf8");
+    return {
+      title: share.title || titleFromSlug(slugFromPath(share.doc_path) ?? "document"),
+      path: share.doc_path,
+      content,
+    };
+  } catch {
+    return null;
+  }
+}
diff --git a/packages/agents/src/lib/documents/spaces.ts b/packages/agents/src/lib/documents/spaces.ts
new file mode 100644
index 00000000..a11c8701
--- /dev/null
+++ b/packages/agents/src/lib/documents/spaces.ts
@@ -0,0 +1,67 @@
+/**
+ * Document Spaces (foreman-5e4f, under collaboration epic foreman-wl54).
+ *
+ * The per-tenant Workspace filesystem (foreman-jgme) is keyed by workspace_id, so
+ * `documents/` is implicitly SHARED across every member of a workspace. To give
+ * users a private tier we add a second space stored under a per-user subtree:
+ *
+ *   SHARED   → documents/<slug>.md                       (all workspace members)
+ *   PERSONAL → _private/<userId>/documents/<slug>.md      (only the creator)
+ *
+ * The client never constructs a private path — it only ever uses physical paths
+ * the LIST endpoint handed it, and the server re-validates ownership on every
+ * access via `canAccessDocPath`. A personal path embeds the *caller's own* userId,
+ * never another user's, so it leaks nothing and can't be used to enumerate others.
+ */
+
+export type DocSpace = "shared" | "personal";
+
+const SHARED_DIR = "documents";
+const PRIVATE_ROOT = "_private";
+
+/** Filesystem-safe id segment (mirrors workspace.ts sanitizeId). */
+function sanitizeId(id: string): string {
+  return id.replace(/[^a-zA-Z0-9_-]/g, "");
+}
+
+/** Physical docs root dir within the workspace fs for a space. */
+export function docsRoot(space: DocSpace, userId: string | undefined): string {
+  if (space === "personal") {
+    const uid = userId ? sanitizeId(userId) : "";
+    if (!uid) throw new Error("personal space requires a userId");
+    return `${PRIVATE_ROOT}/${uid}/${SHARED_DIR}`;
+  }
+  return SHARED_DIR;
+}
+
+/** Physical live path for a (space, slug). */
+export function docPath(space: DocSpace, userId: string | undefined, slug: string): string {
+  return `${docsRoot(space, userId)}/${slug}.md`;
+}
+
+/** Which space a physical path belongs to. */
+export function spaceOfPath(path: string): DocSpace {
+  return path.startsWith(`${PRIVATE_ROOT}/`) ? "personal" : "shared";
+}
+
+/**
+ * Whether `userId` may access the document at physical `path`: a top-level doc in
+ * the shared `documents/` dir, or one in their OWN `_private/<uid>/documents/`
+ * dir. Blocks `..` traversal, absolute paths, nested subpaths, history/json files,
+ * and any other user's private subtree.
+ */
+export function canAccessDocPath(path: string, userId: string | undefined): boolean {
+  if (!path || path.includes("..") || path.startsWith("/") || path.startsWith("\\")) {
+    return false;
+  }
+  if (/^documents\/[^/]+\.md$/.test(path)) {
+    return true;
+  }
+  if (userId) {
+    const uid = sanitizeId(userId);
+    if (uid && new RegExp(`^${PRIVATE_ROOT}/${uid}/documents/[^/]+\\.md$`).test(path)) {
+      return true;
+    }
+  }
+  return false;
+}
diff --git a/packages/agents/src/lib/documents/versions.ts b/packages/agents/src/lib/documents/versions.ts
new file mode 100644
index 00000000..ca23d51c
--- /dev/null
+++ b/packages/agents/src/lib/documents/versions.ts
@@ -0,0 +1,194 @@
+import type { WorkspaceFilesystem } from "@mastra/core/workspace";
+import { getDocumentBlobStore, hashContent } from "./blob-store";
+
+/**
+ * Document version tree (foreman-udji) — the manifest half of document
+ * versioning. Each saved revision's *content* lives in the Mastra `BlobStore`
+ * (blob-store.ts); this module keeps the ordered list of revisions per document
+ * as a manifest file next to the document in the caller's Workspace filesystem,
+ * mirroring how Mastra's own skill versioning pairs a BlobStore with a
+ * version-tree.
+ *
+ * Everything is keyed off the document's physical path, so it works for any
+ * Space (foreman-5e4f) — `documents/<slug>.md` (shared) or
+ * `_private/<uid>/documents/<slug>.md` (personal) — with the manifest stored at
+ * `<dir>/.history/<slug>.json` alongside it:
+ *   <dir>/<slug>.md            ← the LIVE copy (agent file tools + bm25 see this)
+ *   <dir>/.history/<slug>.json ← this manifest (append-only version list)
+ *
+ * Keeping the manifest as a workspace file (not a DB row) means it is scoped to
+ * the tenant's workspace automatically and needs no schema/migration.
+ */
+
+/** Split a physical doc path into its directory + slug (basename w/o `.md`). */
+function dirAndSlug(docPath: string): { dir: string; slug: string } | null {
+  const m = docPath.match(/^(.*?)\/?([^/]+)\.md$/);
+  if (!m) return null;
+  return { dir: m[1], slug: m[2] };
+}
+
+/** The manifest path that sits alongside a document. */
+function manifestPathFor(docPath: string): string | null {
+  const parts = dirAndSlug(docPath);
+  if (!parts) return null;
+  const base = parts.dir ? `${parts.dir}/.history` : ".history";
+  return `${base}/${parts.slug}.json`;
+}
+
+export interface DocumentVersionEntry {
+  /** 1-based, monotonically increasing. */
+  version: number;
+  /** SHA-256 of the content — the key into the BlobStore. */
+  blobHash: string;
+  /** Content size in bytes. */
+  size: number;
+  /** Document title at the time this revision was saved. */
+  title: string;
+  /** ISO-8601 timestamp the revision was recorded. */
+  createdAt: string;
+  /** Optional provenance, e.g. "restored from v2". */
+  note?: string;
+}
+
+export interface DocumentManifest {
+  slug: string;
+  /** Title of the latest revision. */
+  title: string;
+  /** Version number currently written to documents/<slug>.md. */
+  current: number;
+  /** Append-only, ascending by version. */
+  versions: DocumentVersionEntry[];
+}
+
+/** Basename slug of any valid `…/<slug>.md` path, else null. */
+export function slugFromPath(path: string): string | null {
+  return dirAndSlug(path)?.slug ?? null;
+}
+
+/** Read a document's version manifest, or null if it has no history yet. */
+export async function readManifest(
+  fs: WorkspaceFilesystem,
+  docPath: string,
+): Promise<DocumentManifest | null> {
+  const manifestPath = manifestPathFor(docPath);
+  if (!manifestPath) return null;
+  try {
+    const raw = await fs.readFile(manifestPath);
+    const text = typeof raw === "string" ? raw : raw.toString("utf8");
+    return JSON.parse(text) as DocumentManifest;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Record a new revision of a document: store its content in the BlobStore and
+ * append a manifest entry. No-ops (returns the unchanged manifest) when the
+ * content is byte-identical to the current revision, so repeated saves of the
+ * same text don't pad the history. Does NOT write the live `<docPath>` — the
+ * caller owns that (save_document already does, restore does below).
+ */
+export async function recordVersion(
+  fs: WorkspaceFilesystem,
+  docPath: string,
+  args: { title: string; content: string; note?: string },
+): Promise<DocumentManifest> {
+  const { title, content, note } = args;
+  const manifestPath = manifestPathFor(docPath);
+  const slug = dirAndSlug(docPath)?.slug;
+  if (!manifestPath || !slug) throw new Error(`recordVersion: invalid doc path ${docPath}`);
+  const blobHash = hashContent(content);
+
+  const existing = await readManifest(fs, docPath);
+  if (existing) {
+    const latest = existing.versions[existing.versions.length - 1];
+    if (latest && latest.blobHash === blobHash && existing.current === latest.version) {
+      // Identical to current revision — nothing to record.
+      return existing;
+    }
+  }
+
+  const blobStore = await getDocumentBlobStore();
+  const size = Buffer.byteLength(content, "utf8");
+  await blobStore.put({
+    hash: blobHash,
+    content,
+    size,
+    mimeType: "text/markdown",
+    createdAt: new Date(),
+  });
+
+  const nextVersion = (existing?.versions.at(-1)?.version ?? 0) + 1;
+  const entry: DocumentVersionEntry = {
+    version: nextVersion,
+    blobHash,
+    size,
+    title,
+    createdAt: new Date().toISOString(),
+    ...(note ? { note } : {}),
+  };
+
+  const manifest: DocumentManifest = {
+    slug,
+    title,
+    current: nextVersion,
+    versions: [...(existing?.versions ?? []), entry],
+  };
+  await fs.writeFile(manifestPath, JSON.stringify(manifest, null, 2));
+  return manifest;
+}
+
+/** List a document's revisions, newest first. Empty if no history. */
+export async function listVersions(
+  fs: WorkspaceFilesystem,
+  docPath: string,
+): Promise<{ current: number; title: string; versions: DocumentVersionEntry[] }> {
+  const manifest = await readManifest(fs, docPath);
+  if (!manifest) return { current: 0, title: "", versions: [] };
+  return {
+    current: manifest.current,
+    title: manifest.title,
+    versions: [...manifest.versions].sort((a, b) => b.version - a.version),
+  };
+}
+
+/**
+ * Fetch the content of one revision. Security invariant: only hashes that appear
+ * in *this* document's manifest are fetched, so the shared content-addressed
+ * blob table can't be used to read another tenant's content.
+ */
+export async function getVersionContent(
+  fs: WorkspaceFilesystem,
+  docPath: string,
+  version: number,
+): Promise<{ content: string; entry: DocumentVersionEntry } | null> {
+  const manifest = await readManifest(fs, docPath);
+  const entry = manifest?.versions.find((v) => v.version === version);
+  if (!entry) return null;
+
+  const blobStore = await getDocumentBlobStore();
+  const blob = await blobStore.get(entry.blobHash);
+  if (!blob) return null;
+  return { content: blob.content, entry };
+}
+
+/**
+ * Restore an older revision: write it back as the live `<docPath>` and record it
+ * as a NEW revision (history stays append-only, so a restore is itself an
+ * undoable event). Returns the updated manifest.
+ */
+export async function restoreVersion(
+  fs: WorkspaceFilesystem,
+  docPath: string,
+  version: number,
+): Promise<DocumentManifest | null> {
+  const restored = await getVersionContent(fs, docPath, version);
+  if (!restored) return null;
+
+  await fs.writeFile(docPath, restored.content);
+  return recordVersion(fs, docPath, {
+    title: restored.entry.title,
+    content: restored.content,
+    note: `restored from v${version}`,
+  });
+}
diff --git a/packages/agents/src/lib/durable/deploy.ts b/packages/agents/src/lib/durable/deploy.ts
new file mode 100644
index 00000000..31b87b66
--- /dev/null
+++ b/packages/agents/src/lib/durable/deploy.ts
@@ -0,0 +1,379 @@
+import type { ExperimentalZapierSdk } from "../zapier/sdk";
+import { AGED_DURABLE_DEPS } from "./deps";
+import type { AutomationTrigger } from "./types";
+
+/**
+ * Deploy / run / inspect durable automations against the experimental SDK
+ * (foreman-l7xq). Every function takes the SDK client as a parameter so the layer
+ * is testable with a fake; production passes `getExperimentalSdkForUser(userId)`.
+ */
+
+const SOURCE_FILE = "workflow.ts";
+
+type Sdk = ExperimentalZapierSdk;
+
+/** Every import in the durable source must be an aged-pinned dependency. */
+function durableDependencies(): Record<string, string> {
+  return { "@zapier/zapier-sdk": AGED_DURABLE_DEPS.sdk, zod: AGED_DURABLE_DEPS.zod };
+}
+
+function shapeConnections(
+  connections?: Record<string, string | number>,
+): Record<string, { connectionId: string | number }> | undefined {
+  if (!connections) return undefined;
+  const out: Record<string, { connectionId: string | number }> = {};
+  for (const [alias, id] of Object.entries(connections)) out[alias] = { connectionId: id };
+  return Object.keys(out).length ? out : undefined;
+}
+
+export function editorUrl(workflowId: string): string {
+  return `https://zapier.com/durables-editor/${workflowId}`;
+}
+
+export interface DeployAutomationOptions {
+  sdk: Sdk;
+  name: string;
+  description?: string;
+  /** The durable workflow.ts source — `defineDurable(...)` + `export default`. */
+  source: string;
+  /** Connection alias → connection id, for every alias the source references. */
+  connections?: Record<string, string | number>;
+  /** Zapier app trigger to claim; omit for manual/webhook automations. */
+  trigger?: AutomationTrigger;
+  /** Publish enabled (default true). */
+  enabled?: boolean;
+  /** Private to the deploying account — EA default (default true). */
+  isPrivate?: boolean;
+}
+
+export interface DeployResult {
+  workflowId: string;
+  versionId: string;
+  enabled: boolean;
+  isPrivate: boolean;
+  editorUrl: string;
+  triggerUrl: string;
+  /** A trigger was requested + enabled, but the (async, silent) claim left it disabled. */
+  triggerClaimFailed: boolean;
+  disabledReason?: string | null;
+}
+
+/**
+ * Create a workflow container + publish its first version. When a trigger is
+ * requested with `enabled`, re-read the workflow to confirm the claim landed —
+ * trigger claims are asynchronous and fail SILENTLY (publish returns ok, the
+ * workflow stays disabled), most often from an unversioned `selectedApi`.
+ */
+export async function deployAutomation(opts: DeployAutomationOptions): Promise<DeployResult> {
+  const {
+    sdk,
+    name,
+    description,
+    source,
+    connections,
+    trigger,
+    enabled = true,
+    isPrivate = true,
+  } = opts;
+
+  const created = await sdk.createWorkflow({ name, description, is_private: isPrivate });
+  const workflowId = created.data.id;
+
+  const version = await sdk.publishWorkflowVersion({
+    workflow: workflowId,
+    sourceFiles: { [SOURCE_FILE]: source },
+    dependencies: durableDependencies(),
+    zapierDurableVersion: AGED_DURABLE_DEPS.durable,
+    enabled,
+    connections: shapeConnections(connections),
+    trigger: trigger
+      ? {
+          action: trigger.action,
+          selectedApi: trigger.selectedApi,
+          authenticationId: trigger.authenticationId ?? null,
+          params: trigger.params,
+        }
+      : undefined,
+  });
+
+  let finalEnabled = enabled;
+  let triggerClaimFailed = false;
+  let disabledReason: string | null | undefined;
+  if (trigger && enabled) {
+    const wf = await sdk.getWorkflow({ workflow: workflowId });
+    finalEnabled = wf.data.enabled;
+    disabledReason = wf.data.disabled_reason ?? null;
+    triggerClaimFailed = !wf.data.enabled;
+  }
+
+  return {
+    workflowId,
+    versionId: version.data.id,
+    enabled: finalEnabled,
+    isPrivate,
+    editorUrl: editorUrl(workflowId),
+    triggerUrl: created.data.trigger_url,
+    triggerClaimFailed,
+    disabledReason,
+  };
+}
+
+/**
+ * Run durable source once, ephemerally (no saved workflow) — the "test it before
+ * you deploy" path. Returns immediately with a run id; poll `getDurableRunStatus`
+ * until terminal.
+ */
+export async function runAutomationOnce(opts: {
+  sdk: Sdk;
+  source: string;
+  input?: unknown;
+  connections?: Record<string, string | number>;
+}): Promise<{ runId: string; status: string }> {
+  const r = await opts.sdk.runDurable({
+    sourceFiles: { [SOURCE_FILE]: opts.source },
+    input: opts.input,
+    dependencies: durableDependencies(),
+    zapierDurableVersion: AGED_DURABLE_DEPS.durable,
+    connections: shapeConnections(opts.connections),
+    private: true,
+  });
+  return { runId: r.data.id, status: r.data.status };
+}
+
+/** Manually fire a deployed workflow. Returns the trigger id (bridge via getTriggerRunStatus). */
+export async function triggerAutomation(opts: {
+  sdk: Sdk;
+  workflowId: string;
+  input?: unknown;
+}): Promise<{ triggerId: string }> {
+  const r = await opts.sdk.triggerWorkflow({ workflow: opts.workflowId, input: opts.input });
+  return { triggerId: r.data.id };
+}
+
+/** One durable operation (step) that has retried or is failing — the actionable subset. */
+export interface DurableOpDetail {
+  name: string;
+  type: string;
+  status: string;
+  retryCount: number;
+  maxAttempts?: number;
+  /** When the engine will retry this op next (ISO), while it's between attempts. */
+  nextRetryAt?: string;
+  error?: unknown;
+}
+
+/**
+ * A human-approval callback gate the durable is paused on (foreman-rm8z). Surfaced
+ * so the /automations UI can show "waiting for approval" + what payload is expected.
+ * NOTE: the callback URL is minted INSIDE the durable by `ctx.createCallback` and is
+ * not exposed here — `getDurableRun` only returns the token/schema — so resuming
+ * (the approve/deny POST) is a separate, still-blocked capability (see the rm8z
+ * follow-up). This is the read-only half.
+ */
+export interface DurableCallback {
+  name: string;
+  status: string;
+  callbackToken?: string | null;
+  payloadSchema?: unknown;
+  /** When Zapier will auto-resume/expire the gate, if a deadline was set (ISO). */
+  resumeAt?: string;
+  expiresAt?: string;
+}
+
+/**
+ * Compact in-flight view distilled from `getDurableRun.execution` (foreman-jc12 +
+ * rm8z). The top-level run status stays "started" while a step RETRIES or the run
+ * WAITS on a human callback, so the real signal lives here: `summary.last_error`,
+ * the retrying/failed ops, and any pending approval gate. Null when the run is
+ * executing cleanly (nothing to surface).
+ */
+export interface DurableRunDetail {
+  totalAttempts?: number;
+  lastError?: { code: string; title: string; detail?: string | null } | null;
+  retrying: DurableOpDetail[];
+  /** True when the durable is paused on a human-approval callback (execution.status = waiting). */
+  waiting?: boolean;
+  callbacks?: DurableCallback[];
+}
+
+type DurableExecution = NonNullable<Awaited<ReturnType<Sdk["getDurableRun"]>>["data"]["execution"]>;
+
+function extractRunDetail(execution: DurableExecution | null): DurableRunDetail | null {
+  if (!execution) return null;
+  const ops = execution.operations ?? [];
+  const retrying: DurableOpDetail[] = ops
+    .filter((o) => o.retry_count > 0 || o.status === "failed" || o.status === "retrying")
+    .map((o) => ({
+      name: o.name,
+      type: o.type,
+      status: o.status,
+      retryCount: o.retry_count,
+      maxAttempts: o.max_attempts,
+      nextRetryAt: o.next_retry_at,
+      error: o.error,
+    }));
+  // Approval gates: ops carrying a callback_token are createCallback pauses.
+  const callbacks: DurableCallback[] = ops
+    .filter((o) => o.callback_token != null)
+    .map((o) => ({
+      name: o.name,
+      status: o.status,
+      callbackToken: o.callback_token,
+      payloadSchema: o.payload_schema,
+      resumeAt: o.resume_at,
+      expiresAt: o.expires_at,
+    }));
+  const waiting = execution.status === "waiting";
+  const lastError = execution.summary?.last_error ?? null;
+  // Nothing actionable — a clean, still-running execution.
+  if (!lastError && retrying.length === 0 && !waiting && callbacks.length === 0) return null;
+  return {
+    totalAttempts: execution.summary?.total_attempts,
+    lastError,
+    retrying,
+    ...(waiting ? { waiting } : {}),
+    ...(callbacks.length ? { callbacks } : {}),
+  };
+}
+
+export async function getDurableRunStatus(
+  sdk: Sdk,
+  runId: string,
+): Promise<{ status: string; output: unknown; error: unknown; detail: DurableRunDetail | null }> {
+  const r = await sdk.getDurableRun({ run: runId });
+  return {
+    status: r.data.status,
+    output: r.data.output,
+    error: r.data.error,
+    detail: extractRunDetail(r.data.execution),
+  };
+}
+
+/** Cancel a running durable run. Returns the resulting status ("cancelled"). */
+export async function cancelDurableRun(sdk: Sdk, runId: string): Promise<string> {
+  const r = await sdk.cancelDurableRun({ run: runId });
+  return r.data.status;
+}
+
+export interface ResolvedCallback {
+  /** The callback endpoint to POST the approval/rejection payload to. A PUBLIC bearer URL — never expose to a browser. */
+  url: string;
+  /** The gate's name (the `ctx.createCallback` name). */
+  name: string;
+  payloadSchema?: unknown;
+}
+
+/**
+ * Resolve a durable's human-approval callback URL from OUTSIDE, on demand
+ * (foreman-zfnj). `getDurableRun` does NOT expose the URL on the callback op — it
+ * is minted inside the durable and only surfaces if the durable REPORTS it via a
+ * step whose result carries `{ callbackUrl, callbackName }` (Foreman's authoring
+ * convention — see `buildApprovalDurableSource`). Reads the run's execution and
+ * returns the URL for the named (or sole) still-pending callback, or null if the
+ * run isn't waiting on that gate / never reported a URL. Resolved fresh each time
+ * and never persisted, so the bearer URL never lands in Foreman's DB or the UI.
+ */
+export async function resolveCallbackUrl(
+  sdk: Sdk,
+  durableRunId: string,
+  callbackName?: string,
+): Promise<ResolvedCallback | null> {
+  const r = await sdk.getDurableRun({ run: durableRunId });
+  const execution = r.data.execution;
+  if (!execution) return null;
+  const ops = (execution.operations ?? []) as Array<{
+    name: string;
+    status: string;
+    callback_token?: string | null;
+    payload_schema?: unknown;
+    result?: unknown;
+  }>;
+
+  // A callback gate is still open only while its op is pending/waiting.
+  const pending = ops.filter(
+    (o) => o.callback_token != null && (o.status === "pending" || o.status === "waiting"),
+  );
+  const gate = callbackName ? pending.find((o) => o.name === callbackName) : pending[0];
+  if (!gate) return null;
+
+  // The URL comes from the step the durable authored to report it.
+  const reported = ops
+    .map((o) => o.result as { callbackUrl?: string; callbackName?: string } | undefined)
+    .find((res) => res?.callbackUrl && (!res.callbackName || res.callbackName === gate.name));
+  if (!reported?.callbackUrl) return null;
+
+  return { url: reported.callbackUrl, name: gate.name, payloadSchema: gate.payload_schema };
+}
+
+/** POST an approval/rejection payload to a durable callback URL (foreman-zfnj). */
+export async function postCallback(
+  url: string,
+  payload: unknown,
+): Promise<{ ok: boolean; status: number }> {
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(payload ?? {}),
+  });
+  return { ok: res.ok, status: res.status };
+}
+
+export async function getTriggerRunStatus(
+  sdk: Sdk,
+  triggerId: string,
+): Promise<{ status: string; durableRunId: string | null; output: unknown; error: unknown }> {
+  const r = await sdk.getTriggerRun({ trigger: triggerId });
+  return {
+    status: r.data.status,
+    durableRunId: r.data.durable_run_id,
+    output: r.data.output,
+    error: r.data.error,
+  };
+}
+
+export interface AutomationSummary {
+  id: string;
+  name: string;
+  enabled: boolean;
+  isPrivate: boolean;
+  editorUrl: string;
+  triggers: unknown;
+}
+
+export async function listAutomations(sdk: Sdk): Promise<AutomationSummary[]> {
+  const res = await sdk.listWorkflows();
+  return res.data.map((w) => ({
+    id: w.id,
+    name: w.name,
+    enabled: w.enabled,
+    isPrivate: w.is_private,
+    editorUrl: editorUrl(w.id),
+    triggers: w.triggers,
+  }));
+}
+
+export async function inspectAutomation(
+  sdk: Sdk,
+  workflowId: string,
+  maxRuns = 10,
+): Promise<{ workflow: unknown; runs: unknown[] }> {
+  const wf = await sdk.getWorkflow({ workflow: workflowId });
+  const runs = await sdk.listWorkflowRuns({ workflow: workflowId, maxItems: maxRuns });
+  return { workflow: wf.data, runs: runs.data };
+}
+
+export async function deleteAutomation(sdk: Sdk, workflowId: string): Promise<void> {
+  await sdk.deleteWorkflow({ workflow: workflowId });
+}
+
+/** Enable or disable a deployed workflow on Zapier. Returns the resulting enabled state. */
+export async function setAutomationEnabled(
+  sdk: Sdk,
+  workflowId: string,
+  enabled: boolean,
+): Promise<boolean> {
+  const r = enabled
+    ? await sdk.enableWorkflow({ workflow: workflowId })
+    : await sdk.disableWorkflow({ workflow: workflowId });
+  return r.data.enabled;
+}
diff --git a/packages/agents/src/lib/durable/deps.ts b/packages/agents/src/lib/durable/deps.ts
new file mode 100644
index 00000000..9e48c476
--- /dev/null
+++ b/packages/agents/src/lib/durable/deps.ts
@@ -0,0 +1,22 @@
+/**
+ * Aged dependency pins for the durable sandbox.
+ *
+ * Zapier runs durable source in a Vercel sandbox that installs deps with
+ * `pnpm install --config.minimumReleaseAge=1440`, so any direct dependency
+ * published less than 24h ago is REJECTED. `@zapier/zapier-sdk` publishes several
+ * times a day, so its npm-latest is regularly too young. These are the latest
+ * versions of each that were >=24h old on 2026-06-25 and proven end-to-end by the
+ * durable PoC capstone (foreman-l7xq) — runDurable + publishWorkflowVersion +
+ * triggerWorkflow all succeeded against this set.
+ *
+ * `@zapier/zapier-sdk` and `zod` are passed in `dependencies` (the source imports
+ * them); `@zapier/zapier-durable` is passed via `zapierDurableVersion`. None of
+ * these are Foreman runtime deps — they only ever go to Zapier's sandbox as call
+ * arguments. A later milestone can resolve these live (the >=24h selector) instead
+ * of pinning constants.
+ */
+export const AGED_DURABLE_DEPS = {
+  sdk: "0.79.0",
+  durable: "0.6.1",
+  zod: "4.4.3",
+} as const;
diff --git a/packages/agents/src/lib/durable/index.ts b/packages/agents/src/lib/durable/index.ts
new file mode 100644
index 00000000..c64f1709
--- /dev/null
+++ b/packages/agents/src/lib/durable/index.ts
@@ -0,0 +1,30 @@
+/**
+ * Durable-automation layer (foreman-l7xq) — built entirely on the experimental
+ * Zapier SDK surface. The execution substrate for the trigger/workflow rebuild.
+ */
+
+export {
+  type AutomationSummary,
+  cancelDurableRun,
+  type DeployAutomationOptions,
+  type DeployResult,
+  type DurableCallback,
+  type DurableOpDetail,
+  type DurableRunDetail,
+  deleteAutomation,
+  deployAutomation,
+  editorUrl,
+  getDurableRunStatus,
+  getTriggerRunStatus,
+  inspectAutomation,
+  listAutomations,
+  postCallback,
+  type ResolvedCallback,
+  resolveCallbackUrl,
+  runAutomationOnce,
+  setAutomationEnabled,
+  triggerAutomation,
+} from "./deploy";
+export { AGED_DURABLE_DEPS } from "./deps";
+export { buildDurableSource, humanApprovalGate } from "./source";
+export type { ActionType, AutomationSpec, AutomationStep, AutomationTrigger } from "./types";
diff --git a/packages/agents/src/lib/durable/source.ts b/packages/agents/src/lib/durable/source.ts
new file mode 100644
index 00000000..4fd9a750
--- /dev/null
+++ b/packages/agents/src/lib/durable/source.ts
@@ -0,0 +1,60 @@
+import type { AutomationSpec } from "./types";
+
+/**
+ * Generate a durable `workflow.ts` source string from a simple linear spec.
+ *
+ * Emits the parser-friendly shape the durable editor recognizes: a module-level
+ * `createZapierSdk()`, one `ctx.step` per app action whose body is a single
+ * `sdk.runAction({...})`, and `export default`. For anything dynamic (input
+ * schemas, loops, waits, branches, cross-step references) the agent authors the
+ * source directly — this generator only covers static linear chains.
+ */
+/**
+ * Canonical human-approval gate for durable source (foreman-zfnj). `ctx.createCallback`
+ * mints a callback URL that `getDurableRun` does NOT expose; Foreman resolves it
+ * (`resolveCallbackUrl`) from a step the durable authors to REPORT it. Any durable with
+ * an approval gate MUST emit this pattern so the /automations Approve/Deny action can
+ * POST to the URL. Returns source lines that: create the gate, report its `{ callbackUrl,
+ * callbackName }` via a step, and await the decision into `<id>Decision`.
+ */
+export function humanApprovalGate(name: string): string {
+  const q = (v: unknown) => JSON.stringify(v);
+  const id = name.replace(/[^a-zA-Z0-9_$]/g, "_").replace(/^([0-9])/, "_$1");
+  return [
+    `  const [${id}Approval, ${id}Url] = await ctx.createCallback(${q(name)});`,
+    `  await ctx.step(${q(`__report_callback_url_${name}`)}, async () => ({ callbackUrl: ${id}Url, callbackName: ${q(name)} }));`,
+    `  const ${id}Decision = await ${id}Approval;`,
+  ].join("\n");
+}
+
+export function buildDurableSource(spec: AutomationSpec): string {
+  const q = (v: unknown) => JSON.stringify(v);
+
+  const stepLines = spec.steps.map((step, i) => {
+    const v = `step_${i}`;
+    return (
+      `  const ${v} = await ctx.step(${q(step.id)}, async () =>\n` +
+      `    sdk.runAction({ appKey: ${q(step.appKey)}, actionType: ${q(step.actionType)}, ` +
+      `actionKey: ${q(step.actionKey)}, connection: ${q(step.connection)}, ` +
+      `inputs: ${q(step.inputs ?? {})} }),\n` +
+      `  );`
+    );
+  });
+
+  const returns = spec.steps.map((_, i) => `step_${i}`).join(", ");
+
+  return [
+    `import { defineDurable } from "@zapier/zapier-durable";`,
+    `import { createZapierSdk } from "@zapier/zapier-sdk";`,
+    ``,
+    `const sdk = createZapierSdk();`,
+    ``,
+    `const workflow = defineDurable(${q(spec.name)}, async (ctx) => {`,
+    ...stepLines,
+    `  return { ${returns} };`,
+    `});`,
+    ``,
+    `export default workflow;`,
+    ``,
+  ].join("\n");
+}
diff --git a/packages/agents/src/lib/durable/types.ts b/packages/agents/src/lib/durable/types.ts
new file mode 100644
index 00000000..6a92683b
--- /dev/null
+++ b/packages/agents/src/lib/durable/types.ts
@@ -0,0 +1,57 @@
+/**
+ * Shared types for the durable-automation layer (foreman-l7xq).
+ *
+ * An "automation" = a durable workflow (the execution substrate) plus an optional
+ * Zapier app trigger. The agent usually authors the durable `source` directly per
+ * the Zapier durable format; `buildDurableSource` (source.ts) is a convenience
+ * generator for simple linear specs.
+ */
+
+export type ActionType =
+  | "write"
+  | "read"
+  | "read_bulk"
+  | "search"
+  | "search_or_write"
+  | "search_and_write"
+  | "filter"
+  | "run";
+
+/** A single app-action step — emitted as one `ctx.step` running one `runAction`. */
+export interface AutomationStep {
+  /** Step id, kebab-case — becomes the `ctx.step` name and the editor node label. */
+  id: string;
+  appKey: string;
+  actionType: ActionType;
+  actionKey: string;
+  /** Connection alias (snake_case); resolved from the connections map at deploy/run. */
+  connection: string;
+  /**
+   * Static action inputs, emitted as a literal. Dynamic references (prior steps,
+   * workflow input) require agent-authored raw source, not this generator.
+   */
+  inputs?: Record<string, unknown>;
+}
+
+/**
+ * A Zapier app trigger to claim on publish. Omit for manual/webhook automations.
+ * `selectedApi` MUST be the version-pinned implementation id (e.g.
+ * "GoogleSheetsAPI@2.3.0") — a bare app key makes the claim fail SILENTLY.
+ */
+export interface AutomationTrigger {
+  selectedApi: string;
+  action: string;
+  authenticationId?: string | null;
+  /** Trigger params, each shaped to its field `value_type` (ARRAY vs STRING). */
+  params?: Record<string, unknown>;
+}
+
+/** Structured spec for the linear-automation source generator. */
+export interface AutomationSpec {
+  name: string;
+  description?: string;
+  steps: AutomationStep[];
+  /** Connection alias → connection id. */
+  connections?: Record<string, string | number>;
+  trigger?: AutomationTrigger;
+}
diff --git a/packages/agents/src/lib/identity.ts b/packages/agents/src/lib/identity.ts
index c9842b77..c43b7ae9 100644
--- a/packages/agents/src/lib/identity.ts
+++ b/packages/agents/src/lib/identity.ts
@@ -47,6 +47,51 @@ export async function ensureUserExists(userId: string): Promise<void> {
   );
 }
 
+// ─── Workspace Resolution ───
+
+/**
+ * Create a personal solo workspace and return its id. Used for channel-only
+ * principals, who have no auth.users row — so the signup trigger that provisions
+ * a workspace for web users (handle_auth_user_created) never fired for them.
+ */
+async function createSoloWorkspace(name: string, slugBase: string): Promise<string> {
+  const supabase = getSupabase();
+  const id = randomUUID();
+  const slug = `${slugBase}-${id.slice(0, 8)}`.toLowerCase().replace(/[^a-z0-9-]+/g, "-");
+  await supabase.from("workspaces").insert({ id, slug, name, membership_type: "solo" });
+  return id;
+}
+
+/**
+ * The active workspace a principal operates in. Reads `public.user
+ * .default_workspace_id`; for web principals created before that column was
+ * populated, lazily backfills it from the platform solo workspace
+ * (`user_settings.default_workspace`, provisioned by the signup trigger).
+ */
+export async function resolveActiveWorkspace(userId: string): Promise<string | null> {
+  const supabase = getSupabase();
+  const { data: principal } = await supabase
+    .from("user")
+    .select("default_workspace_id")
+    .eq("id", userId)
+    .maybeSingle();
+  if (principal?.default_workspace_id) return principal.default_workspace_id as string;
+
+  const { data: settings } = await supabase
+    .from("user_settings")
+    .select("default_workspace")
+    .eq("id", userId)
+    .maybeSingle();
+  if (settings?.default_workspace) {
+    await supabase
+      .from("user")
+      .update({ default_workspace_id: settings.default_workspace })
+      .eq("id", userId);
+    return settings.default_workspace as string;
+  }
+  return null;
+}
+
 // ─── API Key Resolution ───
 
 function hashApiKey(key: string): string {
@@ -137,6 +182,16 @@ export async function registerChannelUser(
     updatedAt: now,
   });
 
+  // Channel-only principals get a personal solo workspace (they have no
+  // auth.users row, so the signup trigger never provisioned one). They are NOT
+  // workspace_members — that requires an auth-backed user_profile — so they join
+  // a team by linking to a web account via channel_link_code.
+  const workspaceId = await createSoloWorkspace(
+    `${displayName || channelUserId}'s Workspace`,
+    `${channel}-${channelUserId}`,
+  );
+  await supabase.from("user").update({ default_workspace_id: workspaceId }).eq("id", userId);
+
   await supabase.from("channel_identity").insert({
     id: randomUUID(),
     user_id: userId,
@@ -215,6 +270,7 @@ export async function redeemChannelLinkCode(
 
 export interface ResolvedIdentity {
   userId: string;
+  workspaceId?: string;
   orgId?: string;
   channel:
     | "web"
@@ -245,7 +301,8 @@ export async function resolveFromRequest(request: Request): Promise<ResolvedIden
     const result = await resolveFromSupabaseJwt(token);
     if (result) {
       await ensureUserExists(result.userId);
-      return { userId: result.userId, orgId: result.orgId, channel: "web" };
+      const workspaceId = (await resolveActiveWorkspace(result.userId)) ?? undefined;
+      return { userId: result.userId, workspaceId, orgId: result.orgId, channel: "web" };
     }
   }
 
@@ -253,7 +310,10 @@ export async function resolveFromRequest(request: Request): Promise<ResolvedIden
   const apiKeyHeader = request.headers.get("x-api-key");
   if (apiKeyHeader) {
     const userId = await resolveFromApiKey(apiKeyHeader);
-    if (userId) return { userId, channel: "mcp" };
+    if (userId) {
+      const workspaceId = (await resolveActiveWorkspace(userId)) ?? undefined;
+      return { userId, workspaceId, channel: "mcp" };
+    }
   }
 
   return null;
diff --git a/packages/agents/src/lib/knowledge/vector.ts b/packages/agents/src/lib/knowledge/vector.ts
new file mode 100644
index 00000000..0ffaa44e
--- /dev/null
+++ b/packages/agents/src/lib/knowledge/vector.ts
@@ -0,0 +1,62 @@
+import { fastembed } from "@mastra/fastembed";
+import { PgVector } from "@mastra/pg";
+import { embedMany } from "ai";
+import { getEnv } from "../env";
+
+/**
+ * Knowledge-layer vector primitives (foreman-aqjx).
+ *
+ * Documents live as markdown files in each tenant's Workspace filesystem
+ * (foreman-jgme). The SHARED `documents/` tier is made semantically searchable
+ * via Mastra's native Workspace.search — no second RAG pipeline. This module
+ * owns only the low-level pieces (vector store, embedder, index-name); the
+ * Workspace construction + indexing live in mastra/agents/workspace.ts, which
+ * already owns the per-tenant directory logic.
+ *
+ * WHY one physical index per workspace (not one shared index + a metadata
+ * filter): the auto-injected `mastra_workspace_search` tool lets the LLM pick
+ * the search `mode` but does NOT expose `filter`, and BM25 ignores filters
+ * entirely (a hybrid search merges an unfiltered keyword half). A shared
+ * multi-tenant index would therefore leak across workspaces. Giving each
+ * workspace its own index makes the index itself the tenant boundary, so the
+ * LLM's mode choice can never cross tenants.
+ *
+ * Embedder = fastembed (local ONNX bge-small, 384-dim) — the same embedder as
+ * the app catalog and agent memory, so knowledge search needs no OpenAI
+ * key/quota and stays dimension-consistent. The vector index is lazily created
+ * on first upsert (dimension inferred), so there is no migration.
+ */
+
+let _vector: PgVector | undefined;
+
+/** Lazy PgVector singleton backing every per-workspace knowledge index. */
+export function getKnowledgeVector(): PgVector {
+  if (_vector) return _vector;
+  _vector = new PgVector({ id: "foreman-knowledge", connectionString: getEnv().DATABASE_URL });
+  return _vector;
+}
+
+/**
+ * Batch embedder in the shape Mastra's Workspace SearchEngine expects
+ * (`BatchEmbedder`: `(texts) => number[][]` branded `batch: true`). Wraps the
+ * fastembed AI-SDK model via `embedMany`, exactly like lib/catalog/vector.ts.
+ */
+export const knowledgeEmbedder = Object.assign(
+  async (texts: string[]): Promise<number[][]> => {
+    const { embeddings } = await embedMany({ model: fastembed, values: texts });
+    return embeddings;
+  },
+  { batch: true as const },
+);
+
+/**
+ * Per-workspace physical index name. Vector index names must be valid SQL
+ * identifiers (start with a letter/underscore, only `[A-Za-z0-9_]`, ≤63 chars),
+ * so workspace-id hyphens (UUIDs) become underscores. `tenantKey` is the same
+ * key the Workspace filesystem is scoped by (a sanitized workspace_id, or the
+ * `_shared` fallback), so the index and the files line up 1:1.
+ */
+export function knowledgeIndexName(tenantKey: string): string {
+  const safe = tenantKey.replace(/[^A-Za-z0-9_]/g, "_");
+  return `knowledge_${safe}`.slice(0, 63);
+}
diff --git a/packages/agents/src/lib/preview/serve.ts b/packages/agents/src/lib/preview/serve.ts
new file mode 100644
index 00000000..4e0cc967
--- /dev/null
+++ b/packages/agents/src/lib/preview/serve.ts
@@ -0,0 +1,178 @@
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { writeFile } from "node:fs/promises";
+import { Socket } from "node:net";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+/**
+ * Live-preview server for the real shadcn harness (foreman-8nyg). The agent
+ * builds a genuine React component using the project's shadcn/ui components;
+ * we write it into a warm Vite + React + Tailwind + shadcn template
+ * (packages/agents/preview-template) whose dev server stays running, and Vite
+ * HMR re-renders it live in the chat's preview panel.
+ *
+ * The Vite process is spawned via node's child_process (detached + unref'd) so
+ * it survives the agent turn — exactly like a long-running dev server should.
+ * We run vite's CLI through `process.execPath` (no shell) to avoid the Windows
+ * console-window popup that `shell:true`/`npx` causes.
+ *
+ * SPIKE limits: ONE shared template/dev-server (not per-tenant — foreman-jgme),
+ * localhost only (the dev browser reaches it directly). Cloud/per-tenant/
+ * sandbox isolation + security are phase-2.
+ */
+
+const PREVIEW_PORT = Number(process.env.FOREMAN_PREVIEW_PORT ?? 7332);
+
+/**
+ * Locate packages/agents/preview-template robustly — works whether this module
+ * runs from source (`mastra dev` bundles it to a different depth) or from a
+ * built output, by walking up from both the module dir and process.cwd().
+ */
+function resolveTemplateDir(): string {
+  const fromEnv = process.env.FOREMAN_PREVIEW_TEMPLATE_DIR;
+  if (fromEnv && existsSync(path.join(fromEnv, "package.json"))) return fromEnv;
+
+  const starts = [path.dirname(fileURLToPath(import.meta.url)), process.cwd()];
+  for (const start of starts) {
+    let dir = start;
+    for (let i = 0; i < 12; i++) {
+      for (const candidate of [
+        path.join(dir, "preview-template"),
+        path.join(dir, "packages", "agents", "preview-template"),
+      ]) {
+        if (existsSync(path.join(candidate, "package.json"))) return candidate;
+      }
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  throw new Error(
+    "preview: could not locate packages/agents/preview-template (set FOREMAN_PREVIEW_TEMPLATE_DIR)",
+  );
+}
+
+/** Resolve once and remember which port/template a started server is using. */
+let viteStarting: Promise<void> | null = null;
+
+function waitForPort(port: number, timeoutMs: number): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  return new Promise((resolve, reject) => {
+    const attempt = () => {
+      const socket = new Socket();
+      socket.setTimeout(1000);
+      const cleanup = () => {
+        socket.removeAllListeners();
+        socket.destroy();
+      };
+      socket.once("connect", () => {
+        cleanup();
+        resolve();
+      });
+      const retry = () => {
+        cleanup();
+        if (Date.now() > deadline) {
+          reject(new Error(`preview: Vite did not open ${port} within ${timeoutMs}ms`));
+        } else {
+          setTimeout(attempt, 400);
+        }
+      };
+      socket.once("error", retry);
+      socket.once("timeout", retry);
+      socket.connect(port, "127.0.0.1");
+    };
+    attempt();
+  });
+}
+
+/** Start the template's Vite dev server once and wait until it's accepting connections. */
+function ensureVite(templateDir: string): Promise<void> {
+  if (viteStarting) return viteStarting;
+
+  viteStarting = (async () => {
+    const viteBin = path.join(templateDir, "node_modules", "vite", "bin", "vite.js");
+    if (!existsSync(viteBin)) {
+      throw new Error(
+        `preview: template deps missing — run \`npm install\` in ${templateDir} (node_modules/vite not found)`,
+      );
+    }
+    const child = spawn(process.execPath, [viteBin], {
+      cwd: templateDir,
+      detached: true,
+      stdio: "ignore",
+      windowsHide: true,
+    });
+    child.unref();
+    await waitForPort(PREVIEW_PORT, 30_000);
+  })();
+
+  // If startup fails, allow a later call to retry instead of caching the rejection.
+  viteStarting.catch(() => {
+    viteStarting = null;
+  });
+
+  return viteStarting;
+}
+
+/**
+ * Write the agent's React component into the template and ensure Vite is live.
+ * Returns the dev-server URL the chat embeds in an iframe. Vite HMR makes
+ * subsequent writes update the open preview in place.
+ */
+export async function startReactPreview(componentTsx: string): Promise<{ url: string }> {
+  const templateDir = resolveTemplateDir();
+  await writeFile(path.join(templateDir, "src", "generated.tsx"), componentTsx, "utf8");
+  await ensureVite(templateDir);
+  return { url: `http://localhost:${PREVIEW_PORT}` };
+}
+
+/**
+ * Type-check the template (incl. the just-written generated.tsx) so the
+ * preview_app self-heal loop can feed real compile errors back to the builder
+ * (foreman-8nyg). The 57 ui components are known-good, so any error is in the
+ * generated component or its usage of the registry. Fails OPEN (treats as ok) if
+ * the toolchain isn't reachable — we never want the check itself to block a
+ * preview. Incremental buildinfo lives under node_modules/.cache (gitignored),
+ * so repeat checks are fast.
+ */
+export async function typecheckPreview(): Promise<{ ok: boolean; errors?: string }> {
+  const templateDir = resolveTemplateDir();
+  const tscBin = path.join(templateDir, "node_modules", "typescript", "bin", "tsc");
+  if (!existsSync(tscBin)) return { ok: true };
+
+  return new Promise((resolve) => {
+    const child = spawn(
+      process.execPath,
+      [
+        tscBin,
+        "--noEmit",
+        "--incremental",
+        "--tsBuildInfoFile",
+        path.join("node_modules", ".cache", "preview.tsbuildinfo"),
+      ],
+      { cwd: templateDir, windowsHide: true },
+    );
+    let out = "";
+    child.stdout?.on("data", (d) => {
+      out += d.toString();
+    });
+    child.stderr?.on("data", (d) => {
+      out += d.toString();
+    });
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve({ ok: true });
+      } else {
+        // Prefer errors in the generated component; fall back to all output.
+        const lines = out.split(/\r?\n/);
+        const relevant = lines.filter((l) => l.includes("generated.tsx"));
+        resolve({
+          ok: false,
+          errors: (relevant.length ? relevant : lines).join("\n").slice(0, 2000),
+        });
+      }
+    });
+    child.on("error", () => resolve({ ok: true }));
+  });
+}
diff --git a/packages/agents/src/lib/prompt-template.ts b/packages/agents/src/lib/prompt-template.ts
index 54a585d8..2d469189 100644
--- a/packages/agents/src/lib/prompt-template.ts
+++ b/packages/agents/src/lib/prompt-template.ts
@@ -17,9 +17,9 @@
  */
 
 const BASE_PROMPT = `<role>
-You are Foreman, an AI assistant that executes actions across 9,000+ apps via Zapier.
+You are Foreman, an AI assistant that executes actions across 10,000+ apps via Zapier.
 Your job is to translate natural-language requests into tool calls — sending messages,
-updating records, creating data — and to save reusable patterns as workflows.
+updating records, creating data — and carry them out.
 </role>
 
 <tools>
@@ -38,8 +38,8 @@ updating records, creating data — and to save reusable patterns as workflows.
 <app_actions description="Use run-action to execute things in third-party apps">
 - \`list-actions\` — list available actions for an app
 - \`get-action\` — describe one action
-- \`get-input-fields-schema\` — fetch the input schema (always run this before run-action)
-- \`list-input-field-choices\` — fetch valid values for dropdown/enum fields
+- \`get-action-input-fields-schema\` — fetch the input schema (always run this before run-action)
+- \`list-action-input-field-choices\` — fetch valid values for dropdown/enum fields
 - \`run-action\` — execute an app action (requires approval for writes)
 </app_actions>
 
@@ -55,6 +55,24 @@ updating records, creating data — and to save reusable patterns as workflows.
 - \`fork_conversation\` — clone the current thread
 </foreman_specific>
 
+<knowledge_documents description="The user's saved notes, plans, specs — the shared brain">
+- \`save_document\` — write a markdown note/plan/summary/brief/spec to the workspace. Use when the user asks you to write up, save, or keep something, or to capture shared context. Reusing the same title updates that document (a new version is kept automatically). Documents go to the SHARED team space by default (every workspace member sees them); pass \`space: "personal"\` for a private note only this user should see (when they say "just for me", "private", "personal note", etc.).
+- \`mastra_workspace_search\` — semantic search over the user's saved documents by meaning (not just exact keywords). Documents live under \`documents/\`.
+- \`mastra_workspace_read_file\` — read a document's full contents once search has found it (e.g. \`documents/q3-plan.md\`).
+
+When a question is about the user's own saved knowledge ("what did we decide…", "per my plan…", "summarize my notes on…", or anything that sounds like it lives in their docs), \`mastra_workspace_search\` first, read the most relevant doc, then answer from it.
+
+<citations description="Cite the documents you used so the user can open them">
+When your answer draws on a saved knowledge document, cite it inline with a normal markdown link using the \`doc:\` scheme — the link text is the supported claim, the URL is the document path, and the title attribute is the document's title:
+
+\`The launch is gated on the security review [per the Q3 plan](doc:documents/q3-plan.md "Q3 Launch Plan").\`
+
+- Only cite \`documents/…\` paths you actually read this turn — never invent one.
+- Cite the specific claim, not the whole sentence; one citation per distinct source is enough.
+- This renders as a clickable citation that opens the document. Do not also paste the raw path.
+</citations>
+</knowledge_documents>
+
 </core_tools>
 
 <additional_tools description="Behind search_tools + load_tool — for the long tail">
@@ -93,10 +111,10 @@ Find the right action key. The SDK rejects guessed keys, so always pull from lis
 <phase name="3-schema-discovery" description="Two passes required when writing rows/records">
 Dynamic per-column fields only appear AFTER you've resolved the parent selectors (spreadsheet, base, table). That's why two passes:
 
-1. **First pass — selectors only.** \`get-input-fields-schema\` with no \`inputs\`. Returns selectors (spreadsheet, worksheet, base, table, object_type) but not dynamic column fields.
-2. **Resolve each selector.** For each dropdown, \`list-input-field-choices\` to get a real value. Don't guess IDs — Zapier IDs are opaque and rejecting guessed values is the usual SDK failure mode.
-3. **Second pass — full schema.** \`get-input-fields-schema\` again, passing the resolved selectors as \`inputs\`. This unlocks dynamic column/custom fields (\`COL$A\` on Sheets, per-column keys on Airtable, custom-property keys on HubSpot). Use only the keys returned here — first-pass keys are incomplete for column/record actions.
-4. **Resolve remaining enums.** For any still-enumerated fields, \`list-input-field-choices\` (pass current \`inputs\` so dependent lists narrow correctly).
+1. **First pass — selectors only.** \`get-action-input-fields-schema\` with no \`inputs\`. Returns selectors (spreadsheet, worksheet, base, table, object_type) but not dynamic column fields.
+2. **Resolve each selector.** For each dropdown, \`list-action-input-field-choices\` to get a real value. Don't guess IDs — Zapier IDs are opaque and rejecting guessed values is the usual SDK failure mode.
+3. **Second pass — full schema.** \`get-action-input-fields-schema\` again, passing the resolved selectors as \`inputs\`. This unlocks dynamic column/custom fields (\`COL$A\` on Sheets, per-column keys on Airtable, custom-property keys on HubSpot). Use only the keys returned here — first-pass keys are incomplete for column/record actions.
+4. **Resolve remaining enums.** For any still-enumerated fields, \`list-action-input-field-choices\` (pass current \`inputs\` so dependent lists narrow correctly).
 
 **Empty-schema escape hatch.** If the second-pass schema returns no writable fields for a write action (e.g., a Google Sheet with no header row, an Airtable base with no columns), do not proceed to confirmation. Tell the user the destination has no columns yet and ask what fields the action should set. Otherwise the run-action will fail at execution.
 </phase>
@@ -122,27 +140,7 @@ Once confirmed, call \`run-action\` with the exact fields and connection ID.
 </phase>
 
 <phase name="5-close-loop">
-End your turn with a clear status message.
-
-For chains or shapes the user might want to repeat (multi-step flows, parameterized actions, anything that involved gathering inputs), offer to save:
-
-> Want me to save this as a workflow? You can re-run it any time, or have it fire on a schedule or when you DM a command.
-
-If they say yes, call \`save_workflow({ name: "<short name>" })\`. The tool captures every action that already executed in this conversation, in order, and parameterizes obvious values (emails, IDs, phone numbers) automatically. Only call it AFTER actions have actually run; if nothing has executed yet, tell the user to run it first.
-
-If during the request the user mentions a recurring shape ("every Monday at 9", "whenever someone DMs !standup", "daily report"), don't wait for them to ask — chain \`save_workflow\` immediately followed by \`attach_trigger\` once you've confirmed the schedule or match condition.
-
-To list a user's existing workflows use \`list_workflows()\`. To inspect or pull up a specific one before re-running or editing, call \`get_workflow({ workflowId })\` — get the id from \`list_workflows\` first.
-
-To re-run a saved workflow on demand, call \`run_workflow({ workflowId, inputs? })\`. Pass \`inputs\` for whichever parameters \`get_workflow\` shows (e.g. \`{ recipient_email: "a@b.com" }\`). The tool returns a summary; if it returns \`status: "param_request"\` with a \`missingParams\` list, ask the user for those values and call again. \`run_workflow\` requires user approval — Mastra prompts the user before it actually fires.
-
-To rename a workflow or publish it as a public template, call \`update_workflow({ workflowId, name?, isTemplate? })\`. Pass at least one of \`name\` or \`isTemplate\`. Step content cannot be edited from the agent — to change actions, run them again and save under a new name.
-
-To irreversibly delete a workflow (and all of its run history), call \`delete_workflow({ workflowId })\`. This is destructive and requires user approval. Always confirm the right id with \`list_workflows\` first if there is any ambiguity.
-
-To make a workflow fire automatically — on a schedule or when a chat message arrives — call \`attach_trigger({ workflowId, type, cron|channel })\`. Use \`type: "cron"\` with \`cron: { schedule: "<5-field cron>", timezone? }\` for time-based runs (e.g. \`"0 9 * * 1-5"\` for weekdays at 9am). Use \`type: "channel"\` with \`channel: { channel, match: { command?, from?, room? } }\` for chat-triggered runs (e.g. when the user DMs \`!standup\` on Slack). Confirm the schedule or match condition with the user before calling — \`attach_trigger\` requires approval. To see what's bound to a workflow, call \`list_workflow_triggers({ workflowId })\`. To remove one, \`detach_trigger({ workflowId, triggerId })\`.
-
-Skip the save offer for trivial one-shot requests (a single ad-hoc Slack message, a one-off lookup).
+End your turn with a clear status message — a one-line confirmation when everything ran, or a summary of what's done and what's left when a multi-step task only partially succeeded.
 </phase>
 
 </action_flow>
@@ -159,20 +157,24 @@ If \`list-actions\` has no match for what the user wants (raw cell values, custo
 </fetch_escape_hatch>
 
 <critical_invariants description="These prevent broken behavior — follow every time, no exceptions">
-1. Always run \`get-input-fields-schema\` before every \`run-action\`. Field names vary per app and the SDK rejects incorrect keys.
+1. Always run \`get-action-input-fields-schema\` before every \`run-action\`. Field names vary per app and the SDK rejects incorrect keys.
 2. Always do the two-pass schema fetch for write actions on rows/records. The real column keys aren't returned in the first pass.
 3. Always pass the connection ID to \`run-action\`. Without it the SDK doesn't know which authenticated account to use.
-4. Always get field choices for dropdown/enum fields via \`list-input-field-choices\`. Pass current \`inputs\` so dependent lists narrow correctly.
+4. Always get field choices for dropdown/enum fields via \`list-action-input-field-choices\`. Pass current \`inputs\` so dependent lists narrow correctly.
 5. App keys are always slugs (\`google-sheets\`, \`slack\`, \`hubspot\`) — never long implementation names (\`GoogleSheetsV2CLIAPI\`). Slugs are stable across SDK versions.
 6. If the SDK returns "action not found", call \`list-actions\` to find the real action key. Don't conclude the app lacks the capability — you almost certainly used a wrong key.
 </critical_invariants>
 
 <do_not_redirect>
-NEVER tell the user to "go to zapier.com", "set this up in Zapier", "create a Zap", or otherwise hand the task off to the Zapier web UI. You are Foreman — you own automation in this product. The web UI is not part of the user's experience.
+NEVER tell the user to "go to zapier.com", "set this up in Zapier", "create a Zap", or otherwise hand the task off to the Zapier web UI. You are Foreman — you own automation in this product. The web UI is not part of the user's experience. The only legitimate Zapier-website link you may share is the OAuth connect URL returned by \`connect_zapier\` — that is a credential handoff, not a task handoff.
 
-For multi-step or repeating requests, the answer is always: \`save_workflow\` (capture the shape) and, if it should fire on its own, \`attach_trigger\` (cron for schedules, channel for chat-message matches). The only legitimate Zapier-website link you may share is the OAuth connect URL returned by \`connect_zapier\` — that is a credential handoff, not a task handoff.
+For multi-step requests, just do the work now — run each action in order in this conversation.
 
-If you find yourself about to type "you can set this up in Zapier" — stop. Either you have enough to call \`save_workflow\` + \`attach_trigger\` now, or you need one specific clarification ("what schedule?" "which channel?") before doing so.
+Recurring and event-triggered automation IS available — build it with \`create_automation\`, never by handing off to Zapier:
+- Event-driven ("whenever someone opens a GitHub issue"): pass a \`trigger\` (app + action). The background worker leases the inbox and fires it.
+- Scheduled ("every morning at 9", "every 15 minutes", "Mondays at 8"): pass a \`schedule\` with a cron expression — \`{cron:"0 9 * * *"}\`, \`{cron:"*/15 * * * *"}\`, \`{cron:"0 8 * * 1"}\`. Add \`timezone\` (IANA, e.g. "America/New_York") if the user names one; otherwise it's UTC. Mastra's scheduler fires it.
+- Daily digest ("summarize my automations each morning"): pass \`schedule\` (a cron) + \`digest:true\` and omit \`source\`. Foreman synthesizes a prioritized summary of recent activity into the Inbox — no durable needed.
+Don't claim you've scheduled something unless \`create_automation\` returned an id.
 </do_not_redirect>
 
 <no_exploration_loops>
@@ -228,9 +230,9 @@ User: "Send 'standup in 5' to #engineering on Slack"
 Foreman trace:
 1. \`find-unique-connection({app: "slack"})\` → connection 12345 (account: "@hamish")
 2. \`list-actions({app: "slack", actionType: "write"})\` → finds action with key \`send_channel_message\`
-3. \`get-input-fields-schema({app, action})\` (first pass) → returns selector "channel"
-4. \`list-input-field-choices({app, action, field: "channel"})\` → finds #engineering with ID "C0123"
-5. \`get-input-fields-schema({app, action, inputs: {channel: "C0123"}})\` (second pass) → returns "text" field
+3. \`get-action-input-fields-schema({app, action})\` (first pass) → returns selector "channel"
+4. \`list-action-input-field-choices({app, action, field: "channel"})\` → finds #engineering with ID "C0123"
+5. \`get-action-input-fields-schema({app, action, inputs: {channel: "C0123"}})\` (second pass) → returns "text" field
 6. Reply to user:
    > I'll run **Send Channel Message** on **Slack** using the **@hamish** connection with:
    > - Channel: #engineering
@@ -242,17 +244,6 @@ Foreman trace:
 9. Reply: "Sent. Anything else?"
 </example>
 
-<example name="ambiguous-trigger">
-User: "Use Zapier to emoji react to Slack messages"
-
-The request is ambiguous — react to a specific message now, or set up something that reacts automatically when certain messages appear?
-
-Foreman replies (no tools called yet):
-> Quick question — do you want me to react to a specific message now, or save this as a workflow that reacts automatically (on a schedule, or when certain messages come in)?
-
-After the user clarifies, proceed with the appropriate flow. NEVER answer "you can set that up at zapier.com" — if they want the recurring shape, the answer is \`save_workflow\` + \`attach_trigger\`.
-</example>
-
 <example name="app-not-connected">
 User: "Add a contact named John Doe (john@example.com) to my HubSpot"
 
@@ -275,32 +266,7 @@ Foreman trace (per triage rule 3, both apps in one request):
 4. Run schema discovery for Slack send_channel_message AND Sheets add_row in parallel (no shared dependencies)
 5. Confirm both writes in ONE confirmation message
 6. Execute both run-action calls in parallel
-7. Reply with combined status. Offer to save as a workflow (this is a re-runnable shape).
-</example>
-
-<example name="scheduled-workflow">
-User: "Every weekday at 9am, post 'Standup in 5' to #engineering on Slack"
-
-Foreman trace:
-1. Recognize this is a recurring shape — execute once now, then save + schedule.
-2. Run the action once (find connection, schema, confirm, run-action) so we have something to save. Confirmation is for the immediate run.
-3. After the run succeeds, call \`save_workflow({ name: "Daily standup ping" })\`.
-4. Confirm the schedule with the user before binding:
-   > Saved as 'Daily standup ping'. To fire weekdays at 9am Pacific, I'd attach a cron trigger \`0 9 * * 1-5\` in America/Los_Angeles. Confirm?
-5. On "yes", call \`attach_trigger({ workflowId, type: "cron", cron: { schedule: "0 9 * * 1-5", timezone: "America/Los_Angeles" } })\`.
-6. Reply: "Done — it'll fire on weekdays at 9am LA time. Use \`list_workflow_triggers\` if you ever want to disable it."
-</example>
-
-<example name="channel-triggered-workflow">
-User: "When I DM the bot '!standup' on Slack, post the standup template to #engineering"
-
-Foreman trace:
-1. Run the post-to-#engineering action once now so the shape is captured (confirm + run-action).
-2. \`save_workflow({ name: "Standup on demand" })\`.
-3. Confirm the binding:
-   > Saved. I'll bind it to the Slack DM command \`!standup\` so any time you DM that to the bot, the post fires. Confirm?
-4. On "yes", call \`attach_trigger({ workflowId, type: "channel", channel: { channel: "slack", match: { command: "!standup" } } })\`.
-5. Reply: "Bound. DM me '!standup' on Slack any time."
+7. Reply with combined status.
 </example>
 
 </examples>
diff --git a/packages/agents/src/lib/proposals.ts b/packages/agents/src/lib/proposals.ts
index cb92e5d5..6eb8295c 100644
--- a/packages/agents/src/lib/proposals.ts
+++ b/packages/agents/src/lib/proposals.ts
@@ -1,4 +1,4 @@
-import { getSupabase } from "@/lib/db";
+import { getSupabase } from "./db";
 
 export async function loadOwnedProposal(proposalId: string, userId: string) {
   const supabase = getSupabase();
diff --git a/packages/agents/src/lib/providers/caching.ts b/packages/agents/src/lib/providers/caching.ts
index e1c24f6e..cf93725e 100644
--- a/packages/agents/src/lib/providers/caching.ts
+++ b/packages/agents/src/lib/providers/caching.ts
@@ -37,6 +37,7 @@ export const AGENT_PROMPT_CACHING: Record<AgentName, boolean> = {
   execution: parseBoolEnv(process.env.EXECUTION_PROMPT_CACHING),
   supervisor: parseBoolEnv(process.env.SUPERVISOR_PROMPT_CACHING),
   history: parseBoolEnv(process.env.HISTORY_PROMPT_CACHING),
+  digest: parseBoolEnv(process.env.DIGEST_PROMPT_CACHING),
 };
 
 export const AGENT_TOOL_CACHING: Record<AgentName, boolean> = {
@@ -45,6 +46,7 @@ export const AGENT_TOOL_CACHING: Record<AgentName, boolean> = {
   execution: parseBoolEnv(process.env.EXECUTION_TOOL_CACHING),
   supervisor: parseBoolEnv(process.env.SUPERVISOR_TOOL_CACHING),
   history: parseBoolEnv(process.env.HISTORY_TOOL_CACHING),
+  digest: parseBoolEnv(process.env.DIGEST_TOOL_CACHING),
 };
 
 /** True when the agent opted into either caching mode. */
diff --git a/packages/agents/src/lib/providers/capabilities.ts b/packages/agents/src/lib/providers/capabilities.ts
index 56fd2c16..531adb2b 100644
--- a/packages/agents/src/lib/providers/capabilities.ts
+++ b/packages/agents/src/lib/providers/capabilities.ts
@@ -52,6 +52,8 @@ const CORE_REQUIREMENTS: Record<AgentName, Capability[]> = {
   execution: ["tools", "streaming"],
   supervisor: ["tools"],
   history: ["tools"],
+  // The digest narrator is a one-shot text generation — no tools, no streaming.
+  digest: [],
 };
 
 /**
diff --git a/packages/agents/src/lib/providers/cost.ts b/packages/agents/src/lib/providers/cost.ts
index c8167302..993141e6 100644
--- a/packages/agents/src/lib/providers/cost.ts
+++ b/packages/agents/src/lib/providers/cost.ts
@@ -144,8 +144,26 @@ function getCostCounter() {
  * and records the OpenTelemetry counter when OTEL_ENABLED=true.
  */
 export function onFinishCostLogger(agent: AgentName) {
-  return (event: { totalUsage?: UsageTokens }): void => {
-    const model = primary(AGENT_MODELS[agent]);
+  return (event: {
+    totalUsage?: UsageTokens;
+    response?: { modelId?: string };
+    modelId?: string;
+    model?: string | { modelId?: string };
+  }): void => {
+    // Prefer the model that ACTUALLY ran this call (per-request override from
+    // the composer's model selector) over the agent's static default. AI SDK v6
+    // exposes it on the finish event's response metadata. The router gives Mastra
+    // a bare provider model id (e.g. "claude-haiku-4-5-20251001"), so re-attach
+    // the "anthropic/" prefix to match the MODEL_PRICING keys.
+    const rawModel =
+      event?.response?.modelId ??
+      event?.modelId ??
+      (typeof event?.model === "string" ? event.model : event?.model?.modelId);
+    const model = rawModel
+      ? rawModel.includes("/")
+        ? rawModel
+        : `anthropic/${rawModel}`
+      : primary(AGENT_MODELS[agent]);
     const usage = event?.totalUsage ?? { inputTokens: 0, outputTokens: 0 };
     const breakdown = calculateCost(model, usage);
 
diff --git a/packages/agents/src/lib/providers/models.ts b/packages/agents/src/lib/providers/models.ts
index ecde72f5..f500155c 100644
--- a/packages/agents/src/lib/providers/models.ts
+++ b/packages/agents/src/lib/providers/models.ts
@@ -56,6 +56,8 @@ export const AGENT_MODELS = {
   execution: chain(process.env.EXECUTION_MODEL, MODELS.default),
   supervisor: chain(process.env.SUPERVISOR_MODEL, MODELS.default),
   history: chain(process.env.HISTORY_MODEL, MODELS.fast),
+  // Narrates the daily digest (foreman-bhb5) — a small model is plenty.
+  digest: chain(process.env.DIGEST_MODEL, MODELS.fast),
 } as const;
 
 export type AgentName = keyof typeof AGENT_MODELS;
diff --git a/packages/agents/src/lib/providers/params.ts b/packages/agents/src/lib/providers/params.ts
index cf48b02d..97cf9301 100644
--- a/packages/agents/src/lib/providers/params.ts
+++ b/packages/agents/src/lib/providers/params.ts
@@ -43,6 +43,7 @@ export const AGENT_PARAMS: Record<AgentName, AgentParams> = {
   execution: readParams("EXECUTION"),
   supervisor: readParams("SUPERVISOR"),
   history: readParams("HISTORY"),
+  digest: readParams("DIGEST"),
 };
 
 /**
diff --git a/packages/agents/src/lib/rag/index.ts b/packages/agents/src/lib/rag/index.ts
index a754ccd3..5b69bf67 100644
--- a/packages/agents/src/lib/rag/index.ts
+++ b/packages/agents/src/lib/rag/index.ts
@@ -1,12 +1,13 @@
-import { ModelRouterEmbeddingModel } from "@mastra/core/llm";
+import { fastembed } from "@mastra/fastembed";
 import { PgVector } from "@mastra/pg";
 import { MDocument } from "@mastra/rag";
 import { embedMany } from "ai";
-import { getEnv } from "@/lib/env";
+import { getEnv } from "../env";
 
 const INDEX_NAME = "action_history";
-const EMBEDDING_MODEL = "openai/text-embedding-3-small";
-const EMBEDDING_DIMENSION = 1536;
+// Local ONNX embedder (bge-small, 384-dim) — no OpenAI key/quota needed,
+// matching the agent-memory embedder so local dev is fully self-contained.
+const EMBEDDING_DIMENSION = 384;
 
 let _vector: PgVector | undefined;
 
@@ -21,18 +22,29 @@ function getVector(): PgVector {
 }
 
 function getEmbedder() {
-  return new ModelRouterEmbeddingModel(EMBEDDING_MODEL);
+  return fastembed;
 }
 
 export async function ensureIndex(): Promise<void> {
   const vector = getVector();
   const indexes = await vector.listIndexes();
-  if (!indexes.includes(INDEX_NAME)) {
-    await vector.createIndex({
-      indexName: INDEX_NAME,
-      dimension: EMBEDDING_DIMENSION,
-    });
+  if (indexes.includes(INDEX_NAME)) {
+    // Dimension guard (foreman-hcim): an index built before the 1536->384
+    // embedder switch silently rejects 384-d upserts. If an existing index is
+    // at the wrong dimension, drop it so it recreates at EMBEDDING_DIMENSION;
+    // action_history re-indexes as new runs are recorded. If the dimension is
+    // correct (or can't be read) leave it untouched.
+    const stats = await vector.describeIndex({ indexName: INDEX_NAME }).catch(() => undefined);
+    if (!stats || stats.dimension === EMBEDDING_DIMENSION) return;
+    console.warn(
+      `[rag] ${INDEX_NAME} index is ${stats.dimension}-d but embedder is ${EMBEDDING_DIMENSION}-d — dropping & recreating (history re-indexes over time).`,
+    );
+    await vector.deleteIndex({ indexName: INDEX_NAME });
   }
+  await vector.createIndex({
+    indexName: INDEX_NAME,
+    dimension: EMBEDDING_DIMENSION,
+  });
 }
 
 /**
diff --git a/packages/agents/src/lib/scorers/foreman-llm-judge.ts b/packages/agents/src/lib/scorers/foreman-llm-judge.ts
index 491ba85b..35242281 100644
--- a/packages/agents/src/lib/scorers/foreman-llm-judge.ts
+++ b/packages/agents/src/lib/scorers/foreman-llm-judge.ts
@@ -78,7 +78,7 @@ function extractActualToolNames(output: unknown): string[] {
 }
 
 const JUDGE_INSTRUCTIONS = `You are a quality judge for the Foreman AI agent — an automation assistant
-that executes actions across 9,000+ apps via Zapier.
+that executes actions across 10,000+ apps via Zapier.
 
 You will be given:
   1. The user's request
diff --git a/packages/agents/src/lib/tool-catalog.ts b/packages/agents/src/lib/tool-catalog.ts
index 84987548..705be726 100644
--- a/packages/agents/src/lib/tool-catalog.ts
+++ b/packages/agents/src/lib/tool-catalog.ts
@@ -21,8 +21,8 @@ const READ_ONLY_IDS = new Set([
   "find-first-connection",
   "find-unique-connection",
   "get-connection",
-  "get-input-fields-schema",
-  "list-input-field-choices",
+  "get-action-input-fields-schema",
+  "list-action-input-field-choices",
   "list-tables",
   "get-table",
   "list-table-fields",
diff --git a/packages/agents/src/lib/tool-schema-sanitizer.ts b/packages/agents/src/lib/tool-schema-sanitizer.ts
new file mode 100644
index 00000000..4bcf2102
--- /dev/null
+++ b/packages/agents/src/lib/tool-schema-sanitizer.ts
@@ -0,0 +1,228 @@
+import { jsonSchema } from "ai";
+import { z } from "zod";
+
+/**
+ * Makes Foreman's tool input schemas valid for Anthropic's tool-use API
+ * (via AI SDK v6), which rejects two JSON-Schema object shapes:
+ *
+ *   - object-valued additionalProperties → "additionalProperties: object is not
+ *     supported. Please set 'additionalProperties' to false"
+ *   - omitted additionalProperties      → "additionalProperties must be
+ *     explicitly set to false"
+ *
+ * In other words: EVERY `type:"object"` node in a tool's input schema must have
+ * `additionalProperties: false`. That is trivially satisfiable for fixed-shape
+ * objects — but several Foreman tools have genuinely DYNAMIC inputs typed as
+ * open maps (`z.record`): run-action(inputs), get-action-input-fields-schema(inputs),
+ * list-action-input-field-choices(inputs), create/update-table-records(records[].data),
+ * create-table-fields(fields[].options/config). The model MUST be free to put arbitrary per-app
+ * keys there, so `additionalProperties:false` (which forbids all keys) would
+ * break them — yet Anthropic accepts no open-object form at all.
+ *
+ * The resolution: represent each open map to the MODEL as a JSON **string**
+ * (`{type:"string"}` — no object node, no conflict) and transparently
+ * `JSON.parse` it back into an object before the tool's original `execute`
+ * runs. The tool handler — and the Zapier SDK it forwards to — sees the exact
+ * same object it always did; only the model-facing schema changed.
+ *
+ * This is a single chokepoint applied to the assembled foreman tool map (custom
+ * tools + generated SDK tools), so no individual tool or the SDK-tool generator
+ * needs to know about it. The revive step is a no-op on non-string values, so
+ * it is idempotent and harmless to any other consumer that shares the same
+ * (cached) tool object and still passes objects.
+ *
+ * NOTE: schema acceptance and the parse round-trip are fully verifiable without
+ * a live Zapier connection (see tests/unit/tool-schema-sanitizer.test.ts). A
+ * true end-to-end run-action against a real connection remains the deploy-time
+ * confidence step — it is NOT exercised by the local mocked stack.
+ */
+
+/** A runtime path to a field that was rewritten to a JSON string. `"[]"` means
+ *  "descend into each element of this array". e.g. ["records","[]","data"]. */
+type RevivePath = string[];
+
+const STRING_HINT = 'Pass as a JSON object encoded as a string, e.g. \'{"key":"value"}\'.';
+
+/** Marks tools already processed so a second sanitize pass can't double-wrap. */
+const sanitizedTools = new WeakSet<object>();
+
+function isOpenMapNode(node: Record<string, unknown>): boolean {
+  if (node.type !== "object") return false;
+  const props = node.properties;
+  const hasProps = !!props && typeof props === "object" && Object.keys(props as object).length > 0;
+  const ap = node.additionalProperties;
+  const apIsOpen = ap === true || (!!ap && typeof ap === "object");
+  return !hasProps && apIsOpen;
+}
+
+/**
+ * Walk a JSON schema in place: rewrite open-map object nodes to JSON strings and
+ * force `additionalProperties:false` on every remaining object. Returns the
+ * runtime paths of the rewritten string fields (for the execute-time revive).
+ *
+ * `path` is null inside combinators / $defs — those branches are still made
+ * schema-valid, but a dynamic map nested there can't be reliably revived by
+ * runtime path, so we don't record one (it would surface as a parse error in
+ * tests rather than silently mis-executing).
+ */
+function transformSchema(root: Record<string, unknown>): RevivePath[] {
+  const revivePaths: RevivePath[] = [];
+
+  function walk(node: unknown, path: string[] | null): void {
+    if (!node || typeof node !== "object") return;
+    if (Array.isArray(node)) {
+      for (const item of node) walk(item, path);
+      return;
+    }
+    const obj = node as Record<string, unknown>;
+
+    if (obj.type === "object") {
+      if (isOpenMapNode(obj)) {
+        const desc = typeof obj.description === "string" ? obj.description : "";
+        for (const key of Object.keys(obj)) delete obj[key];
+        obj.type = "string";
+        obj.description = desc ? `${desc} ${STRING_HINT}` : STRING_HINT;
+        if (path) revivePaths.push(path);
+        return;
+      }
+      // Fixed-shape object — close it and recurse into its declared properties.
+      obj.additionalProperties = false;
+      const props = obj.properties;
+      if (props && typeof props === "object") {
+        for (const key of Object.keys(props as object)) {
+          walk((props as Record<string, unknown>)[key], path ? [...path, key] : null);
+        }
+      }
+    }
+
+    if (obj.type === "array") {
+      if (Array.isArray(obj.items)) {
+        // Draft-07 tuple form — positional, not simply path-addressable.
+        for (const item of obj.items) walk(item, null);
+      } else if (obj.items) {
+        walk(obj.items, path ? [...path, "[]"] : null);
+      }
+      // Draft-2020-12 tuple form.
+      if (Array.isArray(obj.prefixItems)) {
+        for (const item of obj.prefixItems) walk(item, null);
+      }
+    }
+
+    // Combinators and $defs: recurse for schema validity, but these branches are
+    // not addressable by a simple runtime path, so don't record revive paths.
+    for (const comb of ["anyOf", "allOf", "oneOf"] as const) {
+      const branches = obj[comb];
+      if (Array.isArray(branches)) for (const b of branches) walk(b, null);
+    }
+    if (obj.$defs && typeof obj.$defs === "object") {
+      for (const key of Object.keys(obj.$defs as object)) {
+        walk((obj.$defs as Record<string, unknown>)[key], null);
+      }
+    }
+  }
+
+  walk(root, []);
+  return revivePaths;
+}
+
+/** Parse string values back into objects at the recorded revive paths. */
+function reviveAtPath(node: unknown, path: RevivePath, i: number): void {
+  if (node === null || typeof node !== "object") return;
+  const seg = path[i];
+
+  if (seg === "[]") {
+    if (Array.isArray(node)) {
+      for (const el of node) reviveAtPath(el, path, i + 1);
+    }
+    return;
+  }
+
+  const obj = node as Record<string, unknown>;
+  if (i === path.length - 1) {
+    const value = obj[seg];
+    if (typeof value !== "string") return;
+    const trimmed = value.trim();
+    if (trimmed === "") {
+      delete obj[seg];
+      return;
+    }
+    try {
+      obj[seg] = JSON.parse(trimmed);
+    } catch (err) {
+      throw new Error(
+        `Tool input field "${seg}" must be a valid JSON object string: ${
+          err instanceof Error ? err.message : String(err)
+        }`,
+      );
+    }
+    return;
+  }
+  reviveAtPath(obj[seg], path, i + 1);
+}
+
+export function reviveDynamicInputs(input: unknown, paths: RevivePath[]): void {
+  for (const path of paths) reviveAtPath(input, path, 0);
+}
+
+function toJsonSchema(schema: unknown): Record<string, unknown> | null {
+  if (!schema || typeof schema !== "object") return null;
+  const s = schema as Record<string, unknown>;
+  // Already an AI SDK Schema (from jsonSchema()) — has a `.jsonSchema` property.
+  if (s.jsonSchema && typeof s.jsonSchema === "object") {
+    return structuredClone(s.jsonSchema) as Record<string, unknown>;
+  }
+  // Zod v4 schema — native JSON Schema export.
+  try {
+    return z.toJSONSchema(schema as Parameters<typeof z.toJSONSchema>[0]) as Record<
+      string,
+      unknown
+    >;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Rewrite each tool's input schema to be Anthropic-valid and wrap its `execute`
+ * to revive JSON-string fields back into objects. Mutates the tools in place
+ * (and returns the same map). Tools whose schema can't be resolved are left
+ * untouched. Idempotent: a tool is processed at most once.
+ */
+export function sanitizeToolSchemas<T extends Record<string, unknown>>(tools: T): T {
+  for (const tool of Object.values(tools)) {
+    if (!tool || typeof tool !== "object") continue;
+    if (sanitizedTools.has(tool)) continue;
+
+    const t = tool as {
+      inputSchema?: unknown;
+      execute?: (...args: unknown[]) => unknown;
+      strict?: boolean;
+    };
+
+    const js = toJsonSchema(t.inputSchema);
+    if (!js) {
+      sanitizedTools.add(tool);
+      continue;
+    }
+
+    const revivePaths = transformSchema(js);
+    t.inputSchema = jsonSchema(js);
+    // We hand-close the schema (additionalProperties:false everywhere); a
+    // non-strict tool with an explicit closed schema is exactly what Anthropic
+    // wants, and it avoids the strict-grammar limits Anthropic enforces.
+    t.strict = false;
+
+    if (revivePaths.length > 0 && typeof t.execute === "function") {
+      const original = t.execute;
+      // Async wrapper so a revive failure (malformed JSON from the model)
+      // surfaces as a rejected promise, the same way Mastra awaits execute.
+      t.execute = async (input: unknown, ...rest: unknown[]) => {
+        reviveDynamicInputs(input, revivePaths);
+        return (original as (...a: unknown[]) => unknown).call(tool, input, ...rest);
+      };
+    }
+
+    sanitizedTools.add(tool);
+  }
+  return tools;
+}
diff --git a/packages/agents/src/lib/trigger-inbox/index.ts b/packages/agents/src/lib/trigger-inbox/index.ts
new file mode 100644
index 00000000..b28bb185
--- /dev/null
+++ b/packages/agents/src/lib/trigger-inbox/index.ts
@@ -0,0 +1,157 @@
+import type { ExperimentalZapierSdk } from "../zapier/sdk";
+
+/**
+ * Trigger-inbox layer (foreman-l7xq) — the chosen trigger substrate. A trigger
+ * inbox is a server-side durable queue Zapier maintains for an app+action+
+ * connection: `ensureInbox` once, then `lease` a batch, process, and `ack`
+ * (done) / `release` (retry). At-least-once delivery, so the queue can redeliver;
+ * `dispatchLeased` dedups on the message id.
+ *
+ * Every function takes the SDK client as a parameter so the layer is testable
+ * with a fake; production passes `getExperimentalSdkForUser(userId)`. The lease
+ * loop that drives this (worker, run dispatch, idempotency store) is M3.
+ */
+
+type Sdk = ExperimentalZapierSdk;
+
+export interface InboxMessageAttributes {
+  /** Times this message has been leased; >1 ⇒ a prior lease expired/released ⇒ a redelivery. */
+  lease_count: number;
+  error_message: string | null;
+  /** Zapier's own flag that the underlying event may be a duplicate. */
+  possible_duplicate_data: boolean;
+}
+
+export interface LeasedMessage {
+  id: string;
+  created_at: string;
+  status: string;
+  message_attributes: InboxMessageAttributes;
+  payload: Record<string, unknown>;
+}
+
+export interface Lease {
+  lease_id: string | null;
+  leased_until: string | null;
+  results: LeasedMessage[];
+  inbox_attributes: { status: string; paused_reason: string | null };
+}
+
+export async function ensureInbox(opts: {
+  sdk: Sdk;
+  /** Idempotency key — `ensureTriggerInbox` is keyed on `key`; same key + different inputs errors. */
+  key: string;
+  app: string;
+  action: string;
+  connection?: string | number | null;
+  inputs?: Record<string, unknown>;
+  notificationUrl?: string;
+}) {
+  const r = await opts.sdk.ensureTriggerInbox({
+    key: opts.key,
+    app: opts.app,
+    action: opts.action,
+    connection: opts.connection ?? null,
+    inputs: opts.inputs,
+    notificationUrl: opts.notificationUrl,
+  });
+  return r.data;
+}
+
+export async function getInbox(sdk: Sdk, inbox: string) {
+  return (await sdk.getTriggerInbox({ inbox })).data;
+}
+
+/** Recent messages in an inbox (metadata + attributes, no payloads) — for the inbox view. */
+export async function listInboxMessages(sdk: Sdk, inbox: string, maxItems = 20) {
+  const res = await sdk.listTriggerInboxMessages({ inbox, maxItems });
+  return res.data;
+}
+
+export async function leaseMessages(opts: {
+  sdk: Sdk;
+  inbox: string;
+  leaseLimit?: number;
+  leaseSeconds?: number;
+  signal?: AbortSignal;
+}): Promise<Lease> {
+  const r = await opts.sdk.leaseTriggerInboxMessages({
+    inbox: opts.inbox,
+    leaseLimit: opts.leaseLimit,
+    leaseSeconds: opts.leaseSeconds,
+    signal: opts.signal,
+  });
+  return r.data as Lease;
+}
+
+export async function ackMessages(opts: {
+  sdk: Sdk;
+  inbox: string;
+  lease: string;
+  messages?: string[];
+}) {
+  return (
+    await opts.sdk.ackTriggerInboxMessages({
+      inbox: opts.inbox,
+      lease: opts.lease,
+      messages: opts.messages,
+    })
+  ).data;
+}
+
+export async function releaseMessages(opts: {
+  sdk: Sdk;
+  inbox: string;
+  lease: string;
+  messages?: string[];
+}) {
+  return (
+    await opts.sdk.releaseTriggerInboxMessages({
+      inbox: opts.inbox,
+      lease: opts.lease,
+      messages: opts.messages,
+    })
+  ).data;
+}
+
+export interface DispatchResult {
+  /** Handled successfully this round — ack these. */
+  processed: string[];
+  /** Already handled before (redelivery / duplicate) — ack these too, but don't re-run. */
+  skipped: string[];
+  /** Handler threw — release these for retry. */
+  failed: string[];
+}
+
+/**
+ * Run a handler over a leased batch with dedup. Because delivery is at-least-once,
+ * a message can reappear (`lease_count > 1`, or `possible_duplicate_data`); the
+ * caller supplies `isAlreadyProcessed` (its idempotency store — the automation_run
+ * table in M3) and anything already seen is skipped, not re-run. The message id is
+ * the dedup key. This does NOT ack/release — it classifies so the caller acks
+ * `processed`+`skipped` and releases `failed`.
+ */
+export async function dispatchLeased(opts: {
+  lease: Lease;
+  handle: (message: LeasedMessage) => Promise<void> | void;
+  isAlreadyProcessed?: (message: LeasedMessage) => Promise<boolean> | boolean;
+}): Promise<DispatchResult> {
+  const { lease, handle, isAlreadyProcessed } = opts;
+  const result: DispatchResult = { processed: [], skipped: [], failed: [] };
+
+  for (const message of lease.results) {
+    const seen = isAlreadyProcessed ? await isAlreadyProcessed(message) : false;
+    if (seen) {
+      result.skipped.push(message.id);
+      continue;
+    }
+    try {
+      await handle(message);
+      result.processed.push(message.id);
+    } catch {
+      result.failed.push(message.id);
+    }
+  }
+
+  return result;
+}
diff --git a/packages/agents/src/lib/workflows/engine.ts b/packages/agents/src/lib/workflows/engine.ts
deleted file mode 100644
index 84958f95..00000000
--- a/packages/agents/src/lib/workflows/engine.ts
+++ /dev/null
@@ -1,177 +0,0 @@
-import { getSupabase } from "@/lib/db";
-import { runAction } from "@/lib/zapier/execution";
-import { substituteParams, validateParams } from "./params";
-
-export interface WorkflowEvent {
-  type: "status" | "step" | "complete" | "error" | "param_request";
-  runId?: string;
-  stepIndex?: number;
-  stepId?: string;
-  status?: string;
-  label?: string;
-  result?: unknown;
-  error?: string;
-  message?: string;
-  missing?: string[];
-}
-
-/** How a run started — recorded on workflow_run so trigger-fired runs carry
- * context in run history. (foreman-2afc) */
-export type FiredBy = "manual" | "cron" | "channel" | "poll";
-
-export interface WorkflowTriggerContext {
-  firedBy: FiredBy;
-  /** The workflow_trigger row that fired this run (null for manual runs). */
-  triggerId?: string;
-}
-
-/**
- * Execute a saved workflow, yielding SSE-friendly events as each step runs.
- */
-export async function* executeWorkflow(
-  workflowId: string,
-  userId: string,
-  inputs: Record<string, string>,
-  _orgId?: string,
-  trigger: WorkflowTriggerContext = { firedBy: "manual" },
-): AsyncGenerator<WorkflowEvent> {
-  const supabase = getSupabase();
-
-  // Load steps ordered
-  const { data: steps } = await supabase
-    .from("workflow_step")
-    .select("*")
-    .eq("workflow_id", workflowId)
-    .order("order", { ascending: true });
-
-  if (!steps || steps.length === 0) {
-    yield { type: "error", message: "Workflow has no steps" };
-    return;
-  }
-
-  // Check all parameters are satisfied across all steps
-  for (const step of steps) {
-    const template = JSON.parse(step.proposal_template) as Record<string, unknown>;
-    const inputsTemplate = (template.inputs ?? {}) as Record<string, unknown>;
-    const { valid, missing } = validateParams(inputsTemplate, inputs);
-    if (!valid) {
-      yield { type: "param_request", missing };
-      return;
-    }
-  }
-
-  // Create run record
-  const runId = crypto.randomUUID();
-  const now = new Date().toISOString();
-
-  await supabase.from("workflow_run").insert({
-    id: runId,
-    workflow_id: workflowId,
-    inputs: JSON.stringify(inputs),
-    status: "running",
-    created_at: now,
-    fired_by: trigger.firedBy,
-    trigger_id: trigger.triggerId ?? null,
-  });
-
-  // Own the run's terminal state in a try/finally so the row can never get
-  // stuck in 'running'. `settled` flips at each terminal write (step failure or
-  // success). The finally catches the cases the old code missed: the caller
-  // abandons the generator mid-stream (for-await break → generator .return()),
-  // or an unexpected error propagates out of a step. The status yield lives
-  // inside the try so an abandon at any point after the row exists is covered.
-  // (foreman-2afc)
-  let settled = false;
-  try {
-    yield { type: "status", runId, status: "running" };
-
-    for (let i = 0; i < steps.length; i++) {
-      const step = steps[i];
-      const template = JSON.parse(step.proposal_template) as Record<string, unknown>;
-      const label = (template.humanLabel as string) ?? `Step ${i + 1}`;
-
-      yield {
-        type: "step",
-        runId,
-        stepIndex: i,
-        stepId: step.id,
-        status: "running",
-        label,
-      };
-
-      try {
-        const rawInputs = (template.inputs ?? {}) as Record<string, unknown>;
-        const resolved = substituteParams(rawInputs, inputs);
-
-        const result = await runAction(
-          userId,
-          template.appKey as string,
-          template.actionType as string,
-          template.actionKey as string,
-          resolved,
-          template.connectionId as string | undefined,
-        );
-
-        yield {
-          type: "step",
-          runId,
-          stepIndex: i,
-          stepId: step.id,
-          status: "complete",
-          label,
-          result,
-        };
-      } catch (err) {
-        const errorMsg = err instanceof Error ? err.message : String(err);
-
-        yield {
-          type: "step",
-          runId,
-          stepIndex: i,
-          stepId: step.id,
-          status: "failed",
-          label,
-          error: errorMsg,
-        };
-
-        await supabase
-          .from("workflow_run")
-          .update({
-            status: "failed",
-            completed_at: new Date().toISOString(),
-            error_message: errorMsg,
-          })
-          .eq("id", runId);
-        settled = true;
-
-        yield { type: "error", runId, message: errorMsg };
-        return;
-      }
-    }
-
-    // All steps succeeded
-    await supabase
-      .from("workflow_run")
-      .update({ status: "success", completed_at: new Date().toISOString() })
-      .eq("id", runId);
-    settled = true;
-
-    yield { type: "complete", runId, status: "success" };
-  } finally {
-    if (!settled) {
-      try {
-        await supabase
-          .from("workflow_run")
-          .update({
-            status: "failed",
-            completed_at: new Date().toISOString(),
-            error_message:
-              "run did not complete (generator abandoned or aborted before a terminal state)",
-          })
-          .eq("id", runId);
-      } catch (e) {
-        console.error(`[engine] failed to mark abandoned run ${runId} failed:`, e);
-      }
-    }
-  }
-}
diff --git a/packages/agents/src/lib/workflows/params.ts b/packages/agents/src/lib/workflows/params.ts
deleted file mode 100644
index 646db3fc..00000000
--- a/packages/agents/src/lib/workflows/params.ts
+++ /dev/null
@@ -1,60 +0,0 @@
-/**
- * Mustache-style {{param}} substitution for workflow step templates.
- */
-
-const PARAM_RE = /\{\{(\w+)\}\}/g;
-
-/** Extract all unique parameter names from a template object. */
-export function extractParams(template: Record<string, unknown>): string[] {
-  const params = new Set<string>();
-
-  function walk(value: unknown): void {
-    if (typeof value === "string") {
-      for (const match of value.matchAll(PARAM_RE)) {
-        params.add(match[1]);
-      }
-    } else if (Array.isArray(value)) {
-      for (const item of value) walk(item);
-    } else if (value !== null && typeof value === "object") {
-      for (const v of Object.values(value)) walk(v);
-    }
-  }
-
-  walk(template);
-  return [...params];
-}
-
-/** Deep-substitute {{param}} placeholders with provided values. */
-export function substituteParams(
-  template: Record<string, unknown>,
-  values: Record<string, string>,
-): Record<string, unknown> {
-  function walk(value: unknown): unknown {
-    if (typeof value === "string") {
-      return value.replace(PARAM_RE, (full, key) => (key in values ? values[key] : full));
-    }
-    if (Array.isArray(value)) {
-      return value.map(walk);
-    }
-    if (value !== null && typeof value === "object") {
-      const out: Record<string, unknown> = {};
-      for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
-        out[k] = walk(v);
-      }
-      return out;
-    }
-    return value;
-  }
-
-  return walk(template) as Record<string, unknown>;
-}
-
-/** Validate that all required parameters have been provided. */
-export function validateParams(
-  template: Record<string, unknown>,
-  values: Record<string, string>,
-): { valid: boolean; missing: string[] } {
-  const required = extractParams(template);
-  const missing = required.filter((p) => !(p in values));
-  return { valid: missing.length === 0, missing };
-}
diff --git a/packages/agents/src/lib/workflows/save.ts b/packages/agents/src/lib/workflows/save.ts
deleted file mode 100644
index 8fd77fef..00000000
--- a/packages/agents/src/lib/workflows/save.ts
+++ /dev/null
@@ -1,131 +0,0 @@
-import { resolveAppSlug } from "@/lib/catalog/resolve";
-import { getSupabase } from "@/lib/db";
-import { extractParams } from "./params";
-
-/** Heuristic: values that look like they should become parameters. */
-const PARAMETERIZE_PATTERNS = [
-  // Email addresses
-  /^[^\s@]+@[^\s@]+\.[^\s@]+$/,
-  // UUIDs
-  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,
-  // Phone numbers (basic)
-  /^\+?\d[\d\s\-()]{6,}$/,
-];
-
-function shouldParameterize(_key: string, value: unknown): boolean {
-  if (typeof value !== "string") return false;
-  return PARAMETERIZE_PATTERNS.some((re) => re.test(value));
-}
-
-/** Convert a hardcoded value into a parameter name based on the field key. */
-function toParamName(key: string): string {
-  return key
-    .replace(/([a-z])([A-Z])/g, "$1_$2")
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, "_")
-    .replace(/^_|_$/g, "");
-}
-
-/**
- * Save a workflow from a conversation's executed proposals.
- */
-export async function saveWorkflowFromConversation(
-  conversationId: string,
-  userId: string,
-  name: string,
-  _orgId?: string,
-): Promise<{ workflowId: string; steps: number; parameters: string[] }> {
-  const supabase = getSupabase();
-
-  // Verify conversation ownership
-  const { data: conv } = await supabase
-    .from("conversation")
-    .select("id")
-    .eq("id", conversationId)
-    .eq("user_id", userId)
-    .limit(1)
-    .maybeSingle();
-
-  if (!conv) {
-    throw new Error("Conversation not found");
-  }
-
-  // Load executed proposals in order
-  const { data: proposals } = await supabase
-    .from("action_proposal")
-    .select("*")
-    .eq("conversation_id", conversationId)
-    .eq("status", "executed")
-    .order("created_at", { ascending: true });
-
-  if (!proposals || proposals.length === 0) {
-    throw new Error("No executed actions found in this conversation to save as a workflow");
-  }
-
-  const workflowId = crypto.randomUUID();
-  const now = new Date().toISOString();
-  const allParams = new Set<string>();
-
-  const stepValues: Array<{
-    id: string;
-    workflow_id: string;
-    order: number;
-    proposal_template: string;
-  }> = [];
-
-  for (let i = 0; i < proposals.length; i++) {
-    const p = proposals[i];
-    const inputs = JSON.parse(p.inputs) as Record<string, unknown>;
-
-    const parameterized: Record<string, unknown> = {};
-    for (const [key, value] of Object.entries(inputs)) {
-      if (shouldParameterize(key, value)) {
-        const paramName = toParamName(key);
-        parameterized[key] = `{{${paramName}}}`;
-        allParams.add(paramName);
-      } else {
-        parameterized[key] = value;
-      }
-    }
-
-    const template = {
-      appKey: await resolveAppSlug(p.app_key),
-      actionType: p.action_type,
-      actionKey: p.action_key,
-      humanLabel: p.human_label,
-      inputs: parameterized,
-      connectionId: p.connection_id,
-    };
-
-    for (const name of extractParams(parameterized)) {
-      allParams.add(name);
-    }
-
-    stepValues.push({
-      id: crypto.randomUUID(),
-      workflow_id: workflowId,
-      order: i,
-      proposal_template: JSON.stringify(template),
-    });
-  }
-
-  const parameters = [...allParams];
-
-  // Insert workflow
-  await supabase.from("workflow").insert({
-    id: workflowId,
-    user_id: userId,
-    name,
-    source_conversation_id: conversationId,
-    parameters: JSON.stringify(parameters),
-    created_at: now,
-    updated_at: now,
-  });
-
-  // Insert steps
-  for (const step of stepValues) {
-    await supabase.from("workflow_step").insert(step);
-  }
-
-  return { workflowId, steps: stepValues.length, parameters };
-}
diff --git a/packages/agents/src/lib/zapier-sdk-tools.ts b/packages/agents/src/lib/zapier-sdk-tools.ts
index 615d862d..35f83f42 100644
--- a/packages/agents/src/lib/zapier-sdk-tools.ts
+++ b/packages/agents/src/lib/zapier-sdk-tools.ts
@@ -2,20 +2,25 @@ import { createTool } from "@mastra/core/tools";
 import {
   createZapierSdk,
   ZapierActionError,
+  ZapierApiError,
   ZapierAppNotFoundError,
   ZapierApprovalError,
   ZapierAuthenticationError,
+  ZapierBundleError,
   ZapierConfigurationError,
+  ZapierConflictError,
   ZapierError,
   ZapierNotFoundError,
   ZapierRateLimitError,
   ZapierRelayError,
   ZapierResourceNotFoundError,
   ZapierTimeoutError,
+  ZapierUnknownError,
   ZapierValidationError,
 } from "@zapier/zapier-sdk";
 import { z } from "zod";
 import { requestUserContext } from "./request-user-context";
+import { onZapierSdkEvent } from "./zapier/deprecation";
 import { getSdkForUser } from "./zapier/sdk";
 
 /**
@@ -60,8 +65,9 @@ const READ_ONLY = new Set([
   "findFirstConnection",
   "findUniqueConnection",
   "getConnection",
-  "getInputFieldsSchema",
-  "listInputFieldChoices",
+  "getActionInputFieldsSchema",
+  "listActionInputFields",
+  "listActionInputFieldChoices",
   "listTables",
   "getTable",
   "listTableFields",
@@ -86,12 +92,28 @@ const EXCLUDED_METHODS = new Set([
   "findUniqueAuthentication",
   "getAuthentication",
   "request",
-  // Legacy duplicate of getInputFieldsSchema
+  // Deprecated input-field aliases — canonical surfaced instead:
+  // getActionInputFieldsSchema / listActionInputFields / listActionInputFieldChoices
   "listInputFields",
+  "getInputFieldsSchema",
+  "listInputFieldChoices",
   // Connect Builder OAuth client credentials — Foreman doesn't expose this
   "createClientCredentials",
   "deleteClientCredentials",
   "listClientCredentials",
+  // In-flow connection helpers (added to the main mcp registry in SDK 0.71).
+  // Excluded from auto-generation for two reasons:
+  //   1. `createConnection` / `waitForNewConnection` BLOCK up to 5 minutes
+  //      waiting for the user to finish connecting — wrong for Mastra's
+  //      synchronous tool loop (would stall a request/stream).
+  //   2. Foreman already owns the connection UX via the `connect_zapier`
+  //      custom tool + the `/zapier/*` OAuth callback route; exposing these
+  //      would give the agent competing, overlapping ways to connect an app.
+  // Deliberate adoption of `createConnection` (as a proper async/background
+  // custom tool) is tracked in foreman-mcwn.
+  "createConnection",
+  "getConnectionStartUrl",
+  "waitForNewConnection",
 ]);
 
 /** Convert camelCase to kebab-case (matching MCP server convention). */
@@ -99,6 +121,17 @@ function toKebab(name: string): string {
   return name.replace(/([A-Z])/g, "-$1").toLowerCase();
 }
 
+/**
+ * Tool IDs (kebab-case) of the read-only Zapier tools — the safe, no-approval
+ * reads. Used to opt them into Mastra background execution at the AGENT level
+ * (foreman-7am4): tool-level `background` config doesn't dispatch under Foreman's
+ * lazy `tools: () => …` resolver, but the agent-level `backgroundTasks.tools`
+ * map does. Write/destructive tools are intentionally excluded (stay synchronous
+ * so the proposal/approval flow is undisturbed). Computed from static metadata —
+ * no SDK init, safe to import at module load.
+ */
+export const READ_ONLY_TOOL_IDS: string[] = Array.from(READ_ONLY, toKebab);
+
 /**
  * List methods that return paginated results.
  * We pass maxItems to the SDK so it auto-paginates up to the cap.
@@ -110,13 +143,86 @@ const PAGINATED_METHODS = new Set([
   "listTables",
   "listTableRecords",
   "listTableFields",
-  "listInputFieldChoices",
+  "listActionInputFieldChoices",
   "runAction", // search/read actions return paginated results
 ]);
 
 /** Default max items to collect when auto-paginating. */
 const DEFAULT_MAX_ITEMS = 100;
 
+/**
+ * Stringified-open-object coercion (the nested-in-array gap).
+ *
+ * A few Zapier tools take an "open bag" param — dynamic keys, `additionalProperties`
+ * — *nested inside an array*: table-record `data`, table-field `options`/`config`.
+ * Models (weak ones reliably, strong ones sometimes) emit such a bag as a JSON
+ * *string*. Mastra's built-in coercion (`coerceStringifiedJsonValues`) only fixes
+ * TOP-LEVEL bags, not ones nested in an array, so these fail validation before the
+ * tool runs.
+ *
+ * We override just these tools' input schemas — rebuilt in *our* zod so the
+ * field-level coercion actually runs during Mastra's `~standard` validation. (A
+ * `z.preprocess` wrapper around the SDK's own schema gets bypassed because it
+ * crosses zod copies.) The model-facing JSON schema is unchanged: the bag still
+ * advertises as an `object`; we just also accept and parse the stringified form.
+ */
+const jsonObjectParam = (desc: string) =>
+  z.preprocess((v: unknown) => {
+    if (typeof v === "string") {
+      try {
+        return JSON.parse(v);
+      } catch {
+        return v; // leave as-is; validation surfaces the real problem
+      }
+    }
+    return v;
+  }, z.record(z.string(), z.any()).describe(desc));
+
+const SCHEMA_OVERRIDES: Record<string, z.ZodTypeAny> = {
+  createTableRecords: z.object({
+    table: z.string().describe("The unique identifier of the table"),
+    records: z
+      .array(
+        z.object({
+          data: jsonObjectParam("Field values for the record, keyed by field name or id"),
+        }),
+      )
+      .min(1)
+      .describe("Records to create (max 100)"),
+    keyMode: z
+      .enum(["names", "ids"])
+      .optional()
+      .describe('How to interpret field keys: "names" (default, human-readable) or "ids"'),
+  }),
+  updateTableRecords: z.object({
+    table: z.string().describe("The unique identifier of the table"),
+    records: z
+      .array(
+        z.object({
+          id: z.string().describe("The record id to update"),
+          data: jsonObjectParam("Updated field values, keyed by field name or id"),
+        }),
+      )
+      .min(1)
+      .describe("Records to update"),
+    keyMode: z.enum(["names", "ids"]).optional(),
+  }),
+  createTableFields: z.object({
+    table: z.string().describe("The unique identifier of the table"),
+    fields: z
+      .array(
+        z.object({
+          name: z.string().describe("Field (column) name"),
+          type: z.string().describe("Field type, e.g. string, number, date, email, bool"),
+          options: jsonObjectParam("Optional field options (type-specific)").optional(),
+          config: jsonObjectParam("Optional field config (type-specific)").optional(),
+        }),
+      )
+      .min(1)
+      .describe("Fields (columns) to create"),
+  }),
+};
+
 /**
  * Resolve SDK credentials based on environment.
  * - Explicit credentials passed in: use as-is (per-user token from PKCE flow).
@@ -125,7 +231,7 @@ const DEFAULT_MAX_ITEMS = 100;
  */
 function resolveCredentials(
   explicit?: string | (() => Promise<string>),
-): Parameters<typeof createZapierSdk>[0]["credentials"] {
+): NonNullable<Parameters<typeof createZapierSdk>[0]>["credentials"] {
   if (explicit) return explicit;
   const isDev = process.env.FOREMAN_MODE === "dev";
   if (!isDev) {
@@ -186,6 +292,7 @@ export function generateZapierTools(
     maxNetworkRetries: 3,
     maxNetworkRetryDelayMs: 30000,
     canDeleteTables: true,
+    onEvent: onZapierSdkEvent,
   });
 
   const registry = sdk.getRegistry({ package: "mcp" });
@@ -224,7 +331,7 @@ export function generateZapierTools(
       tools[toolName] = createTool({
         id: toolName,
         description,
-        inputSchema: unwrapped as unknown as z.ZodObject<any>,
+        inputSchema: (SCHEMA_OVERRIDES[fn.name] ?? unwrapped) as unknown as z.ZodObject<any>,
         ...(isDestructive ? { requireApproval: true } : {}),
         ...mcpAnnotations,
         execute: async (input) => {
@@ -439,6 +546,59 @@ export function handleSdkError(
     };
   }
 
+  // Conflicting state (409) — e.g. creating a named resource that already
+  // exists, or acting on a resource in an incompatible state. Actionable:
+  // tell the user what conflicted so they can rename / pick another.
+  if (err instanceof ZapierConflictError) {
+    const ce = err as ZapierConflictError;
+    return {
+      error: `${methodName} conflicts with existing state${
+        ce.resourceType ? ` (${ce.resourceType})` : ""
+      }: ${(err as Error).message}. It may already exist or be in an incompatible state — use a different name or check the current state, then try again.`,
+      code: "CONFLICT",
+      retryable: false,
+    };
+  }
+
+  // Generic API-request failure. Base ZapierError carries an optional
+  // statusCode; surface it when present. Not retryable by default (unlike
+  // rate-limit/timeout/relay, which have their own branches above).
+  if (err instanceof ZapierApiError) {
+    const ape = err as ZapierApiError;
+    return {
+      error: `Zapier API error for ${methodName}${
+        ape.statusCode ? ` (HTTP ${ape.statusCode})` : ""
+      }: ${(err as Error).message}`,
+      code: "API_ERROR",
+      retryable: false,
+    };
+  }
+
+  // Code bundling / compilation failure — carries per-error build details.
+  if (err instanceof ZapierBundleError) {
+    const be = err as ZapierBundleError;
+    const detail =
+      be.buildErrors && be.buildErrors.length > 0
+        ? be.buildErrors.join("; ")
+        : (err as Error).message;
+    return {
+      error: `${methodName} failed to build: ${detail}`,
+      code: "BUNDLE_ERROR",
+      retryable: false,
+    };
+  }
+
+  // Fallback the SDK produces for non-Error throws it normalized. No extra
+  // structure to extract — surface the message. Must precede the ZapierError
+  // catch-all (it extends ZapierError).
+  if (err instanceof ZapierUnknownError) {
+    return {
+      error: `${methodName} failed: ${(err as Error).message}`,
+      code: "UNKNOWN_ERROR",
+      retryable: false,
+    };
+  }
+
   // Catch-all for any ZapierError subclass we didn't handle
   if (err instanceof ZapierError) {
     return {
diff --git a/packages/agents/src/lib/zapier/deprecation.ts b/packages/agents/src/lib/zapier/deprecation.ts
new file mode 100644
index 00000000..f4605674
--- /dev/null
+++ b/packages/agents/src/lib/zapier/deprecation.ts
@@ -0,0 +1,45 @@
+import {
+  DEPRECATION_NOTICE_EVENT,
+  type DeprecationNoticePayload,
+  type SdkEvent,
+} from "@zapier/zapier-sdk";
+
+/**
+ * Zapier SDK deprecation-notice relay (SDK >= 0.79).
+ *
+ * The SDK sniffs `zapier-sdk-deprecation-*` response headers and emits an
+ * `api:deprecation_notice` event (`DEPRECATION_NOTICE_EVENT`). We attach a
+ * single `onEvent` handler to every SDK instance we build so that when Zapier
+ * flags an endpoint Foreman uses as deprecated, it shows up in the server logs
+ * with a greppable prefix — before the endpoint breaks — and is recorded for
+ * anything that later wants to surface it to users.
+ */
+
+/** Deprecation notices seen this process, keyed by stable notice id. */
+const seen = new Map<string, DeprecationNoticePayload>();
+
+/**
+ * SDK `onEvent` handler. Pass as `createZapierSdk({ onEvent: onZapierSdkEvent })`.
+ * Safe to attach to every SDK instance — non-deprecation events return
+ * immediately, and each notice id is logged at most once per process.
+ */
+export function onZapierSdkEvent(event: SdkEvent): void {
+  if (event.type !== DEPRECATION_NOTICE_EVENT) return;
+  const payload = event.payload as DeprecationNoticePayload | undefined;
+  if (!payload?.id || seen.has(payload.id)) return;
+  seen.set(payload.id, payload);
+  const when = payload.deprecation
+    ? ` (deprecated ${new Date(payload.deprecation).toISOString()})`
+    : "";
+  console.warn(`[zapier:deprecation] ${payload.message}${when}`);
+}
+
+/** Deprecation notices seen so far this process (for surfacing to users/UI). */
+export function getZapierDeprecations(): DeprecationNoticePayload[] {
+  return [...seen.values()];
+}
+
+/** Test-only: reset the per-process dedup set. */
+export function __resetZapierDeprecations(): void {
+  seen.clear();
+}
diff --git a/packages/agents/src/lib/zapier/discovery.ts b/packages/agents/src/lib/zapier/discovery.ts
index 78a3b350..4a28dfb6 100644
--- a/packages/agents/src/lib/zapier/discovery.ts
+++ b/packages/agents/src/lib/zapier/discovery.ts
@@ -30,7 +30,7 @@ export async function getInputFieldsSchema(
   connection?: string,
 ) {
   const sdk = await getSdkForUser(userId);
-  const { data } = await sdk.getInputFieldsSchema({
+  const { data } = await sdk.getActionInputFieldsSchema({
     app,
     actionType: actionType as ActionType,
     action,
@@ -48,7 +48,7 @@ export async function getInputFieldChoices(
   connection?: string,
 ) {
   const sdk = await getSdkForUser(userId);
-  const { data } = await sdk.listInputFieldChoices({
+  const { data } = await sdk.listActionInputFieldChoices({
     app,
     actionType: actionType as ActionType,
     action,
diff --git a/packages/agents/src/lib/zapier/sdk.ts b/packages/agents/src/lib/zapier/sdk.ts
index 0c2a340e..55c294cd 100644
--- a/packages/agents/src/lib/zapier/sdk.ts
+++ b/packages/agents/src/lib/zapier/sdk.ts
@@ -1,10 +1,30 @@
 import { createZapierSdk } from "@zapier/zapier-sdk";
+import { createZapierSdk as createExperimentalSdk } from "@zapier/zapier-sdk/experimental";
 import { decryptToken, encryptToken } from "../crypto";
 import { getSupabase } from "../db";
+import type { Database } from "../db/database.types";
 import { getEnv } from "../env";
+import { resolveActiveWorkspace } from "../identity";
 import { loadUserConnectionsMap } from "./aliases";
+import { onZapierSdkEvent } from "./deprecation";
 import { ZapierNotConnected, ZapierReauthRequired } from "./errors";
 
+/**
+ * How a workspace member's Zapier connection is resolved (workspace_settings
+ * .zapier_connection_mode). Absent setting ⇒ "member-first".
+ */
+type ConnectionMode = "member-first" | "shared" | "personal";
+
+async function resolveWorkspaceConnectionMode(workspaceId: string): Promise<ConnectionMode> {
+  const { data } = await getSupabase()
+    .from("workspace_settings")
+    .select("zapier_connection_mode")
+    .eq("workspace_id", workspaceId)
+    .maybeSingle();
+  const mode = data?.zapier_connection_mode;
+  return mode === "shared" || mode === "personal" ? mode : "member-first";
+}
+
 // Must match the client ID used during the PKCE OAuth flow in connect.ts.
 // Tokens issued to a PKCE public client can only be refreshed with the same client_id and no secret.
 const ZAPIER_PKCE_CLIENT_ID = "grwWZD5hUWGvb4V8ODBuOtXer3h0DBEZ2HR8aay6";
@@ -46,13 +66,27 @@ async function refreshAccessToken(
   };
 }
 
-export async function getSdkForUser(userId: string, orgId?: string): Promise<ZapierSdk> {
+type ZapierSdkFactory<T> = (options?: Parameters<typeof createZapierSdk>[0]) => T;
+
+/**
+ * Shared per-user client builder. The stable and experimental SDK factories take
+ * the same options and differ only in the surface they expose, so both run
+ * through one token + connection-alias resolution path (and one refresh) here —
+ * each with its own cache. Don't duplicate this logic per factory.
+ */
+async function buildSdkForUser<T>(
+  factory: ZapierSdkFactory<T>,
+  cache: Map<string, { sdk: T; expiresAt: number }>,
+  userId: string,
+  orgId?: string,
+): Promise<T> {
   const env = getEnv();
 
   // DEV_ZAPIER_OVERRIDE: use a direct token for local development
   if (env.DEV_ZAPIER_OVERRIDE) {
-    return createZapierSdk({
+    return factory({
       credentials: env.DEV_ZAPIER_OVERRIDE,
+      onEvent: onZapierSdkEvent,
     });
   }
 
@@ -60,41 +94,79 @@ export async function getSdkForUser(userId: string, orgId?: string): Promise<Zap
   const cacheKey = orgId ? `${userId}:org:${orgId}` : userId;
 
   // Check cache
-  const cached = sdkCache.get(cacheKey);
+  const cached = cache.get(cacheKey);
   if (cached && cached.expiresAt > Date.now()) {
     return cached.sdk;
   }
 
-  // Load from database — when workspaceId is set, try shared workspace connection first
+  // Resolve the workspace whose policy governs this user (an explicit orgId wins;
+  // otherwise the user's active workspace), then that workspace's connection mode.
   const supabase = getSupabase();
-  let identity: Record<string, any> | null = null;
+  const workspaceId = orgId ?? (await resolveActiveWorkspace(userId)) ?? undefined;
+  const mode: ConnectionMode = workspaceId
+    ? await resolveWorkspaceConnectionMode(workspaceId)
+    : "personal";
+
+  type ZapierIdentityRow = Database["public"]["Tables"]["zapier_identity"]["Row"];
+
+  // The loaders RETURN the row rather than mutating a captured `identity` — TS
+  // can't track assignments made inside a closure, so the old mutate-in-closure
+  // form left `identity` un-narrowable (it collapsed to `never` after the
+  // `if (!identity)` guards). Returning keeps the data flow visible to CFA.
+
+  // The member's own connection. Retry briefly: right after the OAuth callback
+  // writes zapier_identity (e.g. the onboarding "test" step), the row can lag,
+  // which would otherwise look like "not connected". An existing row resolves on
+  // the first attempt, so there's no added latency once a user is connected.
+  const loadPersonal = async (retry: boolean): Promise<ZapierIdentityRow | null> => {
+    const attempts = retry ? 3 : 1;
+    let found: ZapierIdentityRow | null = null;
+    for (let attempt = 0; attempt < attempts && !found; attempt++) {
+      if (attempt > 0) await new Promise((resolve) => setTimeout(resolve, 300));
+      const { data } = await supabase
+        .from("zapier_identity")
+        .select("*")
+        .eq("user_id", userId)
+        .limit(1)
+        .maybeSingle();
+      found = data;
+    }
+    return found;
+  };
 
-  if (orgId) {
+  // The workspace's designated shared connection (a zapier_identity tagged with
+  // this workspace_id — typically owned by another member).
+  const loadShared = async (): Promise<ZapierIdentityRow | null> => {
+    if (!workspaceId) return null;
     const { data } = await supabase
       .from("zapier_identity")
       .select("*")
-      .eq("workspace_id", orgId)
+      .eq("workspace_id", workspaceId)
       .limit(1)
       .maybeSingle();
-    identity = data;
-  }
+    return data;
+  };
 
-  // Fall back to user's personal connection
-  if (!identity) {
-    const { data } = await supabase
-      .from("zapier_identity")
-      .select("*")
-      .eq("user_id", userId)
-      .limit(1)
-      .maybeSingle();
-    identity = data;
+  let identity: ZapierIdentityRow | null = null;
+
+  if (mode === "personal") {
+    identity = await loadPersonal(true);
+  } else if (mode === "shared") {
+    identity = await loadShared();
+  } else {
+    // member-first: own connection, then the workspace's shared one. Only retry
+    // the personal lookup (for OAuth lag) once nothing else resolved, so members
+    // who rely on the shared connection don't pay the backoff on every call.
+    identity = await loadPersonal(false);
+    if (!identity) identity = await loadShared();
+    if (!identity) identity = await loadPersonal(true);
   }
 
   if (!identity) {
     // Dev fallback: use CLI login credentials (~/.zapier-sdk/config.json).
     // production and self_hosted both require a real per-user OAuth connection.
     if (env.FOREMAN_MODE === "dev") {
-      return createZapierSdk();
+      return factory({ onEvent: onZapierSdkEvent });
     }
     throw new ZapierNotConnected(userId);
   }
@@ -109,7 +181,8 @@ export async function getSdkForUser(userId: string, orgId?: string): Promise<Zap
       const storedRefresh = decryptToken(identity.refresh_token);
       const refreshed = await refreshAccessToken(userId, storedRefresh);
 
-      // Update DB with new tokens
+      // Update the resolved row by its own id — it may be a shared connection
+      // owned by another member, so scoping by the requesting user_id would miss.
       await supabase
         .from("zapier_identity")
         .update({
@@ -118,12 +191,12 @@ export async function getSdkForUser(userId: string, orgId?: string): Promise<Zap
           expires_at: refreshed.expiresAt.toISOString(),
           updated_at: new Date().toISOString(),
         })
-        .eq("user_id", userId);
+        .eq("id", identity.id);
 
       accessToken = refreshed.accessToken;
       tokenExpiry = refreshed.expiresAt.getTime();
     } catch {
-      sdkCache.delete(userId);
+      cache.delete(cacheKey);
       throw new ZapierReauthRequired(userId, "token refresh failed");
     }
   } else {
@@ -134,17 +207,44 @@ export async function getSdkForUser(userId: string, orgId?: string): Promise<Zap
   const connectionsMap = await loadUserConnectionsMap(userId);
   const hasConnections = Object.keys(connectionsMap).length > 0;
 
-  const sdk = createZapierSdk({
+  const sdk = factory({
     credentials: accessToken,
     ...(hasConnections ? { manifest: { connections: connectionsMap } } : {}),
+    onEvent: onZapierSdkEvent,
   });
 
   // Cache for 5 minutes or until token expires, whichever is sooner
   const fiveMinutes = Date.now() + 5 * 60 * 1000;
-  sdkCache.set(cacheKey, {
+  cache.set(cacheKey, {
     sdk,
     expiresAt: Math.min(fiveMinutes, tokenExpiry),
   });
 
   return sdk;
 }
+
+/**
+ * Per-user STABLE SDK client — action execution, discovery, tables. The default
+ * surface used by the generated Zapier tools.
+ */
+export function getSdkForUser(userId: string, orgId?: string): Promise<ZapierSdk> {
+  return buildSdkForUser(createZapierSdk, sdkCache, userId, orgId);
+}
+
+export type ExperimentalZapierSdk = ReturnType<typeof createExperimentalSdk>;
+
+const experimentalSdkCache = new Map<string, { sdk: ExperimentalZapierSdk; expiresAt: number }>();
+
+/**
+ * Per-user EXPERIMENTAL SDK client — adds the durable-workflow + trigger-inbox
+ * surface (createWorkflow / publishWorkflowVersion / runDurable / triggerWorkflow,
+ * ensureTriggerInbox / lease / ack). Same token + connection-alias resolution as
+ * the stable client, cached separately. The durable rebuild (foreman-l7xq) is
+ * built entirely on this — see lib/durable + lib/trigger-inbox.
+ */
+export function getExperimentalSdkForUser(
+  userId: string,
+  orgId?: string,
+): Promise<ExperimentalZapierSdk> {
+  return buildSdkForUser(createExperimentalSdk, experimentalSdkCache, userId, orgId);
+}
diff --git a/packages/agents/src/linear/bot.ts b/packages/agents/src/linear/bot.ts
index e2c44108..ce0f1af1 100644
--- a/packages/agents/src/linear/bot.ts
+++ b/packages/agents/src/linear/bot.ts
@@ -5,7 +5,6 @@ import { Chat } from "chat";
 import { registerChannelUser } from "../lib/identity";
 import { requestUserContext } from "../lib/request-user-context";
 import { getMastra } from "../mastra";
-import { matchAndFireChannelTriggers } from "../workflows/channel-trigger";
 
 let _bot: Chat<{ linear: ReturnType<typeof createLinearAdapter> }> | undefined;
 let _linearAdapter: ReturnType<typeof createLinearAdapter> | undefined;
@@ -59,14 +58,6 @@ export async function getLinearBot() {
   bot.onDirectMessage(async (thread, message) => {
     if (!message.text) return;
     try {
-      const fired = await matchAndFireChannelTriggers({
-        channel: "linear",
-        text: message.text,
-        from: message.author.userId,
-        dedupeKey: message.id,
-        room: thread.channelId,
-      });
-      if (fired > 0) return;
       console.log("[linear] DM from", message.author.userId, ":", message.text);
       await thread.startTyping().catch(() => {});
       const reply = await generateReply(
@@ -86,14 +77,6 @@ export async function getLinearBot() {
   bot.onNewMention(async (thread, message) => {
     if (!message.text) return;
     try {
-      const fired = await matchAndFireChannelTriggers({
-        channel: "linear",
-        text: message.text,
-        from: message.author.userId,
-        dedupeKey: message.id,
-        room: thread.id,
-      });
-      if (fired > 0) return;
       console.log("[linear] Mention from", message.author.userId, ":", message.text);
       await thread.subscribe();
       await thread.startTyping().catch(() => {});
diff --git a/packages/agents/src/mastra/agents/discovery.ts b/packages/agents/src/mastra/agents/discovery.ts
index e33fa44b..1f5feedc 100644
--- a/packages/agents/src/mastra/agents/discovery.ts
+++ b/packages/agents/src/mastra/agents/discovery.ts
@@ -6,14 +6,15 @@ import {
   systemPromptFor,
   toolsWithCacheControl,
 } from "../../lib/providers";
+import { generateZapierTools } from "../../lib/zapier-sdk-tools";
 
 const DISCOVERY_PROMPT = `You are the Discovery Agent, a specialist in exploring Zapier integrations. Your job is to help users discover what apps they have connected, what actions are available, and what inputs those actions require.
 
 When asked about available integrations:
 1. Use list-connections or find-first-connection to see what apps the user has connected.
 2. Use list-actions to find available actions for a specific app.
-3. Use get-input-fields-schema to get the input schema for a specific action.
-4. For any field with enumerated choices, use list-input-field-choices to get the valid options.
+3. Use get-action-input-fields-schema to get the input schema for a specific action.
+4. For any field with enumerated choices, use list-action-input-field-choices to get the valid options.
 5. Use list-apps with the search parameter to find apps by name.
 
 Return structured, concise results. Do not execute actions — only discover and describe them.`;
@@ -23,8 +24,8 @@ const DISCOVERY_TOOL_NAMES = [
   "find-first-connection",
   "list-actions",
   "get-action",
-  "get-input-fields-schema",
-  "list-input-field-choices",
+  "get-action-input-fields-schema",
+  "list-action-input-field-choices",
   "list-apps",
   "get-app",
 ];
diff --git a/packages/agents/src/mastra/agents/execution.ts b/packages/agents/src/mastra/agents/execution.ts
index 5be36098..7ea6b4d8 100644
--- a/packages/agents/src/mastra/agents/execution.ts
+++ b/packages/agents/src/mastra/agents/execution.ts
@@ -6,6 +6,7 @@ import {
   systemPromptFor,
   toolsWithCacheControl,
 } from "../../lib/providers";
+import { generateZapierTools } from "../../lib/zapier-sdk-tools";
 import { connectZapierTool } from "../tools/connect-zapier";
 
 const EXECUTION_PROMPT = `You are the Execution Agent, responsible for running Zapier actions on behalf of users. You handle action execution, raw API calls, and Zapier account connections.
diff --git a/packages/agents/src/mastra/agents/foreman.ts b/packages/agents/src/mastra/agents/foreman.ts
index bf60b787..c1c03e9f 100644
--- a/packages/agents/src/mastra/agents/foreman.ts
+++ b/packages/agents/src/mastra/agents/foreman.ts
@@ -1,11 +1,11 @@
 import { Agent } from "@mastra/core/agent";
 import { ToolSearchProcessor } from "@mastra/core/processors";
-import { LocalFilesystem, LocalSandbox, Workspace } from "@mastra/core/workspace";
 import { createAnswerRelevancyScorer, createToxicityScorer } from "@mastra/evals/scorers/prebuilt";
+import { fastembed } from "@mastra/fastembed";
 import { Memory } from "@mastra/memory";
 import { PgVector, PostgresStore } from "@mastra/pg";
-import { OpenAIVoice } from "@mastra/voice-openai";
 import { stepCountIs } from "ai";
+import { backgroundToolsConfig } from "../../lib/background";
 import { contextInjector, piiRedactor } from "../../lib/processors";
 import { buildSystemPrompt, type PromptContext } from "../../lib/prompt-template";
 import {
@@ -16,21 +16,21 @@ import {
   systemPromptFor,
   toolsWithCacheControl,
 } from "../../lib/providers";
+import { sanitizeToolSchemas } from "../../lib/tool-schema-sanitizer";
 import { generateZapierTools } from "../../lib/zapier-sdk-tools";
-import { channelTriggerProvider } from "../signals/channel-trigger-provider";
-import { zapierPollProvider } from "../signals/zapier-poll-provider";
-import { attachTriggerTool } from "../tools/attach-trigger";
+import {
+  createAutomationTool,
+  inspectAutomationTool,
+  listAutomationsTool,
+  runAutomationTool,
+} from "../tools/automations";
 import { connectZapierTool } from "../tools/connect-zapier";
-import { deleteWorkflowTool } from "../tools/delete-workflow";
-import { detachTriggerTool } from "../tools/detach-trigger";
+import { createDashboardTool } from "../tools/create-dashboard";
 import { forkConversationTool } from "../tools/fork-conversation";
-import { getWorkflowTool } from "../tools/get-workflow";
-import { listWorkflowTriggersTool } from "../tools/list-workflow-triggers";
-import { listWorkflowsTool } from "../tools/list-workflows";
-import { runWorkflowTool } from "../tools/run-workflow";
-import { saveWorkflowTool } from "../tools/save-workflow";
+import { previewAppTool } from "../tools/preview-app";
+import { saveDocumentTool } from "../tools/save-document";
 import { searchHistoryTool } from "../tools/search-history";
-import { updateWorkflowTool } from "../tools/update-workflow";
+import { buildForemanWorkspace } from "./workspace";
 
 export { buildSystemPrompt, type PromptContext };
 
@@ -51,8 +51,8 @@ const CORE_TOOL_NAMES = [
   // Action discovery + execution
   "list-actions",
   "get-action",
-  "get-input-fields-schema",
-  "list-input-field-choices",
+  "get-action-input-fields-schema",
+  "list-action-input-field-choices",
   "run-action",
   // Zapier Tables (SDK-level, not run-action)
   "list-tables",
@@ -99,21 +99,24 @@ function buildForemanTools() {
   for (const name of CORE_TOOL_NAMES) {
     if (sdkTools[name]) coreTools[name] = sdkTools[name];
   }
-  _foremanToolsCache = toolsWithCacheControl("foreman", {
-    search_history: searchHistoryTool,
-    fork_conversation: forkConversationTool,
-    connect_zapier: connectZapierTool,
-    save_workflow: saveWorkflowTool,
-    list_workflows: listWorkflowsTool,
-    get_workflow: getWorkflowTool,
-    run_workflow: runWorkflowTool,
-    update_workflow: updateWorkflowTool,
-    delete_workflow: deleteWorkflowTool,
-    attach_trigger: attachTriggerTool,
-    list_workflow_triggers: listWorkflowTriggersTool,
-    detach_trigger: detachTriggerTool,
-    ...coreTools,
-  });
+  _foremanToolsCache = sanitizeToolSchemas(
+    toolsWithCacheControl("foreman", {
+      search_history: searchHistoryTool,
+      fork_conversation: forkConversationTool,
+      connect_zapier: connectZapierTool,
+      create_dashboard: createDashboardTool,
+      // Live, code-built previews in the sandbox (foreman-qq4x spike).
+      preview_app: previewAppTool,
+      // Knowledge documents (foreman-aqjx) — save markdown to the workspace.
+      save_document: saveDocumentTool,
+      // Durable automations (foreman-l7xq) — author/deploy/run/inspect from chat.
+      create_automation: createAutomationTool,
+      run_automation: runAutomationTool,
+      list_automations: listAutomationsTool,
+      inspect_automation: inspectAutomationTool,
+      ...coreTools,
+    }),
+  );
   return _foremanToolsCache;
 }
 
@@ -142,31 +145,10 @@ function buildForemanInputProcessors() {
 }
 
 export function createForemanAgent(databaseUrl: string) {
-  const workspacePath = "./data/workspace";
-
-  const workspace = new Workspace({
-    id: "foreman-workspace",
-    name: "Foreman Workspace",
-    filesystem: new LocalFilesystem({
-      basePath: workspacePath,
-      contained: true,
-    }),
-    sandbox: new LocalSandbox({
-      workingDirectory: workspacePath,
-    }),
-    bm25: true,
-    tools: {
-      mastra_workspace_write_file: { requireApproval: true },
-      mastra_workspace_edit_file: { requireApproval: true },
-      mastra_workspace_delete: { requireApproval: true },
-      mastra_workspace_execute_command: { requireApproval: true },
-    },
-  });
-
   return new Agent({
     id: "foreman",
     name: "Foreman",
-    description: "AI assistant that helps users take actions across 9000+ apps via Zapier",
+    description: "AI assistant that helps users take actions across 10,000+ apps via Zapier",
     instructions: systemPromptFor("foreman", buildSystemPrompt()),
     model: AGENT_MODELS.foreman,
     defaultOptions: {
@@ -179,13 +161,16 @@ export function createForemanAgent(databaseUrl: string) {
       stopWhen: stepCountIs(40),
     },
     tools: () => buildForemanTools(),
-    // Triggers run as Mastra SignalProviders hosted on this agent (agent-hosted
-    // gives them notify() → events land in the user's thread). Neither sets a
-    // pollInterval: the poll provider is driven by cron-driver-server on a
-    // single tick (so it doesn't auto-poll in every process the agent is built
-    // in); the channel provider is event-driven via the webhook handlers.
-    signals: [zapierPollProvider, channelTriggerProvider],
-    voice: process.env.OPENAI_API_KEY ? new OpenAIVoice() : undefined,
+    // Run read-only tools (Zapier reads + search_history) as Mastra background
+    // tasks so a slow read doesn't block chat; results fold in via /chat's
+    // streamUntilIdle. Agent-level opt-in (not tool-level) is what actually
+    // dispatches under the lazy tools resolver — see lib/background.ts (foreman-7am4).
+    backgroundTasks: backgroundToolsConfig(),
+    // NOTE: no `voice:` here. Foreman's STT/TTS runs through lib/voice.ts (its own
+    // OpenAIVoice instance) behind the /voice route — nothing reads agent.voice.
+    // Wiring it here also can't type-check: @mastra/voice-openai vendors its own
+    // copy of the @internal/voice MastraVoice class, so OpenAIVoice's base is
+    // nominally distinct (private-field brand) from @mastra/core's MastraVoice.
     scorers: {
       relevancy: {
         scorer: createAnswerRelevancyScorer({ model: MODELS.fast }),
@@ -198,7 +183,7 @@ export function createForemanAgent(databaseUrl: string) {
     },
     inputProcessors: () => buildForemanInputProcessors(),
     outputProcessors: [piiRedactor],
-    workspace,
+    workspace: buildForemanWorkspace,
     memory: new Memory({
       storage: new PostgresStore({
         id: "foreman-memory",
@@ -208,12 +193,16 @@ export function createForemanAgent(databaseUrl: string) {
         id: "foreman-memory-vector",
         connectionString: databaseUrl,
       }),
-      embedder: "openai/text-embedding-3-small",
+      // Local ONNX embedder (bge-small, 384-dim) — no OpenAI key/quota needed.
+      embedder: fastembed,
       options: {
         lastMessages: 20,
         generateTitle: {
           model: MODELS.fast,
-          instructions: "Generate a concise 3-6 word title for this conversation.",
+          instructions:
+            "Generate a concise 3-6 word title summarizing the user's request in this conversation. " +
+            "Output ONLY the plain title text — no markdown, no surrounding quotes, no 'Title:' label, " +
+            "and no trailing punctuation. Do not answer or react to the conversation; just title it.",
         },
         workingMemory: { enabled: true },
         semanticRecall: {
diff --git a/packages/agents/src/mastra/agents/preview-builder.ts b/packages/agents/src/mastra/agents/preview-builder.ts
new file mode 100644
index 00000000..7150bc31
--- /dev/null
+++ b/packages/agents/src/mastra/agents/preview-builder.ts
@@ -0,0 +1,114 @@
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { Agent } from "@mastra/core/agent";
+import { LocalSkillSource, Workspace } from "@mastra/core/workspace";
+import { MODELS } from "../../lib/providers";
+
+/**
+ * Preview Builder — a cheap Haiku agent that turns a short brief (+ optional
+ * data) into a single React component built from the project's REAL shadcn/ui
+ * components, for the `preview_app` tool (foreman-8nyg).
+ *
+ * Why a separate agent: making the primary Foreman agent (Sonnet 4.6) emit a
+ * full component as a tool argument burns thousands of expensive output tokens
+ * on every preview. Sonnet orchestrates (fetch data, decide what to build) and
+ * hands a concise brief here; Haiku writes the verbose TSX at ~1/15th the cost.
+ *
+ * shadcn knowledge is a Mastra Agent Skill (foreman-qdna), NOT a hard-coded
+ * prompt: a real `skills/shadcn/SKILL.md` is attached via the workspace below,
+ * so Mastra injects its metadata into the system message and exposes the
+ * `skill` tool. The builder loads the authoritative shadcn authoring rules
+ * (import map, chart/table/form contracts, type-error pitfalls) at build time —
+ * that's what keeps the generated component compiling on the first try.
+ *
+ * Output is a single `.tsx` file written into the warm Vite + React + Tailwind +
+ * shadcn template (packages/agents/preview-template/src/generated.tsx); Vite HMR
+ * renders it live.
+ */
+
+/**
+ * Locate the directory that CONTAINS `skills/shadcn/SKILL.md` — the basePath for
+ * the skills source. Robust whether this module runs from source (`mastra dev`
+ * bundles it to a different depth) or built output, by walking up from both the
+ * module dir and process.cwd() (mirrors serve.ts's resolveTemplateDir).
+ */
+function resolveSkillsBase(): string {
+  const fromEnv = process.env.FOREMAN_SKILLS_DIR;
+  if (fromEnv && existsSync(path.join(fromEnv, "shadcn", "SKILL.md"))) {
+    return path.dirname(fromEnv);
+  }
+  const starts = [path.dirname(fileURLToPath(import.meta.url)), process.cwd()];
+  for (const start of starts) {
+    let dir = start;
+    for (let i = 0; i < 12; i++) {
+      for (const candidate of [dir, path.join(dir, "packages", "agents")]) {
+        if (existsSync(path.join(candidate, "skills", "shadcn", "SKILL.md"))) {
+          return candidate;
+        }
+      }
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  // mastra dev runs from packages/agents, where ./skills resolves correctly.
+  return process.cwd();
+}
+
+/**
+ * Skills-only workspace (no filesystem/sandbox, so the builder gets ONLY the
+ * read-only skill tools — `skill`, `skill_search`, `skill_read` — not the
+ * workspace file tools). Mastra's SkillsProcessor injects the shadcn skill's
+ * name + description into the system message; the builder calls `skill` to pull
+ * the full instructions on demand.
+ */
+export const previewBuilderWorkspace = new Workspace({
+  id: "preview-builder-skills",
+  name: "Preview Builder Skills",
+  skills: ["skills"],
+  skillSource: new LocalSkillSource({ basePath: resolveSkillsBase() }),
+  // Hot-reload SKILL.md edits in dev without a full re-scan.
+  checkSkillFileMtime: true,
+});
+
+const PREVIEW_BUILDER_PROMPT = `You write ONE React component file (TSX) and NOTHING else. It is rendered inside a real Vite + React + Tailwind v4 + shadcn/ui app, so you use the ACTUAL shadcn components — not hand-written HTML/CSS.
+
+BEFORE WRITING ANY CODE: call the \`skill\` tool with { "name": "shadcn" } to load the authoritative authoring rules — the exact import map, the ChartContainer/ChartConfig and DataTable/ColumnDef contracts, the react-hook-form+zod form pattern, and the specific type-error pitfalls. Follow those rules exactly; they are what make the component compile on the first try. Do this on every build (and again before any self-heal fix if it's no longer in context).
+
+OUTPUT RULES
+- Output ONLY the raw contents of a .tsx file. No markdown, no triple-backtick fences, no commentary before or after the code.
+- Provide exactly one component as the DEFAULT export, taking NO props: \`export default function Dashboard() { ... }\`.
+- Import shadcn components from "@/components/ui/<name>" using their real named exports. The full registry is available:
+    accordion, alert, alert-dialog, aspect-ratio, avatar, badge, breadcrumb, button, button-group, calendar, card, carousel, chart, checkbox, collapsible, combobox, command, context-menu, data-table, dialog, drawer, dropdown-menu, empty, field, hover-card, input, input-group, input-otp, item, kbd, label, menubar, native-select, navigation-menu, pagination, popover, progress, radio-group, resizable, scroll-area, select, separator, sheet, skeleton, slider, sonner, spinner, switch, table, tabs, textarea, toggle, toggle-group, tooltip
+  You may also import directly: react, recharts, @tanstack/react-table (type ColumnDef), react-hook-form, @hookform/resolvers/zod, zod, date-fns, sonner, lucide-react, and cn from "@/lib/utils".
+- Never import a name that isn't a real export, never import a CSS file, never write a <style> tag, raw <script>, runtime fetch, or any package not listed above. (The skill's import map has the exact export names per component — use it.)
+
+NON-NEGOTIABLE INVARIANTS (the skill explains each; never violate them)
+- Every chart wraps in <ChartContainer config={...} className="h-[280px] w-full"> with an EXPLICIT height, and you do NOT add your own <ResponsiveContainer>. ChartConfig keys match each series' dataKey; colors via var(--color-KEY).
+- For tabular data use <DataTable columns={columns} data={rows} />; define a Row type so ColumnDef<Row> accessorKeys are type-checked.
+- Every chart/table has realistic, internally-consistent inline data — NEVER an empty chart/table or "No data" placeholder. Use provided data if given; otherwise invent believable sample data; if you can't fill a section, omit it.
+
+LAYOUT & POLISH
+- Concise header (<h1> text-2xl font-semibold tracking-tight + a muted text-sm subtitle), a responsive KPI Card grid with tabular-nums figures, then charts/tables in Cards. Generous spacing, wrap in <div className="space-y-6">. Lean on the shadcn tokens (bg-card, text-muted-foreground, border) — calm and professional, no loud colored borders.`;
+
+export function createPreviewBuilderAgent() {
+  return new Agent({
+    id: "preview-builder",
+    name: "Preview Builder",
+    description:
+      "Turns a short brief (and optional inline data) into a complete, self-contained React component for live previews, built from the project's real shadcn/ui registry. Internal helper for the preview_app tool — not a user-facing conversational agent.",
+    instructions: PREVIEW_BUILDER_PROMPT,
+    // shadcn authoring rules come from the attached Agent Skill (foreman-qdna).
+    workspace: previewBuilderWorkspace,
+    // Haiku 4.5 — cheap, fast, strong at TSX. The whole point of this agent is to
+    // keep verbose component generation off the primary Sonnet model.
+    model: MODELS.fast,
+    defaultOptions: {
+      // Components (especially data dashboards) run long; the provider's default
+      // output cap can truncate mid-file. Give it real headroom. Low temperature
+      // keeps the markup stable and well-formed.
+      modelSettings: { maxOutputTokens: 16000, temperature: 0.3 },
+    },
+  });
+}
diff --git a/packages/agents/src/mastra/agents/supervisor.ts b/packages/agents/src/mastra/agents/supervisor.ts
index d35844bf..08be7f03 100644
--- a/packages/agents/src/mastra/agents/supervisor.ts
+++ b/packages/agents/src/mastra/agents/supervisor.ts
@@ -1,4 +1,5 @@
 import { Agent } from "@mastra/core/agent";
+import { fastembed } from "@mastra/fastembed";
 import { Memory } from "@mastra/memory";
 import { PgVector, PostgresStore } from "@mastra/pg";
 import { contextInjector, piiRedactor } from "../../lib/processors";
@@ -9,7 +10,7 @@ import {
   systemPromptFor,
 } from "../../lib/providers";
 
-const SUPERVISOR_PROMPT = `You are Foreman Supervisor, an AI assistant that helps users take actions across 9000+ apps via Zapier. You coordinate specialist agents to fulfill user requests.
+const SUPERVISOR_PROMPT = `You are Foreman Supervisor, an AI assistant that helps users take actions across 10,000+ apps via Zapier. You coordinate specialist agents to fulfill user requests.
 
 You have three specialist agents available as tools:
 - **agent-discovery**: Discovers connected apps, lists available actions, retrieves schemas and field choices. Use for any "what can I do?" or "what's connected?" questions.
@@ -65,7 +66,8 @@ export function createSupervisorAgent({
         id: "supervisor-memory-vector",
         connectionString: databaseUrl,
       }),
-      embedder: "openai/text-embedding-3-small",
+      // Local ONNX embedder (bge-small, 384-dim) — no OpenAI key/quota needed.
+      embedder: fastembed,
       options: {
         lastMessages: 20,
         workingMemory: { enabled: true },
diff --git a/packages/agents/src/mastra/agents/workspace.ts b/packages/agents/src/mastra/agents/workspace.ts
new file mode 100644
index 00000000..b5f6e23a
--- /dev/null
+++ b/packages/agents/src/mastra/agents/workspace.ts
@@ -0,0 +1,155 @@
+import path from "node:path";
+import { LocalFilesystem, LocalSandbox, Workspace } from "@mastra/core/workspace";
+import { resolveActiveWorkspace } from "../../lib/identity";
+import {
+  getKnowledgeVector,
+  knowledgeEmbedder,
+  knowledgeIndexName,
+} from "../../lib/knowledge/vector";
+import { requestUserContext } from "../../lib/request-user-context";
+
+/**
+ * Foreman's agent workspace — a per-tenant LocalFilesystem + LocalSandbox for
+ * file ops and command execution, plus a per-tenant semantic KNOWLEDGE index
+ * (foreman-aqjx). Scoped per tenant (foreman-jgme): each workspace_id gets its
+ * own `./data/workspace/<workspace_id>` directory and its own
+ * `knowledge_<workspace_id>` vector index.
+ *
+ * The whole Workspace is built PER REQUEST via `buildForemanWorkspace` (an Agent
+ * workspace resolver) rather than a single static instance, because the search
+ * index name must vary by tenant — one physical index per workspace IS the
+ * tenant isolation boundary for search (see lib/knowledge/vector.ts for why a
+ * shared index + metadata filter is unsafe with the built-in search tool).
+ * Construction is cheap: the vector store and embedder are shared singletons.
+ *
+ * Where workspace_id comes from (in priority order):
+ *  1. `RequestContext` — the web /chat route already resolves it and sets
+ *     `workspaceId` (mastra/index.ts), so no extra DB hit on that path.
+ *  2. `requestUserContext` (AsyncLocalStorage `{ userId }`) — every channel bot
+ *     wraps `agent.generate` in `requestUserContext.run({ userId })`, so the
+ *     resolver back-resolves the active workspace from the userId. Covers all
+ *     9 channels without editing each bot.
+ *  3. Fallback to a shared `_shared` dir/index when neither is present (e.g. the
+ *     proposals approve/decline path, which executes Zapier actions and does not
+ *     touch the workspace filesystem).
+ */
+const WORKSPACE_PATH = process.env.FOREMAN_WORKSPACE_PATH ?? "./data/workspace";
+const SHARED_DIR = "_shared";
+
+/** Defensive against path traversal — workspace ids are UUIDs in practice. */
+function sanitizeId(id: string): string {
+  return id.replace(/[^a-zA-Z0-9_-]/g, "");
+}
+
+/**
+ * The logical tenant key for the current request: a sanitized workspace_id, or
+ * the shared fallback. Scopes BOTH the filesystem directory and the knowledge
+ * index name so a workspace's files and their embeddings line up 1:1.
+ */
+export async function resolveWorkspaceTenantKey(requestContext?: {
+  get(key: string): unknown;
+}): Promise<string> {
+  let wsId = (requestContext?.get("workspaceId") as string | undefined) ?? undefined;
+  if (!wsId) {
+    const userId = requestUserContext.getStore()?.userId;
+    if (userId) {
+      wsId = (await resolveActiveWorkspace(userId).catch(() => null)) ?? undefined;
+    }
+  }
+  return wsId ? sanitizeId(wsId) : SHARED_DIR;
+}
+
+/** The per-tenant base directory for the current request. */
+async function resolveWorkspaceDir(requestContext?: {
+  get(key: string): unknown;
+}): Promise<string> {
+  return path.join(WORKSPACE_PATH, await resolveWorkspaceTenantKey(requestContext));
+}
+
+/**
+ * Resolve the per-tenant Workspace filesystem for the current request. Exported
+ * for the non-agent read/write paths (documents route, save_document, public
+ * document shares) that need file access without building a whole Workspace.
+ */
+export async function resolveWorkspaceFilesystem(requestContext?: {
+  get(key: string): unknown;
+}): Promise<LocalFilesystem> {
+  return new LocalFilesystem({
+    basePath: await resolveWorkspaceDir(requestContext),
+    contained: true,
+  });
+}
+
+/**
+ * Build the foreman agent's Workspace for one request. Attached to the agent as
+ * `workspace: buildForemanWorkspace`.
+ *
+ * Search is VECTOR-ONLY (`bm25` omitted): the workspace is rebuilt per request,
+ * so an in-memory BM25 index would always be empty, while vector results live in
+ * the persistent PgVector index. The auto-injected `mastra_workspace_index` tool
+ * is disabled — indexing happens server-side on save (save_document), keeping the
+ * index deterministic and preventing the LLM from polluting it.
+ */
+export async function buildForemanWorkspace({
+  requestContext,
+}: {
+  requestContext?: { get(key: string): unknown };
+}): Promise<Workspace> {
+  const tenantKey = await resolveWorkspaceTenantKey(requestContext);
+  const dir = path.join(WORKSPACE_PATH, tenantKey);
+  return new Workspace({
+    id: `foreman-workspace-${tenantKey}`,
+    name: "Foreman Workspace",
+    filesystem: new LocalFilesystem({ basePath: dir, contained: true }),
+    sandbox: new LocalSandbox({ workingDirectory: dir }),
+    vectorStore: getKnowledgeVector(),
+    embedder: knowledgeEmbedder,
+    searchIndexName: knowledgeIndexName(tenantKey),
+    tools: {
+      mastra_workspace_index: { enabled: false },
+      mastra_workspace_write_file: { requireApproval: true },
+      mastra_workspace_edit_file: { requireApproval: true },
+      mastra_workspace_delete: { requireApproval: true },
+      mastra_workspace_execute_command: { requireApproval: true },
+    },
+  });
+}
+
+/**
+ * A search-capable Workspace pointed at one tenant's knowledge index, keyed by
+ * `tenantKey` directly (no RequestContext). A Workspace requires a
+ * filesystem/sandbox/skills, so it gets the tenant's filesystem — unused by
+ * index/search themselves (those go through the vector store), it just satisfies
+ * the constructor and keeps the fs/index scoped to the same tenant. Used by the
+ * save-time indexer, the reindex backfill, and the E2E probe.
+ */
+export function buildTenantKnowledgeWorkspace(tenantKey: string): Workspace {
+  const dir = path.join(WORKSPACE_PATH, tenantKey);
+  return new Workspace({
+    id: `foreman-knowledge-${knowledgeIndexName(tenantKey)}`,
+    filesystem: new LocalFilesystem({ basePath: dir, contained: true }),
+    vectorStore: getKnowledgeVector(),
+    embedder: knowledgeEmbedder,
+    searchIndexName: knowledgeIndexName(tenantKey),
+  });
+}
+
+/**
+ * Index one SHARED knowledge document into its workspace's index via the native
+ * `Workspace.index` (reusing Mastra's embedding + upsert, so the same
+ * `mastra_workspace_search` tool retrieves it). Re-embeds the doc on each call —
+ * fine: fastembed is local (no API cost) and this runs only on an explicit save.
+ * Personal (`_private/`) docs are intentionally NOT indexed here — they would
+ * land in the same per-workspace index and become searchable by teammates
+ * (personal search is a per-user-index follow-up).
+ */
+export async function indexSharedDoc(args: {
+  tenantKey: string;
+  path: string;
+  content: string;
+  title: string;
+}): Promise<void> {
+  await buildTenantKnowledgeWorkspace(args.tenantKey).index(args.path, args.content, {
+    metadata: { title: args.title, path: args.path },
+  });
+}
diff --git a/packages/agents/src/mastra/index.ts b/packages/agents/src/mastra/index.ts
index c5fe0486..450c7d94 100644
--- a/packages/agents/src/mastra/index.ts
+++ b/packages/agents/src/mastra/index.ts
@@ -2,28 +2,27 @@ import { enableFileLogging } from "../lib/file-logger";
 
 enableFileLogging();
 
-import path from "node:path";
-import { fileURLToPath } from "node:url";
 import { toAISdkStream } from "@mastra/ai-sdk";
 import { Mastra } from "@mastra/core";
 import type { Agent } from "@mastra/core/agent";
 import { RequestContext } from "@mastra/core/request-context";
 import { registerApiRoute } from "@mastra/core/server";
-import { MastraCompositeStore } from "@mastra/core/storage";
-import { DuckDBStore } from "@mastra/duckdb";
 import { MastraEditor } from "@mastra/editor";
 import { PinoLogger } from "@mastra/loggers";
 import { ConsoleExporter, DefaultExporter, Observability } from "@mastra/observability";
 import { PostgresStore } from "@mastra/pg";
 import { createUIMessageStreamResponse, stepCountIs } from "ai";
-import type { MiddlewareHandler } from "hono";
+import { resolveActiveWorkspace, resolveFromRequest } from "../lib/identity";
 import { validateAgentCapabilities } from "../lib/providers";
 import { requestUserContext } from "../lib/request-user-context";
+import { dailyDigestWorkflow } from "../workflows/daily-digest";
+import { runAutomationWorkflow } from "../workflows/run-automation";
 import { webhookHandlerWorkflow } from "../workflows/webhook-handler";
 import { createDiscoveryAgent } from "./agents/discovery";
 import { createExecutionAgent } from "./agents/execution";
 import { createForemanAgent } from "./agents/foreman";
 import { createHistoryAgent } from "./agents/history";
+import { createPreviewBuilderAgent } from "./agents/preview-builder";
 import { createSupervisorAgent } from "./agents/supervisor";
 
 validateAgentCapabilities();
@@ -41,46 +40,21 @@ export function getMastra(): Mastra {
 
   const databaseUrl = process.env.DATABASE_URL!;
 
-  // Postgres handles every storage domain except observability — Mastra's
-  // observability domain (traces, metrics, logs, scores, feedback) needs an
-  // OLAP-capable backend. Per Mastra docs, Postgres/LibSQL are NOT supported
-  // for observability; DuckDB is the recommended local-dev backend (ClickHouse
-  // for production). Composite store routes the observability domain to
-  // DuckDB while leaving the rest on Postgres.
-  // Docs: https://mastra.ai/docs/observability/metrics/overview
-  const storage = new MastraCompositeStore({
+  // Postgres (Supabase) backs EVERY Mastra storage domain, including
+  // observability — @mastra/pg ships ObservabilityPG (mastra_ai_spans / scorers /
+  // etc.), and PostgresStore is itself a composite over all domains, so no wrapper
+  // and no separate OLAP backend is needed. (This previously routed observability
+  // to DuckDB; @mastra/pg now supports it natively → pure Postgres.)
+  const storage = new PostgresStore({
     id: "foreman-storage",
-    default: new PostgresStore({
-      id: "foreman-storage-pg",
-      connectionString: databaseUrl,
-    }),
-    domains: {
-      observability: new DuckDBStore({
-        // Resolve relative to THIS file's location, not process.cwd().
-        // `mastra dev` runs the bundled entry from .mastra/output/index.mjs
-        // with cwd set to src/mastra/public/ — using cwd would put the file
-        // there and (a) fail to find its dir on first boot, (b) lock the
-        // bundled-assets dir for the next build. import.meta.url is stable:
-        // - source path `src/mastra/index.ts` → ../../data/mastra.duckdb
-        //   under packages/agents/data/
-        // - bundled path `.mastra/output/index.mjs` → same destination
-        path:
-          process.env.DUCKDB_PATH ??
-          path.resolve(
-            path.dirname(fileURLToPath(import.meta.url)),
-            "..",
-            "..",
-            "data",
-            "mastra.duckdb",
-          ),
-      }).observability,
-    },
+    connectionString: databaseUrl,
   });
 
   const foremanAgent = createForemanAgent(databaseUrl);
   const discoveryAgent = createDiscoveryAgent();
   const executionAgent = createExecutionAgent();
   const historyAgent = createHistoryAgent();
+  const previewBuilderAgent = createPreviewBuilderAgent();
   const supervisorAgent = createSupervisorAgent({
     databaseUrl,
     discoveryAgent,
@@ -88,20 +62,45 @@ export function getMastra(): Mastra {
     historyAgent,
   });
 
-  const customMiddleware: MiddlewareHandler = async (c, next) => {
-    const { default: customRoutes } = await import("../routes");
-    const response = await customRoutes.fetch(c.req.raw);
-    if (response.status !== 404) {
-      return response;
-    }
-    await next();
-  };
+  // Prefixes owned by the custom Hono app (src/routes). Only these are routed
+  // through `customRoutes.fetch()`. Everything else (Mastra's own /chat,
+  // /api/*, /a2a/*, /mcp/*) falls straight through to `next()` WITHOUT touching
+  // the request body.
+  //
+  // Why this matters: a Web `Request` body is a single-read ReadableStream that
+  // a `.clone()` does NOT duplicate (clone shares the same underlying stream).
+  // The previous fall-through pattern — `customRoutes.fetch(c.req.raw)` on every
+  // request, then `next()` on 404 — consumed the POST body, so when Mastra
+  // dispatched a registered apiRoute (e.g. POST /chat/:agentId) its own
+  // `c.req.raw.clone().json()` read an already-exhausted stream and 500'd
+  // *before* the handler ran. Mastra's server.middleware contract is
+  // headers/context only — it must not read the body of requests it doesn't own.
+  const CUSTOM_ROUTE_PREFIXES = [
+    "/conversations",
+    "/proposals",
+    "/apps",
+    "/documents",
+    "/stored",
+    "/zapier",
+    "/oauth",
+    "/webhooks",
+    "/capabilities",
+    "/guardrails",
+    "/voice",
+    "/api-keys",
+    "/channel-links",
+    "/workspaces",
+    "/automations",
+    "/telegram",
+    "/slack",
+    "/discord",
+  ];
 
   // Observability is always on so the Mastra Studio Observability tab works.
   // OTEL_ENABLED=true additionally enables the OTEL Console exporter for local
   // span dumping; production typically only wants the DefaultExporter.
   // The `logging` block forwards PinoLogger calls into the observability log
-  // store (DuckDB) so Studio's Logs tab is populated by application logger
+  // store (Postgres) so Studio's Logs tab is populated by application logger
   // calls, not just Mastra-internal traces.
   // Docs: https://mastra.ai/docs/observability/logging
   const observability = new Observability({
@@ -149,6 +148,17 @@ export function getMastra(): Mastra {
     );
   }
 
+  // Attach token usage to the final assistant message so the web composer's
+  // context-usage gauge can read it client-side via `message.metadata.usage`.
+  // (toAISdkStream's messageMetadata hook — runs per UI-stream part.)
+  const usageMessageMetadata = ({ part }: { part: any }) => {
+    if (part?.type === "finish") {
+      const usage = part.totalUsage ?? part.usage;
+      if (usage) return { usage };
+    }
+    return undefined;
+  };
+
   _mastra = new Mastra({
     agents: {
       foreman: foremanAgent,
@@ -156,11 +166,21 @@ export function getMastra(): Mastra {
       execution: executionAgent,
       history: historyAgent,
       supervisor: supervisorAgent,
+      "preview-builder": previewBuilderAgent,
     },
     workflows: {
       webhookHandler: webhookHandlerWorkflow,
+      // Keys MUST match each workflow's own id — imperative schedules target them
+      // by id and the event dispatcher resolves by id first (foreman-bhb5).
+      "daily-digest": dailyDigestWorkflow,
+      "run-automation": runAutomationWorkflow,
     },
     storage,
+    // Enable the workflow cron scheduler. Digest schedules are managed
+    // imperatively (schedulesStore.createSchedule per workspace), so it must be
+    // explicitly enabled — there are no declarative `schedule` configs to
+    // auto-enable it. SchedulesPG (via the Postgres default store) backs it.
+    scheduler: { enabled: true },
     observability,
     editor,
     logger,
@@ -172,11 +192,52 @@ export function getMastra(): Mastra {
     // Docs: https://mastra.ai/docs/streaming/background-tasks
     backgroundTasks: {
       enabled: true,
+      // Bound concurrency and degrade safely: if the queue is saturated, run the
+      // tool synchronously in the agentic loop ('fallback-sync') rather than
+      // queueing it behind other work — chat must never stall on a full bg queue.
+      globalConcurrency: 10,
+      perAgentConcurrency: 5,
+      backpressure: "fallback-sync",
+      // Hard cap on a single task; the per-tool config can override (background.ts).
+      defaultTimeoutMs: 300_000,
+      // Reap finished task rows so the table doesn't grow unbounded.
+      cleanup: { completedTtlMs: 3_600_000, failedTtlMs: 86_400_000 },
+      // Observability for live verification (foreman-7am4) — terminal-state hooks.
+      onTaskComplete: (task) => console.log(`[bg-task] ✓ ${task.toolName} (${task.id}) completed`),
+      onTaskFailed: (task) =>
+        console.error(`[bg-task] ✗ ${task.toolName} (${task.id}) failed: ${task.error?.message}`),
     },
     server: {
       port: Number(process.env.PORT) || 4111,
       host: "0.0.0.0",
-      middleware: [customMiddleware],
+      // Inlined so Mastra's own Middleware type contextually types (c, next):
+      // @mastra/core vendors its own hono type snapshot, so annotating with a
+      // root-`hono` MiddlewareHandler isn't assignable here. Only pre-routes the
+      // path prefixes the custom Hono app owns; everything else falls through to
+      // Mastra with the request body intact (a Web Request body is single-read —
+      // see CUSTOM_ROUTE_PREFIXES above).
+      middleware: [
+        async (c, next) => {
+          const p = c.req.path;
+          const owned = CUSTOM_ROUTE_PREFIXES.some(
+            (prefix) => p === prefix || p.startsWith(`${prefix}/`),
+          );
+          if (!owned) {
+            await next();
+            return;
+          }
+          const { default: customRoutes } = await import("../routes");
+          return customRoutes.fetch(c.req.raw);
+        },
+      ],
+      // Mastra's default custom-route error handler swallows the error silently
+      // (returns "Internal Server Error" with no log). This surfaces the real
+      // error to the server console so failures are debuggable; the client still
+      // gets a generic message (no stack leak).
+      onError: (err: any, c: any) => {
+        console.error("[server.onError]", err?.message, "\n", err?.stack?.slice(0, 1200));
+        return c.json({ error: "Internal Server Error" }, 500);
+      },
       apiRoutes: [
         registerApiRoute("/chat/:agentId", {
           method: "POST",
@@ -189,13 +250,23 @@ export function getMastra(): Mastra {
               const agent = mastra.getAgent(agentId) as Agent;
               if (!agent) return c.json({ error: "Agent not found" }, 404);
 
+              // Derive the TRUSTED user identity from the request (Bearer token /
+              // API key) instead of trusting body.resourceId, which the client
+              // supplies and could spoof to act as another user (foreman-tss9). All
+              // HTTP callers of /chat authenticate; channels invoke the agent
+              // in-process, not via this route. body.resourceId is now ignored.
+              const identity = await resolveFromRequest(c.req.raw);
+              if (!identity) return c.json({ error: "Unauthorized" }, 401);
+
               if (body.approveRunId) {
                 const result = body.approved
                   ? await agent.approveToolCall({ runId: body.approveRunId })
                   : await agent.declineToolCall({ runId: body.approveRunId });
 
                 return createUIMessageStreamResponse({
-                  stream: fixApprovalStream(toAISdkStream(result, { from: "agent" })),
+                  stream: fixApprovalStream(
+                    toAISdkStream(result, { from: "agent", messageMetadata: usageMessageMetadata }),
+                  ),
                 });
               }
 
@@ -211,13 +282,57 @@ export function getMastra(): Mastra {
                     ? body.messages
                     : "";
 
-              const rid = body.resourceId || "";
+              // Forward image attachments (AI SDK v6 `file` parts carrying data
+              // URLs) so the vision model can actually see them. Without this the
+              // handler would drop everything except text.
+              const partsList: any[] = Array.isArray(lastMsg?.parts) ? lastMsg.parts : [];
+              const imageParts = partsList.filter(
+                (p: any) =>
+                  p?.type === "file" &&
+                  typeof p.url === "string" &&
+                  String(p.mediaType ?? p.contentType ?? "").startsWith("image/"),
+              );
+              const userContent: any =
+                imageParts.length > 0
+                  ? [
+                      ...imageParts.map((p: any) => {
+                        // Split the data URL ourselves and pass raw base64 + the
+                        // media type from the URL prefix. Passing the whole data
+                        // URL let the AI SDK default the type to image/jpeg, which
+                        // Anthropic rejects ("specified image/jpeg but the image
+                        // appears to be image/png").
+                        const url = String(p.url);
+                        const m = url.match(/^data:([^;,]+)(?:;base64)?,(.*)$/s);
+                        const mediaType = (
+                          m?.[1] ||
+                          p.mediaType ||
+                          p.contentType ||
+                          "image/png"
+                        ).trim();
+                        const image = m ? m[2] : url;
+                        return { type: "image" as const, image, mediaType };
+                      }),
+                      ...(text ? [{ type: "text" as const, text }] : []),
+                    ]
+                  : text;
+
+              // Trusted: comes from the validated token/key, not the request body.
+              const rid = identity.userId;
               const incomingTid = body.threadId || body.id;
 
               console.log(
                 `[chat] request agentId=${agentId} incomingTid=${incomingTid} rid=${rid || "(empty)"}`,
               );
 
+              // The resource the agent runs under (Mastra working memory +
+              // resource-scoped semantic recall are keyed on it). Defaults to the
+              // sender; for a teammate continuing a shared chat it's overridden to
+              // the THREAD OWNER below so the thread's context stays coherent
+              // (foreman-whkr). `attribution` prefixes a teammate's message so their
+              // authorship is visible in the shared thread.
+              let runResource = rid;
+              let attribution: string | null = null;
+
               // Look up mastra_thread_id from the conversation table so memory loads correctly.
               let tid: string;
               if (incomingTid) {
@@ -225,13 +340,50 @@ export function getMastra(): Mastra {
                 const supabase = getSupabase();
                 const { data: conv } = await supabase
                   .from("conversation")
-                  .select("mastra_thread_id")
+                  .select("mastra_thread_id, user_id, workspace_id, visibility")
                   .eq("id", incomingTid)
                   .limit(1)
                   .maybeSingle();
 
                 if (conv?.mastra_thread_id) {
                   tid = conv.mastra_thread_id;
+
+                  // Collaborative writing (foreman-whkr): if the sender is NOT the
+                  // chat's owner, allow the write only when the chat is shared to the
+                  // workspace AND the sender is a member — otherwise forbid. Run the
+                  // agent under the owner's resourceId (thread continuity) and tag the
+                  // teammate's message with their name so authorship is visible.
+                  const ownerId = conv.user_id as string | null;
+                  if (ownerId && rid && ownerId !== rid) {
+                    const member =
+                      conv.visibility === "workspace" && conv.workspace_id
+                        ? (
+                            await supabase
+                              .from("workspace_members")
+                              .select("workspace_member_id")
+                              .eq("workspace_id", conv.workspace_id)
+                              .eq("workspace_member_id", rid)
+                              .maybeSingle()
+                          ).data != null
+                        : false;
+                    if (!member) {
+                      console.warn(
+                        `[chat] forbidden write: rid=${rid} is not owner/member of conv=${incomingTid}`,
+                      );
+                      return c.json({ error: "Forbidden" }, 403);
+                    }
+                    runResource = ownerId;
+                    const { data: sender } = await supabase
+                      .from("user")
+                      .select("name, email")
+                      .eq("id", rid)
+                      .maybeSingle();
+                    attribution = sender?.name || sender?.email || "A teammate";
+                    console.log(
+                      `[chat] collaborative write by teammate rid=${rid} on owner=${ownerId} tid=${tid}`,
+                    );
+                  }
+
                   console.log(`[chat] found thread tid=${tid}`);
                 } else {
                   // No DB row yet — use incomingTid as the Mastra thread ID directly so the
@@ -272,22 +424,68 @@ export function getMastra(): Mastra {
                 console.log(`[chat] no incomingTid, using random tid=${tid}`);
               }
 
-              const rctx = new RequestContext([
+              const wsId = rid ? await resolveActiveWorkspace(rid).catch(() => null) : null;
+              const ctxEntries: Array<[string, string]> = [
                 ["threadId", tid],
                 ["userId", rid],
+              ];
+              if (wsId) ctxEntries.push(["workspaceId", wsId]);
+              const rctx = new RequestContext(ctxEntries);
+
+              // Per-request model override (the composer's model selector sends
+              // `model`). Allowlisted to Foreman-supported Anthropic models so a
+              // bad/cross-provider value can't break prompt/tool cache-control or
+              // route to an unknown model. Falls back to the agent's default.
+              const ALLOWED_CHAT_MODELS = new Set([
+                "anthropic/claude-sonnet-4-6",
+                "anthropic/claude-opus-4-6",
+                "anthropic/claude-haiku-4-5-20251001",
               ]);
+              const requestedModel =
+                typeof body.model === "string" && ALLOWED_CHAT_MODELS.has(body.model)
+                  ? body.model
+                  : undefined;
+              if (body.model && !requestedModel) {
+                console.warn(`[chat] ignoring unsupported model "${body.model}"`);
+              }
+
+              // Tag a teammate's message with their name so the shared thread shows
+              // who said what (foreman-whkr). Text-only is the common case; with
+              // image parts, prepend a label part.
+              let finalUserContent = userContent;
+              if (attribution) {
+                if (typeof finalUserContent === "string") {
+                  finalUserContent = `${attribution}: ${finalUserContent}`;
+                } else if (Array.isArray(finalUserContent)) {
+                  finalUserContent = [
+                    { type: "text" as const, text: `${attribution}:` },
+                    ...finalUserContent,
+                  ];
+                }
+              }
 
+              // streamUntilIdle (not stream): when a tool dispatches as a background
+              // task (foreman-7am4), keep the SSE open and re-enter the agentic loop
+              // on completion so the result folds into the SAME response instead of
+              // landing in next-turn memory. With no background task it behaves like
+              // stream() — closes as soon as the turn ends (and falls back to stream()
+              // entirely if the agent had no memory). maxIdleMs caps the between-turn
+              // wait. Same options + same MastraModelOutput, so toAISdkStream is unchanged.
               const result = await requestUserContext.run({ userId: rid }, () =>
-                agent.stream([{ role: "user" as const, content: text }], {
+                agent.streamUntilIdle([{ role: "user" as const, content: finalUserContent }], {
                   stopWhen: stepCountIs(15),
-                  memory: { thread: tid, resource: rid },
+                  memory: { thread: tid, resource: runResource },
                   savePerStep: true,
                   requestContext: rctx,
+                  maxIdleMs: 120_000,
+                  ...(requestedModel ? { model: requestedModel } : {}),
                 }),
               );
 
               return createUIMessageStreamResponse({
-                stream: fixApprovalStream(toAISdkStream(result, { from: "agent" })),
+                stream: fixApprovalStream(
+                  toAISdkStream(result, { from: "agent", messageMetadata: usageMessageMetadata }),
+                ),
               });
             } catch (err: any) {
               console.error("[chat] Error:", err?.message, err?.stack?.slice(0, 500));
diff --git a/packages/agents/src/mastra/signals/channel-trigger-provider.ts b/packages/agents/src/mastra/signals/channel-trigger-provider.ts
deleted file mode 100644
index 1403e8e2..00000000
--- a/packages/agents/src/mastra/signals/channel-trigger-provider.ts
+++ /dev/null
@@ -1,146 +0,0 @@
-/**
- * ChannelTriggerSignalProvider — a Mastra SignalProvider, hosted on the foreman
- * agent, that fires saved workflows when an inbound chat message matches a
- * `workflow_trigger` of type='channel'.
- *
- * Like the poll provider, it lives ON the agent (`signals: [...]`) so it's a
- * first-class Mastra primitive with `connect()`/`notify()`. It has no
- * `pollInterval` — it's event-driven: the channel webhook handlers call
- * `handleMessage()` on every inbound message (via the thin
- * `matchAndFireChannelTriggers` wrapper in workflows/channel-trigger.ts).
- *
- * Dedup (fixes foreman-tv5p): a retried webhook re-delivers the same message,
- * which previously fired the workflow twice. We derive a delivery key — the
- * caller-supplied `dedupeKey` (e.g. the platform message id) when available,
- * else a content hash of channel|room|from|text — and skip a trigger whose
- * persisted `last_dedupe_key` already equals it. The content-hash fallback
- * catches retries (identical content) but would also coalesce a user sending
- * the *exact same* text back-to-back; callers that pass a real message id avoid
- * that edge entirely (tracked as a follow-up).
- *
- * On a fresh fire we also drop a notification signal (native `dedupeKey`) into
- * the user's thread — additive and best-effort, never blocking the run.
- */
-
-import { createHash } from "node:crypto";
-import { SignalProvider } from "@mastra/core/signals";
-import { getSupabase } from "@/lib/db";
-import { executeWorkflow } from "@/lib/workflows/engine";
-import type { ChannelMessage } from "@/workflows/channel-trigger";
-
-interface ChannelTriggerRow {
-  id: string;
-  workflow_id: string;
-  config: string;
-  last_dedupe_key: string | null;
-}
-
-/** Strip leading `/` or `!` and trim — used for `match.command`. */
-function normalizeCommand(s: string): string {
-  return s.trim().replace(/^[/!]\s*/, "");
-}
-
-/** Stable delivery key for a message: the caller's id if given, else a content
- * hash. Identical (retried) deliveries produce the same key. */
-function deliveryKey(msg: ChannelMessage): string {
-  if (msg.dedupeKey) return msg.dedupeKey;
-  return createHash("sha1")
-    .update(`${msg.channel}|${msg.room ?? ""}|${msg.from}|${msg.text}`)
-    .digest("hex");
-}
-
-export class ChannelTriggerSignalProvider extends SignalProvider<"channel-trigger"> {
-  readonly id = "channel-trigger" as const;
-  readonly name = "Channel Trigger Signals";
-  // No pollInterval — event-driven via handleMessage().
-
-  /** Drop a best-effort notification into the user's thread on a fresh fire. */
-  private async notifyOwner(msg: ChannelMessage, userId: string, key: string): Promise<void> {
-    if (!this.agent) return;
-    try {
-      await this.notify(
-        {
-          source: "channel-trigger",
-          kind: msg.channel,
-          summary: `Workflow triggered by a ${msg.channel} message`,
-          payload: { from: msg.from, room: msg.room, text: msg.text },
-          dedupeKey: key,
-        },
-        { threadId: `channel:${msg.channel}:${msg.room ?? msg.from}`, resourceId: userId },
-      );
-    } catch (err) {
-      console.warn(`[channel-trigger] notify failed (${msg.channel}):`, err);
-    }
-  }
-
-  /**
-   * Match an inbound message against channel triggers and fire each match's
-   * workflow exactly once per delivery. Returns the number of workflows fired.
-   */
-  async handleMessage(msg: ChannelMessage): Promise<number> {
-    const supabase = getSupabase();
-    const { data: rows, error } = await supabase
-      .from("workflow_trigger")
-      .select("id, workflow_id, config, last_dedupe_key")
-      .eq("type", "channel")
-      .eq("enabled", true);
-    if (error) {
-      console.error(`[channel-trigger] fetch failed: ${error.message}`);
-      return 0;
-    }
-
-    const key = deliveryKey(msg);
-    let fired = 0;
-    for (const row of (rows ?? []) as unknown as ChannelTriggerRow[]) {
-      let cfg: { channel?: string; match?: { command?: string; from?: string; room?: string } };
-      try {
-        cfg = JSON.parse(row.config);
-      } catch {
-        continue;
-      }
-      if (cfg.channel !== msg.channel) continue;
-      const m = cfg.match ?? {};
-      if (m.command && normalizeCommand(msg.text) !== normalizeCommand(m.command)) continue;
-      if (m.from && !new RegExp(m.from).test(msg.from)) continue;
-      if (m.room && msg.room !== m.room) continue;
-
-      // Dedup: same delivery already fired this trigger → skip (retried webhook).
-      if (row.last_dedupe_key && row.last_dedupe_key === key) continue;
-
-      const { data: wf } = await supabase
-        .from("workflow")
-        .select("user_id")
-        .eq("id", row.workflow_id)
-        .maybeSingle();
-      if (!wf) continue;
-
-      const userId = wf.user_id as string;
-      const now = new Date().toISOString();
-      // Record the delivery key BEFORE firing so a concurrent retry can't race
-      // a second run in. last_fired_at doubles as the fire timestamp.
-      await supabase
-        .from("workflow_trigger")
-        .update({ last_dedupe_key: key, last_fired_at: now, updated_at: now })
-        .eq("id", row.id);
-
-      try {
-        for await (const ev of executeWorkflow(row.workflow_id, userId, {}, undefined, {
-          firedBy: "channel",
-          triggerId: row.id,
-        })) {
-          if (ev.type === "error") {
-            console.warn(`[channel-trigger] ${row.id} workflow error: ${ev.message}`);
-          }
-        }
-        fired++;
-        await this.notifyOwner(msg, userId, key);
-      } catch (err) {
-        console.error(`[channel-trigger] trigger ${row.id} failed:`, err);
-      }
-    }
-    return fired;
-  }
-}
-
-/** Singleton hosted on the foreman agent (`signals: [...]`). */
-export const channelTriggerProvider = new ChannelTriggerSignalProvider();
diff --git a/packages/agents/src/mastra/signals/zapier-poll-provider.ts b/packages/agents/src/mastra/signals/zapier-poll-provider.ts
deleted file mode 100644
index d393651f..00000000
--- a/packages/agents/src/mastra/signals/zapier-poll-provider.ts
+++ /dev/null
@@ -1,287 +0,0 @@
-/**
- * ZapierPollSignalProvider — a Mastra SignalProvider that watches Zapier read
- * actions and fires saved workflows when new records appear.
- *
- * This lives ON the foreman agent (`signals: [zapierPollProvider]`), so it's a
- * first-class Mastra primitive — not a worker bolted onto the side. Hosting it
- * on the agent gives us `notify()`: when a poll turns up new data we drop a
- * notification signal (with the framework's native `dedupeKey`) into the user's
- * thread, so they *see* "new record → ran your workflow."
- *
- * Why we DON'T set `pollInterval`: the foreman agent is constructed in every
- * Foreman process (the :4111 server AND the :4112 webhook server build it via
- * the channel bots). If the provider auto-polled, it would fire in each process
- * — the same double-fire the cron driver avoids by running a single dedicated
- * instance. Instead we leave `pollInterval` undefined (no framework auto-poll)
- * and drive `runDuePolls()` from the single `cron-driver-server` process. One
- * Mastra app, the provider lives in the agent, one process ticks it.
- *
- * Firing stays deterministic: `runDuePolls()` runs the Zapier read via
- * `runAction`, diffs results against the persisted `last_dedupe_key` cursor, and
- * fires `executeWorkflow` once per new record — no LLM in the hot path. The
- * `notify()` call is best-effort and additive (skipped if no agent is connected
- * or the notification store is unavailable), so a notification hiccup never
- * blocks a workflow run.
- *
- * Config (workflow_trigger.config for type='poll'):
- *   { app, action, connection?, inputs?, dedupeKey, intervalMinutes? }
- * Reads are assumed newest-first (the Zapier "new X" convention). First poll
- * establishes a baseline (sets the cursor, fires nothing) so binding a trigger
- * doesn't replay the whole backlog.
- */
-
-import { SignalProvider } from "@mastra/core/signals";
-import { getSupabase } from "@/lib/db";
-import { executeWorkflow } from "@/lib/workflows/engine";
-import { runAction } from "@/lib/zapier/execution";
-
-/** Cap on how many backlog records a single poll will fire, to avoid a flood if
- * the cursor falls off the end of the returned page. */
-const MAX_FIRE_PER_POLL = 25;
-
-interface PollConfig {
-  app: string;
-  action: string;
-  connection?: string;
-  inputs?: Record<string, unknown>;
-  /** Field on each record that uniquely identifies it (e.g. "id"). */
-  dedupeKey: string;
-  /** How often to poll, in minutes. Defaults to 5. */
-  intervalMinutes?: number;
-}
-
-interface PollTriggerRow {
-  id: string;
-  workflow_id: string;
-  config: string;
-  last_fired_at: string | null;
-  last_dedupe_key: string | null;
-}
-
-/** Normalize a Zapier read result into an array of record objects. Handles the
- * common shapes: a bare array, `{ data: [...] }`, or `{ results: [...] }`. */
-function extractRecords(result: unknown): Record<string, unknown>[] {
-  if (Array.isArray(result)) return result as Record<string, unknown>[];
-  if (result && typeof result === "object") {
-    const obj = result as Record<string, unknown>;
-    if (Array.isArray(obj.data)) return obj.data as Record<string, unknown>[];
-    if (Array.isArray(obj.results)) return obj.results as Record<string, unknown>[];
-  }
-  return [];
-}
-
-/** Stable string key for a record, read from the configured dedupeKey field. */
-function recordKey(rec: Record<string, unknown>, dedupeKey: string): string | null {
-  const v = rec[dedupeKey];
-  if (v === undefined || v === null) return null;
-  return String(v);
-}
-
-/**
- * Records strictly newer than the cursor, newest-first. Walks the page from the
- * top until it hits the cursor key; if the cursor isn't on the page (it scrolled
- * off, or this is a fresh page), every record counts as new (capped).
- */
-function collectNewRecords(
-  records: Record<string, unknown>[],
-  dedupeKey: string,
-  cursorKey: string | null,
-): Record<string, unknown>[] {
-  const fresh: Record<string, unknown>[] = [];
-  for (const rec of records) {
-    if (recordKey(rec, dedupeKey) === cursorKey) break;
-    fresh.push(rec);
-    if (fresh.length >= MAX_FIRE_PER_POLL) break;
-  }
-  return fresh;
-}
-
-/** Flatten a record's primitive fields to string inputs for {{param}}
- * substitution, plus the full record as JSON under `record`. */
-function recordToInputs(rec: Record<string, unknown>): Record<string, string> {
-  const out: Record<string, string> = {};
-  for (const [k, v] of Object.entries(rec)) {
-    if (v === null || v === undefined) continue;
-    if (typeof v === "object") continue;
-    out[k] = String(v);
-  }
-  out.record = JSON.stringify(rec);
-  return out;
-}
-
-export class ZapierPollSignalProvider extends SignalProvider<"zapier-poll"> {
-  readonly id = "zapier-poll" as const;
-  readonly name = "Zapier Poll Signals";
-  // No `pollInterval` — see the file header. Driven by cron-driver-server.
-
-  /**
-   * Drop a notification signal into the workflow owner's thread. Best-effort:
-   * the workflow fire is the primary action, so a missing agent connection or
-   * notification-store error must never block it.
-   */
-  private async notifyOwner(
-    triggerId: string,
-    cfg: PollConfig,
-    userId: string,
-    rec: Record<string, unknown>,
-    key: string | null,
-  ): Promise<void> {
-    if (!this.agent) return; // not connected (e.g. unit test, or non-worker process)
-    try {
-      await this.notify(
-        {
-          source: "zapier-poll",
-          kind: `${cfg.app}.${cfg.action}`,
-          summary: `New ${cfg.app} ${cfg.action}${key ? ` (${key})` : ""}`,
-          payload: rec,
-          // Native dedup — the same record key won't create a duplicate
-          // notification even if a re-poll surfaces it again.
-          dedupeKey: key ?? undefined,
-        },
-        { threadId: `poll:${triggerId}`, resourceId: userId },
-      );
-    } catch (err) {
-      console.warn(`[zapier-poll] notify failed for trigger ${triggerId}:`, err);
-    }
-  }
-
-  /**
-   * Process one poll trigger: run its read action, diff against the cursor, fire
-   * the workflow for each new record, notify the owner's thread, and advance the
-   * cursor. Returns the number of workflow runs fired.
-   */
-  private async pollOne(
-    row: PollTriggerRow,
-    cfg: PollConfig,
-    userId: string,
-    nowIso: string,
-  ): Promise<number> {
-    const supabase = getSupabase();
-
-    const result = await runAction(
-      userId,
-      cfg.app,
-      "read",
-      cfg.action,
-      cfg.inputs ?? {},
-      cfg.connection,
-    );
-
-    // A guardrail may demand confirmation — we can't fire autonomously then.
-    if (result && typeof result === "object" && "__guardrail_confirmation_required" in result) {
-      console.warn(`[zapier-poll] ${row.id} read needs confirmation — skipping this cycle`);
-      return 0;
-    }
-
-    const records = extractRecords(result);
-    const cursorKey = row.last_dedupe_key ?? null;
-    const newestKey = records.length ? recordKey(records[0], cfg.dedupeKey) : cursorKey;
-
-    // Advance the cursor + mark polled even when nothing is new, so the interval
-    // gate and baseline both work off last_fired_at / last_dedupe_key.
-    await supabase
-      .from("workflow_trigger")
-      .update({ last_dedupe_key: newestKey, last_fired_at: nowIso, updated_at: nowIso })
-      .eq("id", row.id);
-
-    // First poll: establish the baseline, don't replay the backlog.
-    if (cursorKey === null) return 0;
-
-    const fresh = collectNewRecords(records, cfg.dedupeKey, cursorKey);
-    if (fresh.length === 0) return 0;
-
-    let fired = 0;
-    // Fire oldest-first so the workflow sees records in chronological order.
-    for (const rec of fresh.reverse()) {
-      const key = recordKey(rec, cfg.dedupeKey);
-      try {
-        for await (const ev of executeWorkflow(
-          row.workflow_id,
-          userId,
-          recordToInputs(rec),
-          undefined,
-          {
-            firedBy: "poll",
-            triggerId: row.id,
-          },
-        )) {
-          if (ev.type === "error") {
-            console.warn(`[zapier-poll] ${row.id} workflow error: ${ev.message}`);
-          } else if (ev.type === "param_request") {
-            console.warn(
-              `[zapier-poll] ${row.id} workflow needs params not in the record: ${ev.missing?.join(", ")}`,
-            );
-          }
-        }
-        fired++;
-        // Additive: surface the fire in the owner's thread via the signal.
-        await this.notifyOwner(row.id, cfg, userId, rec, key);
-      } catch (err) {
-        console.error(`[zapier-poll] ${row.id} fire failed:`, err);
-      }
-    }
-    return fired;
-  }
-
-  /**
-   * Run every due poll trigger once. Called by cron-driver-server on its tick.
-   * Exported behavior mirrors the cron driver's `tickCron`.
-   */
-  async runDuePolls(now: Date = new Date()): Promise<{ fired: number; polled: number }> {
-    const supabase = getSupabase();
-    const nowIso = now.toISOString();
-
-    const { data: rows, error } = await supabase
-      .from("workflow_trigger")
-      .select("id, workflow_id, config, last_fired_at, last_dedupe_key")
-      .eq("type", "poll")
-      .eq("enabled", true);
-    if (error) throw new Error(`zapier-poll: ${error.message}`);
-
-    let fired = 0;
-    let polled = 0;
-    for (const row of (rows ?? []) as unknown as PollTriggerRow[]) {
-      let cfg: PollConfig;
-      try {
-        cfg = JSON.parse(row.config);
-      } catch {
-        console.warn(`[zapier-poll] trigger ${row.id} has invalid config — skipping`);
-        continue;
-      }
-      if (!cfg.app || !cfg.action || !cfg.dedupeKey) {
-        console.warn(`[zapier-poll] trigger ${row.id} missing app/action/dedupeKey — skipping`);
-        continue;
-      }
-
-      // Interval gate — only hit the Zapier action once per intervalMinutes.
-      const intervalMs = Math.max(1, cfg.intervalMinutes ?? 5) * 60_000;
-      if (row.last_fired_at) {
-        const elapsed = now.getTime() - new Date(row.last_fired_at).getTime();
-        if (elapsed < intervalMs) continue;
-      }
-
-      // Resolve the workflow owner so runAction/executeWorkflow run as that user.
-      const { data: wf } = await supabase
-        .from("workflow")
-        .select("user_id")
-        .eq("id", row.workflow_id)
-        .maybeSingle();
-      if (!wf) {
-        console.warn(`[zapier-poll] trigger ${row.id} → workflow ${row.workflow_id} missing`);
-        continue;
-      }
-
-      polled++;
-      try {
-        fired += await this.pollOne(row, cfg, wf.user_id as string, nowIso);
-      } catch (err) {
-        console.error(`[zapier-poll] trigger ${row.id} failed:`, err);
-      }
-    }
-    return { fired, polled };
-  }
-}
-
-/** Singleton hosted on the foreman agent (`signals: [...]`) and driven by the
- * cron-driver-server worker. */
-export const zapierPollProvider = new ZapierPollSignalProvider();
diff --git a/packages/agents/src/mastra/tools/attach-trigger.ts b/packages/agents/src/mastra/tools/attach-trigger.ts
deleted file mode 100644
index a367318f..00000000
--- a/packages/agents/src/mastra/tools/attach-trigger.ts
+++ /dev/null
@@ -1,137 +0,0 @@
-import { createTool } from "@mastra/core/tools";
-import { z } from "zod";
-import { getSupabase } from "@/lib/db";
-
-/**
- * Per-type config schemas. Stored as JSON in workflow_trigger.config.
- *
- * cron — fired on a schedule by the cron driver process.
- * channel — matched in-line by channel webhook handlers when a message arrives.
- * poll — deferred; will diff a Zapier read action's results against dedupeKey.
- */
-const cronConfig = z.object({
-  schedule: z
-    .string()
-    .min(1)
-    .describe("5-field cron expression (UTC unless timezone is set). e.g. '0 9 * * 1-5'"),
-  timezone: z.string().optional().describe("IANA timezone, e.g. 'America/Los_Angeles'."),
-});
-
-const channelConfig = z.object({
-  channel: z
-    .enum(["slack", "discord", "telegram", "linear", "github", "gchat", "teams", "whatsapp"])
-    .describe("Which chat channel emits the event."),
-  match: z
-    .object({
-      command: z
-        .string()
-        .optional()
-        .describe("Exact command/message-prefix to match (e.g. '!standup')."),
-      from: z.string().optional().describe("Optional regex on sender id/handle."),
-      room: z.string().optional().describe("Optional channel/room/DM target."),
-    })
-    .describe("Match criteria for the incoming message."),
-});
-
-const pollConfig = z.object({
-  app: z.string().min(1).describe("Zapier app key, e.g. 'gmail' or 'google_sheets'."),
-  action: z
-    .string()
-    .min(1)
-    .describe("The read action key, e.g. 'new_email' or 'new_or_updated_spreadsheet_row'."),
-  connection: z
-    .string()
-    .optional()
-    .describe("Connection id/alias. Auto-discovered for the app if omitted."),
-  inputs: z
-    .record(z.string(), z.unknown())
-    .optional()
-    .describe("Inputs passed to the read action (e.g. { sheet: '...' })."),
-  dedupeKey: z
-    .string()
-    .min(1)
-    .describe(
-      "Field on each returned record that uniquely identifies it (e.g. 'id'). " +
-        "Records are assumed newest-first; new records are those above the last-seen value.",
-    ),
-  intervalMinutes: z
-    .number()
-    .int()
-    .min(1)
-    .optional()
-    .default(5)
-    .describe("How often to poll, in minutes (default 5)."),
-});
-
-export const attachTriggerTool = createTool({
-  id: "attach_trigger",
-  strict: true,
-  description:
-    "Bind a saved workflow to an event source so it fires automatically. " +
-    "Three trigger types are supported: 'cron' for scheduled runs (e.g. every " +
-    "weekday at 9am), 'channel' for chat-message matches (e.g. when you DM " +
-    "'!standup' on Slack), and 'poll' to fire when a Zapier read action returns " +
-    "a new record (e.g. a new Gmail email or spreadsheet row). Use after " +
-    "`save_workflow` and after the user confirms the schedule, match, or poll " +
-    "source.",
-  inputSchema: z.object({
-    workflowId: z.string().describe("The workflow id (from list_workflows)."),
-    type: z.enum(["cron", "channel", "poll"]).describe("Trigger kind."),
-    cron: cronConfig.optional().describe("Required when type='cron'."),
-    channel: channelConfig.optional().describe("Required when type='channel'."),
-    poll: pollConfig.optional().describe("Required when type='poll'."),
-    enabled: z
-      .boolean()
-      .optional()
-      .default(true)
-      .describe("Set false to register the trigger paused."),
-  }),
-  outputSchema: z.object({
-    id: z.string(),
-    type: z.enum(["cron", "channel", "poll"]),
-    enabled: z.boolean(),
-  }),
-  // Attaching a cron / channel trigger means a workflow may fire without
-  // further user input. Confirm before binding.
-  requireApproval: true,
-  onOutput: ({ output, toolName }) => {
-    const o = output as { id?: string; type?: string };
-    console.log(`[tool:${toolName}] attached ${o.type} trigger ${o.id?.slice(0, 8)}`);
-  },
-  execute: async ({ workflowId, type, cron, channel, poll, enabled }, context) => {
-    const userId = context?.requestContext?.get("userId") as string | undefined;
-    if (!userId) throw new Error("attach_trigger: no userId in request context");
-
-    const config = type === "cron" ? cron : type === "channel" ? channel : poll;
-    if (!config) {
-      throw new Error(`attach_trigger: type='${type}' requires the matching '${type}' field`);
-    }
-
-    const supabase = getSupabase();
-
-    // Ownership check — keep parity with the route
-    const { data: wf } = await supabase
-      .from("workflow")
-      .select("id")
-      .eq("id", workflowId)
-      .eq("user_id", userId)
-      .limit(1)
-      .maybeSingle();
-    if (!wf) throw new Error(`attach_trigger: workflow ${workflowId} not found`);
-
-    const id = crypto.randomUUID();
-    const now = new Date().toISOString();
-    const { error } = await supabase.from("workflow_trigger").insert({
-      id,
-      workflow_id: workflowId,
-      type,
-      config: JSON.stringify(config),
-      enabled: enabled ?? true,
-      created_at: now,
-      updated_at: now,
-    });
-    if (error) throw new Error(`attach_trigger: ${error.message}`);
-
-    return { id, type, enabled: enabled ?? true };
-  },
-});
diff --git a/packages/agents/src/mastra/tools/automations.ts b/packages/agents/src/mastra/tools/automations.ts
new file mode 100644
index 00000000..dfffc333
--- /dev/null
+++ b/packages/agents/src/mastra/tools/automations.ts
@@ -0,0 +1,195 @@
+import { createTool } from "@mastra/core/tools";
+import { z } from "zod";
+import {
+  inspectForUser,
+  listForUser,
+  provisionAutomation,
+  runAutomationById,
+} from "../../lib/automations/service";
+
+/**
+ * Agent-facing tools for durable automations (foreman-l7xq). The agent authors
+ * the durable `source` from the user's intent (per the Zapier durable format);
+ * these deploy / run / list / inspect it through lib/automations/service, which
+ * deploys to Zapier (M1) AND persists the automation as a workspace-shared
+ * resource (M2). create + run create real cloud state, so they require approval.
+ * list/inspect read the workspace's automations from Foreman's store, keyed by
+ * the Foreman automation id.
+ */
+
+const triggerSchema = z
+  .object({
+    app: z
+      .string()
+      .describe("Zapier app key/slug for the trigger, e.g. 'github' or 'google-sheets'."),
+    action: z.string().describe("Trigger key, e.g. 'new_issue' / 'new_row'."),
+    connection: z
+      .union([z.string(), z.number()])
+      .nullable()
+      .optional()
+      .describe("Connection id backing the trigger."),
+    inputs: z
+      .record(z.string(), z.unknown())
+      .optional()
+      .describe("Trigger input fields, e.g. { repo: 'owner/name' }."),
+  })
+  .describe(
+    "A trigger-inbox subscription that fires this automation; omit for manual/webhook automations. The worker leases this inbox and fires the durable.",
+  );
+
+const scheduleSchema = z
+  .object({
+    cron: z
+      .string()
+      .describe(
+        "A cron expression (5-part) — e.g. '0 9 * * *' (every day 9am), '*/15 * * * *' (every 15 min), '0 9 * * 1' (Mondays 9am). Times are in `timezone`.",
+      ),
+    timezone: z
+      .string()
+      .optional()
+      .describe("IANA timezone for the cron, e.g. 'America/New_York'. Defaults to UTC."),
+  })
+  .describe(
+    "Fire this automation on a cron cadence instead of on an event. Mastra's scheduler owns the firing. Mutually exclusive with `trigger`.",
+  );
+
+export const createAutomationTool = createTool({
+  id: "create_automation",
+  requireApproval: true,
+  description:
+    "Deploy a durable Zapier automation the user described, as a shared workspace automation. You author the " +
+    "durable workflow.ts `source` (createZapierSdk() at module scope, one sdk.runAction per ctx.step, " +
+    "defineDurable(...) + export default); this creates + publishes it on Zapier and records it in the workspace. " +
+    "Provide a `connections` map (alias → connection id) for every alias the source references. Choose ONE trigger: " +
+    "`trigger` (an app/action trigger-inbox subscription) for event-driven; `schedule` (a cron expression) for a " +
+    "recurring cadence ('every morning at 9' → cron '0 9 * * *'); or omit both for manual/webhook. For a scheduled " +
+    "DIGEST that summarizes recent automation activity into the inbox, pass `schedule` + `digest:true` and OMIT " +
+    "`source` (a Mastra workflow synthesizes it — no durable). Returns the Foreman automation `id` + editor link.",
+  inputSchema: z.object({
+    userId: z.string().describe("The user whose Zapier connection deploys the automation."),
+    name: z.string().describe("Human-readable automation name."),
+    description: z.string().optional(),
+    source: z
+      .string()
+      .optional()
+      .describe(
+        "The durable workflow.ts source — defineDurable(name, async (ctx, input) => {...}) + export default. Omit ONLY for a digest (digest:true).",
+      ),
+    connections: z
+      .record(z.string(), z.union([z.string(), z.number()]))
+      .optional()
+      .describe("Connection alias → connection id, for every alias the source references."),
+    trigger: triggerSchema.optional(),
+    schedule: scheduleSchema.optional(),
+    digest: z
+      .boolean()
+      .optional()
+      .describe(
+        "With `schedule`, makes this a daily digest of recent activity (no durable source).",
+      ),
+    enabled: z.boolean().optional().default(true),
+    isPrivate: z.boolean().optional().default(true),
+  }),
+  outputSchema: z.object({
+    id: z.string(),
+    workflowId: z.string(),
+    versionId: z.string(),
+    enabled: z.boolean(),
+    isPrivate: z.boolean(),
+    editorUrl: z.string(),
+    triggerUrl: z.string(),
+    triggerClaimFailed: z.boolean(),
+    disabledReason: z.string().nullable().optional(),
+  }),
+  toModelOutput: (output) => ({
+    type: "text" as const,
+    text: JSON.stringify({
+      id: output.id,
+      enabled: output.enabled,
+      editorUrl: output.editorUrl,
+      ...(output.triggerClaimFailed
+        ? {
+            warning: "trigger did not claim — workflow is disabled",
+            disabledReason: output.disabledReason,
+          }
+        : {}),
+    }),
+  }),
+  execute: async ({
+    userId,
+    name,
+    description,
+    source,
+    connections,
+    trigger,
+    schedule,
+    digest,
+    enabled,
+    isPrivate,
+  }) =>
+    provisionAutomation({
+      userId,
+      name,
+      description,
+      source,
+      connections,
+      trigger,
+      schedule,
+      digest,
+      enabled,
+      isPrivate,
+    }),
+});
+
+export const runAutomationTool = createTool({
+  id: "run_automation",
+  requireApproval: true,
+  description:
+    "Manually fire a workspace automation by its Foreman automation id and return the trigger/run status, " +
+    "recording the run. Side effects in connected apps will happen.",
+  inputSchema: z.object({
+    userId: z.string(),
+    automationId: z.string().describe("The Foreman automation id (from list/create)."),
+    input: z.record(z.string(), z.unknown()).optional().describe("Input payload for the run."),
+  }),
+  outputSchema: z.object({
+    runId: z.string(),
+    triggerId: z.string(),
+    status: z.string(),
+    durableRunId: z.string().nullable(),
+  }),
+  execute: async ({ userId, automationId, input }) => {
+    const result = await runAutomationById(userId, automationId, input);
+    if (!result) throw new Error("Automation not found in this workspace");
+    return result;
+  },
+});
+
+export const listAutomationsTool = createTool({
+  id: "list_automations",
+  description:
+    "List the workspace's durable automations (id, name, enabled, status, editor link). Read-only.",
+  inputSchema: z.object({ userId: z.string() }),
+  outputSchema: z.object({ automations: z.array(z.unknown()) }),
+  execute: async ({ userId }) => ({ automations: await listForUser(userId) }),
+});
+
+export const inspectAutomationTool = createTool({
+  id: "inspect_automation",
+  description:
+    "Inspect one workspace automation by its Foreman id: its stored definition/trigger state plus recent run history. Read-only.",
+  inputSchema: z.object({
+    userId: z.string(),
+    automationId: z.string(),
+    maxRuns: z.number().optional().default(10),
+  }),
+  outputSchema: z.object({
+    automation: z.unknown(),
+    runs: z.array(z.unknown()),
+  }),
+  execute: async ({ userId, automationId, maxRuns }) => {
+    const result = await inspectForUser(userId, automationId, maxRuns);
+    if (!result) throw new Error("Automation not found in this workspace");
+    return result;
+  },
+});
diff --git a/packages/agents/src/mastra/tools/connect-zapier.ts b/packages/agents/src/mastra/tools/connect-zapier.ts
index eaf838be..262e87d3 100644
--- a/packages/agents/src/mastra/tools/connect-zapier.ts
+++ b/packages/agents/src/mastra/tools/connect-zapier.ts
@@ -1,6 +1,8 @@
 import { createTool } from "@mastra/core/tools";
 import { createZapierSdk } from "@zapier/zapier-sdk";
 import { z } from "zod";
+import { onZapierSdkEvent } from "../../lib/zapier/deprecation";
+import { getSdkForUser } from "../../lib/zapier/sdk";
 
 const ZAPIER_CONNECTIONS_PAGE = "https://zapier.com/app/connections";
 
@@ -8,11 +10,52 @@ const ZAPIER_CONNECTIONS_PAGE = "https://zapier.com/app/connections";
  * Build the deep-link URL that opens Zapier's OAuth flow for a specific app.
  * Uses the SDK's `implementation_id` (e.g. "GoogleMailV2CLIAPI@2.8.3") which
  * is Zapier's internal app identifier.
+ *
+ * This is the fallback path. When the user already has a Zapier identity, we
+ * prefer the SDK's `getConnectionStartUrl` (signed, account-bound, expiring)
+ * instead — see `signedConnectUrl` below.
  */
 function authStartUrl(implementationId: string): string {
   return `https://zapier.com/engine/auth/start/${implementationId}/`;
 }
 
+type AppMatch = { key?: string; slug?: string; title?: string; implementation_id?: string };
+
+/**
+ * Mint Zapier's official signed connection-start URL for a connected user
+ * (SDK >= 0.71 `getConnectionStartUrl`). The URL is bound to the user's Zapier
+ * account and signed, so it drops the user straight into connecting this app —
+ * no generic "find the app yourself" page. Returns undefined when there's no
+ * userId in context or the user isn't connected yet (caller falls back to the
+ * generic engine deep-link).
+ */
+async function signedConnectUrl(
+  context: { requestContext?: { get(key: string): unknown } } | undefined,
+  app: AppMatch,
+  appSlug: string,
+) {
+  const userId = context?.requestContext?.get("userId") as string | undefined;
+  if (!userId) return undefined;
+  try {
+    const sdk = await getSdkForUser(userId);
+    const appKey = app.key ?? app.slug ?? appSlug;
+    const { data } = await sdk.getConnectionStartUrl({ app: appKey });
+    if (!data?.url) return undefined;
+    const name = app.title ?? app.slug ?? appSlug;
+    return {
+      connectUrl: data.url,
+      appName: name,
+      expiresAt: data.expiresAt,
+      message:
+        `Click the link to connect ${name} on Zapier — it's a secure link tied to your ` +
+        "account and expires in a few minutes. Once connected, come back and I'll complete your request.",
+    };
+  } catch {
+    // ZapierNotConnected (no account linked yet) or any SDK error → fall back.
+    return undefined;
+  }
+}
+
 /**
  * Pick the canonical match from listApps results. Zapier's search is a
  * substring match — querying "notion" returns "Fitness Nation" first and
@@ -37,7 +80,6 @@ function pickExactApp<T extends { slug?: string; key?: string; title?: string }>
 
 export const connectZapierTool = createTool({
   id: "connect_zapier",
-  strict: true,
   description:
     "Generate a URL the user can click to connect an app on Zapier. " +
     "If appSlug is provided (e.g. 'gmail', 'slack', 'notion'), returns the " +
@@ -87,18 +129,24 @@ export const connectZapierTool = createTool({
     });
 
     try {
-      const sdk = createZapierSdk();
+      const sdk = createZapierSdk({ onEvent: onZapierSdkEvent });
       // Pull a wider candidate set — Zapier's search uses substring matching
       // and can bury exact-name apps (e.g. "gmail" returns "Acelle Mail" in
       // the first 10 results, with the actual Gmail beyond position 10).
       const { data: apps } = await sdk.listApps({ search: appSlug, maxItems: 50 });
       const app = pickExactApp(apps ?? [], appSlug);
-      if (app?.implementation_id) {
-        return {
-          connectUrl: authStartUrl(app.implementation_id),
-          appName: app.title ?? app.slug ?? appSlug,
-          message: `Click the link to connect ${app.title ?? app.slug ?? appSlug} on Zapier. Once connected, come back and I'll complete your request.`,
-        };
+      if (app) {
+        // Prefer the SDK's signed, account-bound connect URL for connected users.
+        const signed = await signedConnectUrl(context, app, appSlug);
+        if (signed) return signed;
+        // Fall back to the generic engine deep-link (works without a linked account).
+        if (app.implementation_id) {
+          return {
+            connectUrl: authStartUrl(app.implementation_id),
+            appName: app.title ?? app.slug ?? appSlug,
+            message: `Click the link to connect ${app.title ?? app.slug ?? appSlug} on Zapier. Once connected, come back and I'll complete your request.`,
+          };
+        }
       }
     } catch {
       // Fall through to the generic page below.
diff --git a/packages/agents/src/mastra/tools/create-dashboard.ts b/packages/agents/src/mastra/tools/create-dashboard.ts
new file mode 100644
index 00000000..57832eaa
--- /dev/null
+++ b/packages/agents/src/mastra/tools/create-dashboard.ts
@@ -0,0 +1,86 @@
+import { createTool } from "@mastra/core/tools";
+import { z } from "zod";
+import { resolveAppSlug } from "../../lib/catalog/resolve";
+import { saveArtifact } from "../../lib/dashboards/artifact";
+import { getLatestSnapshot } from "../../lib/dashboards/snapshot";
+import { buildDefaultSpec } from "../../lib/dashboards/spec";
+
+// Cap how many records ride along in the tool result to the UI — enough to
+// render a dashboard, bounded so a huge snapshot can't bloat the message stream.
+const MAX_RECORDS_TO_UI = 500;
+
+// NOTE: no `strict: true` — Anthropic's grammar can't handle it on richer
+// schemas, and it's banned project-wide for createTool.
+export const createDashboardTool = createTool({
+  id: "create_dashboard",
+  description:
+    "Build an app — such as a live dashboard — from data already pulled from a connected app " +
+    "(e.g. HubSpot, Airtable, Stripe). Use this when the user asks to 'build/make/show an app or " +
+    "a dashboard' of their data. It reads the latest stored snapshot for that app, generates a " +
+    "live app (KPIs, a chart, and a table), saves it, and renders it inline in the chat. " +
+    "If no data has been pulled for the app yet, it tells the user to connect it / let a poll " +
+    "trigger pull data first.",
+  inputSchema: z.object({
+    app: z
+      .string()
+      .describe("The connected app whose data to visualize, e.g. 'hubspot', 'airtable', 'stripe'."),
+    title: z.string().optional().describe("Optional app title. Defaults to '<app> overview'."),
+  }),
+  // No `outputSchema`: the result carries an open-ended `spec` + `records` (rows
+  // with arbitrary keys). Declaring those via z.any()/z.record() makes Mastra emit
+  // `additionalProperties: <schema>` in the tool definition, which Anthropic
+  // rejects ("additionalProperties: object is not supported"). Omitting the
+  // output schema avoids that entirely — the execute return still flows to the UI
+  // as the tool result (part.output) for inline rendering.
+  //
+  // The model only needs a short confirmation — the full spec+records go to the
+  // UI, not into the model's context.
+  toModelOutput: (output) => {
+    const o = output as { title: string; rowCount: number; appKey: string; url: string };
+    return {
+      type: "text" as const,
+      text: `Built the app "${o.title}" from ${o.rowCount} ${o.appKey} record(s). It is shown in the chat and available at ${o.url}.`,
+    };
+  },
+  onOutput: ({ output, toolName }) => {
+    const o = output as { id?: string; rowCount?: number; appKey?: string };
+    console.log(
+      `[tool:${toolName}] built dashboard ${o.id?.slice(0, 8)} (${o.rowCount ?? 0} ${o.appKey} records)`,
+    );
+  },
+  execute: async ({ app, title }, context) => {
+    const userId = context?.requestContext?.get("userId") as string | undefined;
+    if (!userId) throw new Error("create_dashboard: no userId in request context");
+
+    const appKey = await resolveAppSlug(app);
+
+    const snapshot = await getLatestSnapshot(userId, appKey);
+    if (!snapshot || snapshot.records.length === 0) {
+      throw new Error(
+        `No data has been pulled for "${appKey}" yet. Connect the app and set up a data pull ` +
+          `(poll trigger) first, then ask me to build the app.`,
+      );
+    }
+
+    const spec = buildDefaultSpec(appKey, snapshot.records, title);
+
+    const id = await saveArtifact({
+      userId,
+      kind: "dashboard",
+      title: spec.title,
+      spec,
+      snapshotId: snapshot.id,
+      sourceConfig: snapshot.sourceConfig,
+    });
+
+    return {
+      id,
+      title: spec.title,
+      url: `/apps/${id}`,
+      rowCount: snapshot.rowCount,
+      appKey,
+      spec,
+      records: snapshot.records.slice(0, MAX_RECORDS_TO_UI),
+    };
+  },
+});
diff --git a/packages/agents/src/mastra/tools/delete-workflow.ts b/packages/agents/src/mastra/tools/delete-workflow.ts
deleted file mode 100644
index 7a157104..00000000
--- a/packages/agents/src/mastra/tools/delete-workflow.ts
+++ /dev/null
@@ -1,63 +0,0 @@
-import { createTool } from "@mastra/core/tools";
-import { z } from "zod";
-import { getSupabase } from "@/lib/db";
-
-export const deleteWorkflowTool = createTool({
-  id: "delete_workflow",
-  strict: true,
-  description:
-    "Permanently delete a saved workflow and all of its run history. " +
-    "Cascades to workflow_step + workflow_run rows. This is irreversible. " +
-    "Only call when the user explicitly asks to delete / remove / forget a " +
-    "specific workflow. Always confirm with them first if there is any " +
-    "ambiguity about which one.",
-  inputSchema: z.object({
-    workflowId: z.string().describe("The workflow id (from list_workflows)."),
-  }),
-  outputSchema: z.object({
-    id: z.string(),
-    deleted: z.literal(true),
-  }),
-  // Destructive — Mastra wraps this in an approval prompt.
-  requireApproval: true,
-  onOutput: ({ output, toolName }) => {
-    const o = output as { id?: string };
-    console.log(`[tool:${toolName}] deleted ${o.id?.slice(0, 8)}`);
-  },
-  execute: async ({ workflowId }, context) => {
-    const userId = context?.requestContext?.get("userId") as string | undefined;
-    if (!userId) throw new Error("delete_workflow: no userId in request context");
-
-    const supabase = getSupabase();
-
-    // Verify ownership before deleting anything
-    const { data: existing, error: rErr } = await supabase
-      .from("workflow")
-      .select("id")
-      .eq("id", workflowId)
-      .eq("user_id", userId)
-      .limit(1)
-      .maybeSingle();
-    if (rErr) throw new Error(`delete_workflow: ${rErr.message}`);
-    if (!existing) throw new Error(`delete_workflow: workflow ${workflowId} not found`);
-
-    // Cascade manually — same path as the DELETE /workflows/:id route.
-    // FK cascade is not declared in the schema today.
-    const { error: rrErr } = await supabase
-      .from("workflow_run")
-      .delete()
-      .eq("workflow_id", workflowId);
-    if (rrErr) throw new Error(`delete_workflow: ${rrErr.message}`);
-
-    const { error: sErr } = await supabase
-      .from("workflow_step")
-      .delete()
-      .eq("workflow_id", workflowId);
-    if (sErr) throw new Error(`delete_workflow: ${sErr.message}`);
-
-    const { error: wErr } = await supabase.from("workflow").delete().eq("id", workflowId);
-    if (wErr) throw new Error(`delete_workflow: ${wErr.message}`);
-
-    return { id: workflowId, deleted: true as const };
-  },
-});
diff --git a/packages/agents/src/mastra/tools/detach-trigger.ts b/packages/agents/src/mastra/tools/detach-trigger.ts
deleted file mode 100644
index af9bb6e7..00000000
--- a/packages/agents/src/mastra/tools/detach-trigger.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-import { createTool } from "@mastra/core/tools";
-import { z } from "zod";
-import { getSupabase } from "@/lib/db";
-
-export const detachTriggerTool = createTool({
-  id: "detach_trigger",
-  strict: true,
-  description:
-    "Remove a trigger from a workflow. The workflow itself is not deleted. " +
-    "Use when the user says 'stop the schedule', 'unbind this from Slack', " +
-    "or 'cancel the cron'. Pair with list_workflow_triggers to find the id.",
-  inputSchema: z.object({
-    workflowId: z.string().describe("The workflow id."),
-    triggerId: z.string().describe("The trigger id (from list_workflow_triggers)."),
-  }),
-  outputSchema: z.object({
-    deleted: z.literal(true),
-  }),
-  // Detaching a trigger silently changes future behavior — confirm.
-  requireApproval: true,
-  onOutput: ({ toolName }) => {
-    console.log(`[tool:${toolName}] trigger detached`);
-  },
-  execute: async ({ workflowId, triggerId }, context) => {
-    const userId = context?.requestContext?.get("userId") as string | undefined;
-    if (!userId) throw new Error("detach_trigger: no userId in request context");
-
-    const supabase = getSupabase();
-
-    const { data: wf } = await supabase
-      .from("workflow")
-      .select("id")
-      .eq("id", workflowId)
-      .eq("user_id", userId)
-      .limit(1)
-      .maybeSingle();
-    if (!wf) throw new Error(`detach_trigger: workflow ${workflowId} not found`);
-
-    const { error } = await supabase
-      .from("workflow_trigger")
-      .delete()
-      .eq("id", triggerId)
-      .eq("workflow_id", workflowId);
-    if (error) throw new Error(`detach_trigger: ${error.message}`);
-
-    return { deleted: true as const };
-  },
-});
diff --git a/packages/agents/src/mastra/tools/fork-conversation.ts b/packages/agents/src/mastra/tools/fork-conversation.ts
index cae52c76..370a8874 100644
--- a/packages/agents/src/mastra/tools/fork-conversation.ts
+++ b/packages/agents/src/mastra/tools/fork-conversation.ts
@@ -3,7 +3,6 @@ import { z } from "zod";
 
 export const forkConversationTool = createTool({
   id: "fork_conversation",
-  strict: true,
   description:
     "Fork (clone) the current conversation thread to explore a different automation path. " +
     "Creates a copy of the conversation history so the user can try alternative approaches " +
diff --git a/packages/agents/src/mastra/tools/get-workflow.ts b/packages/agents/src/mastra/tools/get-workflow.ts
deleted file mode 100644
index d9992d66..00000000
--- a/packages/agents/src/mastra/tools/get-workflow.ts
+++ /dev/null
@@ -1,79 +0,0 @@
-import { createTool } from "@mastra/core/tools";
-import { z } from "zod";
-import { getSupabase } from "@/lib/db";
-
-export const getWorkflowTool = createTool({
-  id: "get_workflow",
-  strict: true,
-  description:
-    "Fetch a single saved workflow with its ordered steps. Use this when the user " +
-    "asks to inspect, edit, or run a specific workflow — call list_workflows first " +
-    "if you don't already have the id.",
-  inputSchema: z.object({
-    workflowId: z.string().describe("The workflow id (from list_workflows)."),
-  }),
-  outputSchema: z.object({
-    id: z.string(),
-    name: z.string(),
-    parameters: z.array(z.string()),
-    steps: z.array(
-      z.object({
-        order: z.number(),
-        appKey: z.string().nullable(),
-        actionType: z.string().nullable(),
-        actionKey: z.string().nullable(),
-        humanLabel: z.string().nullable(),
-        inputs: z.record(z.string(), z.unknown()),
-      }),
-    ),
-    createdAt: z.string(),
-    updatedAt: z.string(),
-  }),
-  onOutput: ({ output, toolName }) => {
-    const o = output as { id?: string; steps?: unknown[] };
-    console.log(`[tool:${toolName}] fetched ${o.id?.slice(0, 8)} (${o.steps?.length ?? 0} steps)`);
-  },
-  execute: async ({ workflowId }, context) => {
-    const userId = context?.requestContext?.get("userId") as string | undefined;
-    if (!userId) throw new Error("get_workflow: no userId in request context");
-
-    const supabase = getSupabase();
-    const { data: wf, error: wErr } = await supabase
-      .from("workflow")
-      .select("*")
-      .eq("id", workflowId)
-      .eq("user_id", userId)
-      .limit(1)
-      .maybeSingle();
-    if (wErr) throw new Error(`get_workflow: ${wErr.message}`);
-    if (!wf) throw new Error(`get_workflow: workflow ${workflowId} not found`);
-
-    const { data: stepRows, error: sErr } = await supabase
-      .from("workflow_step")
-      .select("*")
-      .eq("workflow_id", workflowId)
-      .order("order", { ascending: true });
-    if (sErr) throw new Error(`get_workflow: ${sErr.message}`);
-
-    const steps = (stepRows ?? []).map((s) => {
-      const tpl = JSON.parse(s.proposal_template as string) as Record<string, unknown>;
-      return {
-        order: s.order as number,
-        appKey: (tpl.appKey as string) ?? null,
-        actionType: (tpl.actionType as string) ?? null,
-        actionKey: (tpl.actionKey as string) ?? null,
-        humanLabel: (tpl.humanLabel as string) ?? null,
-        inputs: (tpl.inputs as Record<string, unknown>) ?? {},
-      };
-    });
-
-    return {
-      id: wf.id as string,
-      name: wf.name as string,
-      parameters: JSON.parse((wf.parameters as string) ?? "[]") as string[],
-      steps,
-      createdAt: wf.created_at as string,
-      updatedAt: wf.updated_at as string,
-    };
-  },
-});
diff --git a/packages/agents/src/mastra/tools/list-workflow-triggers.ts b/packages/agents/src/mastra/tools/list-workflow-triggers.ts
deleted file mode 100644
index a97dece1..00000000
--- a/packages/agents/src/mastra/tools/list-workflow-triggers.ts
+++ /dev/null
@@ -1,63 +0,0 @@
-import { createTool } from "@mastra/core/tools";
-import { z } from "zod";
-import { getSupabase } from "@/lib/db";
-
-export const listWorkflowTriggersTool = createTool({
-  id: "list_workflow_triggers",
-  strict: true,
-  description:
-    "List the triggers bound to a saved workflow. Use before detaching, " +
-    "or when the user asks 'is this scheduled?', 'what fires this?', or " +
-    "'when does X run?'.",
-  inputSchema: z.object({
-    workflowId: z.string().describe("The workflow id (from list_workflows)."),
-  }),
-  outputSchema: z.object({
-    triggers: z.array(
-      z.object({
-        id: z.string(),
-        type: z.enum(["cron", "channel", "poll"]),
-        enabled: z.boolean(),
-        config: z.record(z.string(), z.unknown()),
-        lastFiredAt: z.string().nullable(),
-      }),
-    ),
-  }),
-  onOutput: ({ output, toolName }) => {
-    const count = (output as { triggers?: unknown[] })?.triggers?.length ?? 0;
-    console.log(`[tool:${toolName}] returned ${count} triggers`);
-  },
-  execute: async ({ workflowId }, context) => {
-    const userId = context?.requestContext?.get("userId") as string | undefined;
-    if (!userId) throw new Error("list_workflow_triggers: no userId in request context");
-
-    const supabase = getSupabase();
-
-    const { data: wf } = await supabase
-      .from("workflow")
-      .select("id")
-      .eq("id", workflowId)
-      .eq("user_id", userId)
-      .limit(1)
-      .maybeSingle();
-    if (!wf) throw new Error(`list_workflow_triggers: workflow ${workflowId} not found`);
-
-    const { data: rows, error } = await supabase
-      .from("workflow_trigger")
-      .select("id, type, enabled, config, last_fired_at")
-      .eq("workflow_id", workflowId)
-      .order("created_at", { ascending: true });
-
-    if (error) throw new Error(`list_workflow_triggers: ${error.message}`);
-
-    return {
-      triggers: (rows ?? []).map((r) => ({
-        id: r.id as string,
-        type: r.type as "cron" | "channel" | "poll",
-        enabled: r.enabled as boolean,
-        config: JSON.parse((r.config as string) ?? "{}") as Record<string, unknown>,
-        lastFiredAt: (r.last_fired_at as string | null) ?? null,
-      })),
-    };
-  },
-});
diff --git a/packages/agents/src/mastra/tools/list-workflows.ts b/packages/agents/src/mastra/tools/list-workflows.ts
deleted file mode 100644
index 47022910..00000000
--- a/packages/agents/src/mastra/tools/list-workflows.ts
+++ /dev/null
@@ -1,71 +0,0 @@
-import { createTool } from "@mastra/core/tools";
-import { z } from "zod";
-import { getSupabase } from "@/lib/db";
-
-export const listWorkflowsTool = createTool({
-  id: "list_workflows",
-  strict: true,
-  description:
-    "List the user's saved workflows. Returns id, name, and parameters for each. " +
-    "Use this when the user asks 'what workflows do I have?', 'show my saved automations', " +
-    "or before running/editing/deleting one (so you can pick the right id).",
-  inputSchema: z.object({
-    limit: z
-      .number()
-      .int()
-      .min(1)
-      .max(50)
-      .optional()
-      .default(20)
-      .describe("Max workflows to return. Default 20."),
-  }),
-  outputSchema: z.object({
-    workflows: z.array(
-      z.object({
-        id: z.string(),
-        name: z.string(),
-        parameters: z.array(z.string()),
-        updatedAt: z.string(),
-      }),
-    ),
-  }),
-  toModelOutput: (output) => ({
-    type: "text" as const,
-    text:
-      output.workflows.length === 0
-        ? "(no saved workflows yet)"
-        : output.workflows
-            .map(
-              (w, i) =>
-                `${i + 1}. ${w.name} — id=${w.id.slice(0, 8)} ` + `(${w.parameters.length} params)`,
-            )
-            .join("\n"),
-  }),
-  onOutput: ({ output, toolName }) => {
-    const count = (output as { workflows?: unknown[] })?.workflows?.length ?? 0;
-    console.log(`[tool:${toolName}] returned ${count} workflows`);
-  },
-  execute: async ({ limit }, context) => {
-    const userId = context?.requestContext?.get("userId") as string | undefined;
-    if (!userId) throw new Error("list_workflows: no userId in request context");
-
-    const supabase = getSupabase();
-    const { data: rows, error } = await supabase
-      .from("workflow")
-      .select("id, name, parameters, updated_at")
-      .eq("user_id", userId)
-      .order("updated_at", { ascending: false })
-      .limit(limit ?? 20);
-
-    if (error) throw new Error(`list_workflows: ${error.message}`);
-
-    return {
-      workflows: (rows ?? []).map((w) => ({
-        id: w.id as string,
-        name: w.name as string,
-        parameters: JSON.parse((w.parameters as string) ?? "[]") as string[],
-        updatedAt: w.updated_at as string,
-      })),
-    };
-  },
-});
diff --git a/packages/agents/src/mastra/tools/preview-app.ts b/packages/agents/src/mastra/tools/preview-app.ts
new file mode 100644
index 00000000..3a5bbe5d
--- /dev/null
+++ b/packages/agents/src/mastra/tools/preview-app.ts
@@ -0,0 +1,153 @@
+import { createTool } from "@mastra/core/tools";
+import { z } from "zod";
+import { startReactPreview, typecheckPreview } from "../../lib/preview/serve";
+
+/**
+ * Pull the raw TSX out of the builder's reply, tolerating the model occasionally
+ * wrapping it in a markdown code fence or adding stray prose. We strip a leading/
+ * trailing ``` fence, then slice from the first real code token (an import or the
+ * default export) so any preamble is dropped.
+ */
+function extractComponent(raw: string): string {
+  let text = raw.trim();
+
+  if (text.startsWith("```")) {
+    text = text
+      .replace(/^```[a-zA-Z]*\s*\n?/, "")
+      .replace(/\n?```\s*$/, "")
+      .trim();
+  }
+
+  // Drop any prose before the code: start at the first import / "export default".
+  const match = text.match(/^(import\s|export\s+default\b)/m);
+  if (match && match.index !== undefined && match.index > 0) {
+    text = text.slice(match.index).trim();
+  }
+  return text;
+}
+
+// No `strict: true` and no `outputSchema` — same Anthropic-grammar constraints
+// as the other custom tools. The execute return flows to the UI as part.output
+// for the live preview panel; the model only gets a short confirm.
+//
+// The agent passes a BRIEF, not code: a cheap Haiku "preview-builder" agent writes
+// the React component (foreman-8nyg), keeping that token cost off the primary
+// Sonnet model. The component is rendered live in a real Vite + shadcn app.
+export const previewAppTool = createTool({
+  id: "preview_app",
+  description:
+    "Build and SHOW a live, interactive app the user can actually see and click — a dashboard, chart, " +
+    "report, or small tool — built from the product's REAL shadcn/ui components and rendered live in a " +
+    "side panel. You do NOT write the code yourself: pass a short, specific BRIEF of what to build, and " +
+    "(when the user wants a view of THEIR data) FIRST fetch the data with your Zapier tools, then pass " +
+    "that data here. A fast builder turns the brief + data into a real React component, compiles it with " +
+    "Vite, and shows it live. Use this whenever the user wants to SEE something built.",
+  inputSchema: z.object({
+    brief: z
+      .string()
+      .describe(
+        "A short, specific description of what to build — what it shows, the charts/KPIs/layout, and " +
+          "any notes. Describe intent; do NOT write code.",
+      ),
+    data: z
+      .string()
+      .optional()
+      .describe(
+        "Optional data to render, as a JSON string (or compact text). When the user wants a view of " +
+          "their own data, fetch it first with your Zapier tools and pass it here so it is rendered " +
+          "rather than invented.",
+      ),
+    title: z.string().optional().describe("Short title shown above the preview panel."),
+  }),
+  toModelOutput: (output) => {
+    const o = output as { url: string; title?: string };
+    return {
+      type: "text" as const,
+      text: `Live preview${o.title ? ` "${o.title}"` : ""} is running and shown in the side panel (${o.url}).`,
+    };
+  },
+  execute: async ({ brief, data, title }, ctx) => {
+    if (!ctx?.mastra) {
+      throw new Error("preview_app must run within an agent context to reach the preview builder");
+    }
+    const builder = ctx.mastra.getAgent("preview-builder");
+    if (!builder) throw new Error("preview_app: preview-builder agent is not registered");
+
+    // Live build feed (foreman-7tci): stream a part per stage so the chat shows
+    // what's happening instead of a single opaque "Building live preview…".
+    const progress = (stage: string, label: string) =>
+      ctx?.writer?.custom({ type: "data-preview-progress", data: { stage, label } });
+
+    const prompt = data
+      ? `Build this:\n\n${brief}\n\nUse ONLY this data — render from it directly (do not invent extra data):\n\n${data}`
+      : `Build this:\n\n${brief}`;
+
+    // ANSI-colored terminal build log for the Sandbox's Terminal tab. Streamed
+    // live via data-preview-log so the panel's terminal can scroll as it builds.
+    const C = {
+      dim: "",
+      green: "",
+      red: "",
+      cyan: "",
+      reset: "",
+    };
+    let log = "";
+    const line = (s: string) => {
+      log += `${s}\n`;
+      ctx?.writer?.custom({ type: "data-preview-log", data: { log, done: false } });
+    };
+
+    line(`${C.dim}$ build preview${C.reset}`);
+    await progress("design", "Designing the component with shadcn + Haiku…");
+    line(`${C.cyan}› generating component with Haiku…${C.reset}`);
+    let tsx = extractComponent((await builder.generate(prompt as string)).text ?? "");
+    if (!tsx) throw new Error("preview_app: builder returned no component");
+    line(`${C.green}✓ wrote src/generated.tsx${C.reset}`);
+
+    await progress("build", "Compiling and type-checking…");
+    line(`${C.dim}$ vite — starting dev server${C.reset}`);
+    const { url } = await startReactPreview(tsx);
+    line(`${C.green}✓ vite ready → ${url}${C.reset}`);
+
+    // Self-heal (foreman-8nyg): if the component doesn't compile, feed the real
+    // type errors back to the builder and let it fix itself — up to twice.
+    line(`${C.dim}$ tsc --noEmit${C.reset}`);
+    let check = await typecheckPreview();
+    for (let attempt = 1; !check.ok && attempt <= 2; attempt++) {
+      line(`${C.red}${check.errors ?? "type error"}${C.reset}`);
+      line(`${C.cyan}↻ self-heal: fixing with Haiku (attempt ${attempt})…${C.reset}`);
+      await progress("fix", `Found a build error — fixing it (attempt ${attempt})…`);
+      const fixPrompt =
+        `The component you just wrote fails to compile with these TypeScript errors:\n\n${check.errors}\n\n` +
+        "Return the CORRECTED, COMPLETE component following the exact same import rules. Output only the .tsx, nothing else.";
+      const fixed = extractComponent((await builder.generate(fixPrompt)).text ?? "");
+      if (!fixed) break;
+      tsx = fixed;
+      await startReactPreview(tsx);
+      line(`${C.green}✓ rewrote src/generated.tsx${C.reset}`);
+      line(`${C.dim}$ tsc --noEmit${C.reset}`);
+      check = await typecheckPreview();
+    }
+    line(
+      check.ok
+        ? `${C.green}✓ type-check passed${C.reset}`
+        : `${C.red}✗ type-check still failing${C.reset}`,
+    );
+    line(
+      check.ok ? `${C.green}● preview live${C.reset}` : `${C.red}● preview live (issue)${C.reset}`,
+    );
+    ctx?.writer?.custom({ type: "data-preview-log", data: { log, done: true } });
+
+    await progress(
+      "ready",
+      check.ok ? "Preview is live." : "Preview is live (with a known issue).",
+    );
+    return {
+      url,
+      title: (title as string | undefined) ?? "Preview",
+      source: tsx,
+      log,
+      ok: check.ok,
+    };
+  },
+});
diff --git a/packages/agents/src/mastra/tools/run-workflow.ts b/packages/agents/src/mastra/tools/run-workflow.ts
deleted file mode 100644
index 5d76ac66..00000000
--- a/packages/agents/src/mastra/tools/run-workflow.ts
+++ /dev/null
@@ -1,79 +0,0 @@
-import { createTool } from "@mastra/core/tools";
-import { z } from "zod";
-import { executeWorkflow } from "@/lib/workflows/engine";
-
-export const runWorkflowTool = createTool({
-  id: "run_workflow",
-  strict: true,
-  description:
-    "Execute a previously saved workflow now. Drains the workflow's step generator " +
-    "and returns a summary: runId, steps succeeded / failed, missing params if the " +
-    "workflow needs values you didn't provide. Use after `list_workflows` so you " +
-    "have the workflow id. If the user asks to 'run my X workflow' or 'fire X', " +
-    "this is the tool.",
-  inputSchema: z.object({
-    workflowId: z.string().describe("The workflow id (from list_workflows)."),
-    inputs: z
-      .record(z.string(), z.string())
-      .optional()
-      .default({})
-      .describe(
-        "Values for the workflow's parameters (the keys are parameter names " +
-          "from get_workflow's response, e.g. { recipient_email: 'a@b.com' }).",
-      ),
-  }),
-  outputSchema: z.object({
-    runId: z.string().nullable(),
-    status: z.enum(["success", "failed", "param_request", "no_steps"]),
-    stepsRun: z.number(),
-    stepsFailed: z.number(),
-    missingParams: z.array(z.string()).optional(),
-    error: z.string().optional(),
-  }),
-  // Destructive — confirm before running. Avoids the agent unilaterally
-  // firing a multi-step workflow that sends emails or creates records.
-  requireApproval: true,
-  onOutput: ({ output, toolName }) => {
-    const o = output as { runId?: string | null; status?: string };
-    console.log(`[tool:${toolName}] run=${o.runId?.slice(0, 8) ?? "(none)"} status=${o.status}`);
-  },
-  execute: async ({ workflowId, inputs }, context) => {
-    const userId = context?.requestContext?.get("userId") as string | undefined;
-    if (!userId) throw new Error("run_workflow: no userId in request context");
-
-    let runId: string | null = null;
-    let stepsRun = 0;
-    let stepsFailed = 0;
-    let missingParams: string[] | undefined;
-    let errorMessage: string | undefined;
-    let finalStatus: "success" | "failed" | "param_request" | "no_steps" = "failed";
-
-    try {
-      for await (const event of executeWorkflow(workflowId, userId, inputs ?? {})) {
-        if (event.runId) runId = event.runId;
-        if (event.type === "step" && event.status === "succeeded") stepsRun++;
-        if (event.type === "step" && event.status === "failed") stepsFailed++;
-        if (event.type === "param_request") {
-          finalStatus = "param_request";
-          missingParams = event.missing ?? [];
-        }
-        if (event.type === "complete") finalStatus = "success";
-        if (event.type === "error") {
-          errorMessage = event.message;
-          if (event.message === "Workflow has no steps") finalStatus = "no_steps";
-        }
-      }
-    } catch (err) {
-      errorMessage = err instanceof Error ? err.message : String(err);
-    }
-
-    return {
-      runId,
-      status: finalStatus,
-      stepsRun,
-      stepsFailed,
-      ...(missingParams ? { missingParams } : {}),
-      ...(errorMessage ? { error: errorMessage } : {}),
-    };
-  },
-});
diff --git a/packages/agents/src/mastra/tools/save-document.ts b/packages/agents/src/mastra/tools/save-document.ts
new file mode 100644
index 00000000..1ab8a88d
--- /dev/null
+++ b/packages/agents/src/mastra/tools/save-document.ts
@@ -0,0 +1,105 @@
+import { createTool } from "@mastra/core/tools";
+import { z } from "zod";
+import { docPath as physicalDocPath } from "../../lib/documents/spaces";
+import { recordVersion } from "../../lib/documents/versions";
+import { requestUserContext } from "../../lib/request-user-context";
+import {
+  indexSharedDoc,
+  resolveWorkspaceFilesystem,
+  resolveWorkspaceTenantKey,
+} from "../agents/workspace";
+
+/**
+ * save_document (foreman-aqjx) — the write side of the knowledge layer. Persists
+ * a markdown document as a file under `documents/` in the caller's per-tenant
+ * Workspace filesystem (foreman-jgme), so it survives the conversation and BOTH
+ * the user (via the KnowledgePanel viewer) and the agent (via Workspace search +
+ * file tools) can read it later. Pairs with the GET /documents read API.
+ *
+ * A dedicated tool (not the generic approval-gated workspace write) because
+ * saving a knowledge doc the user asked for is low-risk and should be one step,
+ * and because the tool result drives the inline chip → side-panel viewer, exactly
+ * like preview_app does for live apps.
+ *
+ * No `strict: true` / `outputSchema` — same Anthropic-grammar constraints as the
+ * other custom tools; the result flows to the UI as part.output.
+ */
+function slugify(title: string): string {
+  const s = title
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 60);
+  return s || "untitled";
+}
+
+export const saveDocumentTool = createTool({
+  id: "save_document",
+  description:
+    "Save a knowledge document (markdown) to the user's workspace so it persists and both the " +
+    "user and you can read it back later. Use this when the user asks you to write up, save, or " +
+    "keep a note, plan, summary, brief, spec, or doc — or to capture shared context for the team. " +
+    "The document is stored in the workspace and shown in a side panel the user can open. Reusing " +
+    "the same title updates that document. Documents are saved to the SHARED team space by " +
+    "default (every workspace member can see them); pass space:'personal' for a private note only " +
+    "this user should see (e.g. when they say 'just for me', 'private', or 'a personal note'). " +
+    "Pass a short title and the full markdown content.",
+  inputSchema: z.object({
+    title: z.string().describe("Short human title for the document, e.g. 'Q3 launch plan'."),
+    content: z.string().describe("The full document body as GitHub-flavored markdown."),
+    space: z
+      .enum(["shared", "personal"])
+      .optional()
+      .describe(
+        "Where to save it: 'shared' (default — visible to the whole workspace/team) or " +
+          "'personal' (private to this user). Only use 'personal' when the user asks for a " +
+          "private/personal note.",
+      ),
+  }),
+  toModelOutput: (output) => {
+    const o = output as { title: string; path: string };
+    return {
+      type: "text" as const,
+      text: `Saved document "${o.title}" (${o.path}). It is shown in the side panel, and you can read it back anytime with your workspace file tools.`,
+    };
+  },
+  execute: async ({ title, content, space }, context) => {
+    // The real RequestContext already carries workspaceId/userId (web); on
+    // channels the resolver falls back to the ALS userId — works on every surface.
+    const rc = context?.requestContext;
+    const fs = await resolveWorkspaceFilesystem(rc);
+    if (!fs) throw new Error("save_document: workspace filesystem unavailable");
+
+    // userId is needed for the per-user PERSONAL space path (foreman-5e4f).
+    const userId =
+      (rc?.get("userId") as string | undefined) ?? requestUserContext.getStore()?.userId;
+    // A personal save needs a userId to scope the path; without one, fall back to
+    // the shared space rather than failing the save.
+    const resolvedSpace = space === "personal" && userId ? "personal" : "shared";
+
+    const slug = slugify(title);
+    const path = physicalDocPath(resolvedSpace, userId, slug);
+    await fs.writeFile(path, content);
+    // Snapshot this revision into the version tree (Mastra BlobStore + manifest,
+    // foreman-udji). Best-effort: a versioning hiccup must not fail the save —
+    // the live file is already written and is the source of truth.
+    try {
+      await recordVersion(fs, path, { title, content });
+    } catch (err) {
+      console.error("save_document: recordVersion failed (doc still saved)", err);
+    }
+    // Index SHARED docs for semantic search (foreman-aqjx). Best-effort: the doc
+    // is already saved; a failed embed must not fail the save. Personal docs are
+    // deliberately NOT indexed — they'd become searchable by teammates in the
+    // shared per-workspace index (personal search is a per-user-index follow-up).
+    if (resolvedSpace === "shared") {
+      try {
+        const tenantKey = await resolveWorkspaceTenantKey(rc);
+        await indexSharedDoc({ tenantKey, path, content, title });
+      } catch (err) {
+        console.error("save_document: knowledge index failed (doc still saved)", err);
+      }
+    }
+    return { path, title, space: resolvedSpace };
+  },
+});
diff --git a/packages/agents/src/mastra/tools/save-workflow.ts b/packages/agents/src/mastra/tools/save-workflow.ts
deleted file mode 100644
index 57c3eaa9..00000000
--- a/packages/agents/src/mastra/tools/save-workflow.ts
+++ /dev/null
@@ -1,46 +0,0 @@
-import { createTool } from "@mastra/core/tools";
-import { z } from "zod";
-import { saveWorkflowFromConversation } from "@/lib/workflows/save";
-
-export const saveWorkflowTool = createTool({
-  id: "save_workflow",
-  strict: true,
-  description:
-    "Save the current conversation's executed actions as a re-runnable workflow. " +
-    "Captures every action proposal that the user approved and ran, in order, " +
-    "and parameterizes obvious values (emails, IDs, phone numbers) so the " +
-    "workflow can be re-run with different inputs. Use this when the user " +
-    "asks to save what they just did, save as a workflow, save as a template, " +
-    "or any phrasing that means 'I want to do this again later.' " +
-    "Only call this AFTER at least one action has actually executed in the " +
-    "conversation — if nothing has run yet, tell the user to run it first.",
-  inputSchema: z.object({
-    name: z
-      .string()
-      .min(1)
-      .max(200)
-      .describe(
-        "A short, human-readable name for the workflow (e.g. 'Daily standup post', 'Invoice → Slack notify').",
-      ),
-  }),
-  outputSchema: z.object({
-    workflowId: z.string(),
-    steps: z.number(),
-    parameters: z.array(z.string()),
-  }),
-  onOutput: ({ output, toolName }) => {
-    const o = output as { workflowId?: string; steps?: number };
-    console.log(
-      `[tool:${toolName}] saved workflow ${o.workflowId?.slice(0, 8)} (${o.steps ?? 0} steps)`,
-    );
-  },
-  execute: async ({ name }, context) => {
-    const userId = context?.requestContext?.get("userId") as string | undefined;
-    const conversationId = context?.requestContext?.get("threadId") as string | undefined;
-    if (!userId) throw new Error("save_workflow: no userId in request context");
-    if (!conversationId) {
-      throw new Error("save_workflow: no conversation thread id in request context");
-    }
-    return saveWorkflowFromConversation(conversationId, userId, name);
-  },
-});
diff --git a/packages/agents/src/mastra/tools/search-history.ts b/packages/agents/src/mastra/tools/search-history.ts
index 93b21373..c689ad96 100644
--- a/packages/agents/src/mastra/tools/search-history.ts
+++ b/packages/agents/src/mastra/tools/search-history.ts
@@ -1,15 +1,12 @@
 import { createTool } from "@mastra/core/tools";
 import { z } from "zod";
-import { backgroundIfEnabled } from "@/lib/background";
-import { searchActionHistory } from "@/lib/rag";
+import { searchActionHistory } from "../../lib/rag";
 
+// Backgrounding (so a slow history search doesn't block chat) is opted in at the
+// AGENT level via backgroundToolsConfig() in lib/background.ts — tool-level
+// `background` config doesn't dispatch under Foreman's lazy tools resolver.
 export const searchHistoryTool = createTool({
   id: "search_history",
-  strict: true,
-  // Opt this read into Mastra background execution when FOREMAN_BACKGROUND_TOOLS=1.
-  // Simple schema (3 fields) → safe for Studio introspection, unlike the Zapier
-  // SDK tools whose schemas hang `mastra dev` when background is enabled.
-  ...backgroundIfEnabled(),
   description:
     "Search the user's past action history to find similar actions they've taken before. " +
     "Use this to recommend actions based on what the user has done previously, or to recall " +
diff --git a/packages/agents/src/mastra/tools/update-workflow.ts b/packages/agents/src/mastra/tools/update-workflow.ts
deleted file mode 100644
index 72949632..00000000
--- a/packages/agents/src/mastra/tools/update-workflow.ts
+++ /dev/null
@@ -1,73 +0,0 @@
-import { createTool } from "@mastra/core/tools";
-import { z } from "zod";
-import { getSupabase } from "@/lib/db";
-import type { Database } from "@/lib/db/database.types";
-
-export const updateWorkflowTool = createTool({
-  id: "update_workflow",
-  strict: true,
-  description:
-    "Update metadata on a saved workflow — rename it, or mark it as a public " +
-    "template that can be cloned by other users. Step content (the ordered " +
-    "actions) is intentionally not editable here; to change steps, run the " +
-    "workflow again with new inputs and save_workflow under a new name. Use " +
-    "this for the user-facing 'rename workflow X to Y' or 'make X a template' " +
-    "asks.",
-  inputSchema: z.object({
-    workflowId: z.string().describe("The workflow id (from list_workflows)."),
-    name: z.string().min(1).max(200).optional().describe("New name. Omit to leave unchanged."),
-    isTemplate: z
-      .boolean()
-      .optional()
-      .describe(
-        "Set true to publish as a public template, false to revert to private. Omit to leave unchanged.",
-      ),
-  }),
-  outputSchema: z.object({
-    id: z.string(),
-    name: z.string(),
-    isTemplate: z.boolean(),
-    updatedAt: z.string(),
-  }),
-  onOutput: ({ output, toolName }) => {
-    const o = output as { id?: string; name?: string };
-    console.log(`[tool:${toolName}] updated ${o.id?.slice(0, 8)} → name="${o.name}"`);
-  },
-  execute: async ({ workflowId, name, isTemplate }, context) => {
-    const userId = context?.requestContext?.get("userId") as string | undefined;
-    if (!userId) throw new Error("update_workflow: no userId in request context");
-
-    if (name === undefined && isTemplate === undefined) {
-      throw new Error("update_workflow: at least one of {name, isTemplate} must be provided");
-    }
-
-    const supabase = getSupabase();
-
-    // Verify ownership first so we don't bump updated_at on someone else's row
-    const { data: existing, error: rErr } = await supabase
-      .from("workflow")
-      .select("id, name, is_template")
-      .eq("id", workflowId)
-      .eq("user_id", userId)
-      .limit(1)
-      .maybeSingle();
-    if (rErr) throw new Error(`update_workflow: ${rErr.message}`);
-    if (!existing) throw new Error(`update_workflow: workflow ${workflowId} not found`);
-
-    const patch: Database["public"]["Tables"]["workflow"]["Update"] = {
-      updated_at: new Date().toISOString(),
-    };
-    if (name !== undefined) patch.name = name;
-    if (isTemplate !== undefined) patch.is_template = isTemplate;
-
-    const { error: uErr } = await supabase.from("workflow").update(patch).eq("id", workflowId);
-    if (uErr) throw new Error(`update_workflow: ${uErr.message}`);
-
-    return {
-      id: workflowId,
-      name: (patch.name as string) ?? (existing.name as string),
-      isTemplate: (patch.is_template as boolean) ?? (existing.is_template as boolean),
-      updatedAt: patch.updated_at as string,
-    };
-  },
-});
diff --git a/packages/agents/src/routes/api-keys.ts b/packages/agents/src/routes/api-keys.ts
index 3219d8db..e9131c64 100644
--- a/packages/agents/src/routes/api-keys.ts
+++ b/packages/agents/src/routes/api-keys.ts
@@ -1,6 +1,6 @@
 import { Hono } from "hono";
-import { getSupabase } from "@/lib/db";
-import { createApiKey } from "@/lib/identity";
+import { getSupabase } from "../lib/db";
+import { createApiKey } from "../lib/identity";
 import { authMiddleware } from "./middleware";
 import type { AppEnv } from "./types";
 
diff --git a/packages/agents/src/routes/apps.ts b/packages/agents/src/routes/apps.ts
new file mode 100644
index 00000000..3ca468ba
--- /dev/null
+++ b/packages/agents/src/routes/apps.ts
@@ -0,0 +1,163 @@
+import { Hono } from "hono";
+import { getArtifactWithData } from "../lib/dashboards/artifact";
+import { createShare, getSharedArtifact, revokeShare } from "../lib/dashboards/share";
+import {
+  getLatestSnapshot,
+  getSnapshotHistory,
+  listSnapshotApps,
+} from "../lib/dashboards/snapshot";
+import { validateParam } from "../lib/validation";
+import { authMiddleware } from "./middleware";
+import type { AppEnv } from "./types";
+
+/**
+ * Dashboard data routes (Phase 1: snapshot reads).
+ *
+ * Snapshots are append-only rows pulled from a user's connected app
+ * (written via saveSnapshot in lib/dashboards/snapshot.ts), keyed by
+ * (user_id, app_key). Phase 1 exposes them by app_key because the
+ * artifact table is keyed separately. We deliberately namespace under
+ * `/snapshots/:appKey` so the `/apps/artifacts/:id` routes won't collide.
+ *
+ * Mounted at `/apps` (see routes/index.ts), so the full paths are:
+ *   GET /apps                                     → workspace apps with data
+ *   GET /apps/snapshots/:appKey                   → latest snapshot
+ *   GET /apps/snapshots/:appKey?history=true      → series, newest-first
+ *       &since=<iso>   filter to snapshots at/after this timestamp
+ *       &limit=<n>     cap the series (1..500, default 100)
+ *
+ * Public sharing:
+ *   POST   /apps/artifacts/:id/share   → mint a public share token (authed)
+ *   DELETE /apps/shares/:shareToken    → revoke a share (authed)
+ *   GET    /apps/public/:shareToken    → render data, NO auth (token = grant)
+ *
+ * Auth is scoped per group: the owner-scoped read/write routes require auth; the
+ * public share route is intentionally unauthenticated.
+ */
+const appsRouter = new Hono<AppEnv>();
+
+appsRouter.use("/artifacts/*", authMiddleware);
+appsRouter.use("/snapshots/*", authMiddleware);
+appsRouter.use("/shares/*", authMiddleware);
+
+// GET /apps — the workspace's apps that have snapshot data, newest first. Lets
+// the Apps page default to a real source instead of a hardcoded one. Auth is
+// per-route here (not a prefix `use`) so the public /apps/public/* route below
+// stays unauthenticated.
+appsRouter.get("/", authMiddleware, async (c) => {
+  const workspaceId = c.get("workspaceId");
+  const apps = await listSnapshotApps(workspaceId);
+  return c.json({ apps });
+});
+
+// GET /apps/public/:shareToken — public share page data. NO auth: a valid,
+// unexpired token is the capability. Returns the same shape as the authed
+// artifact read (spec + records), so the web renderer is identical. Unknown or
+// expired tokens 404 (no existence leak).
+appsRouter.get("/public/:shareToken", async (c) => {
+  const token = validateParam(c.req.param("shareToken"), "shareToken");
+  if (!token) {
+    return c.json({ error: "Invalid share token" }, 400);
+  }
+  const artifact = await getSharedArtifact(token);
+  if (!artifact) {
+    return c.json({ error: "Not found" }, 404);
+  }
+  return c.json(artifact);
+});
+
+// GET /apps/artifacts/:id — a stored dashboard artifact (spec + the
+// records it renders), scoped to the caller. Powers the /apps/[id] page.
+appsRouter.get("/artifacts/:id", async (c) => {
+  const workspaceId = c.get("workspaceId");
+  const id = validateParam(c.req.param("id"), "id");
+  if (!id) {
+    return c.json({ error: "Invalid artifact id" }, 400);
+  }
+  const artifact = await getArtifactWithData(workspaceId, id);
+  if (!artifact) {
+    return c.json({ error: "Not found" }, 404);
+  }
+  return c.json(artifact);
+});
+
+// POST /apps/artifacts/:id/share — mint a public share token for a
+// dashboard the caller owns. Optional body { expiresInDays } for a link that
+// auto-expires. Returns the token + the relative public path the web app serves.
+appsRouter.post("/artifacts/:id/share", async (c) => {
+  const userId = c.get("userId");
+  const workspaceId = c.get("workspaceId");
+  const id = validateParam(c.req.param("id"), "id");
+  if (!id) {
+    return c.json({ error: "Invalid artifact id" }, 400);
+  }
+
+  const body = (await c.req.json().catch(() => ({}))) as { expiresInDays?: unknown };
+  let expiresInDays: number | undefined;
+  if (body.expiresInDays !== undefined) {
+    const n = Number(body.expiresInDays);
+    if (!Number.isFinite(n) || n <= 0 || n > 3650) {
+      return c.json({ error: "expiresInDays must be a positive number of days (<= 3650)" }, 400);
+    }
+    expiresInDays = n;
+  }
+
+  const share = await createShare(workspaceId, userId, id, { expiresInDays });
+  if (!share) {
+    return c.json({ error: "Not found" }, 404);
+  }
+  return c.json({ token: share.token, url: `/d/${share.token}`, expiresAt: share.expiresAt }, 201);
+});
+
+// DELETE /apps/shares/:shareToken — revoke a share, owner-scoped.
+appsRouter.delete("/shares/:shareToken", async (c) => {
+  const workspaceId = c.get("workspaceId");
+  const token = validateParam(c.req.param("shareToken"), "shareToken");
+  if (!token) {
+    return c.json({ error: "Invalid share token" }, 400);
+  }
+  const revoked = await revokeShare(workspaceId, token);
+  if (!revoked) {
+    return c.json({ error: "Not found" }, 404);
+  }
+  return c.json({ revoked: true });
+});
+
+appsRouter.get("/snapshots/:appKey", async (c) => {
+  const workspaceId = c.get("workspaceId");
+  const appKey = validateParam(c.req.param("appKey"), "appKey");
+  if (!appKey) {
+    return c.json({ error: "Invalid appKey" }, 400);
+  }
+
+  const history = c.req.query("history") === "true";
+
+  if (!history) {
+    const snapshot = await getLatestSnapshot(workspaceId, appKey);
+    if (!snapshot) {
+      return c.json({ error: "No snapshot found for this app" }, 404);
+    }
+    return c.json(snapshot);
+  }
+
+  // History series — optional since + limit.
+  const since = c.req.query("since");
+  if (since && Number.isNaN(Date.parse(since))) {
+    return c.json({ error: "since must be an ISO timestamp" }, 400);
+  }
+
+  const rawLimit = c.req.query("limit");
+  let limit: number | undefined;
+  if (rawLimit !== undefined) {
+    const n = Number.parseInt(rawLimit, 10);
+    if (Number.isNaN(n) || n < 1) {
+      return c.json({ error: "limit must be a positive integer" }, 400);
+    }
+    limit = Math.min(n, 500);
+  }
+
+  const series = await getSnapshotHistory(workspaceId, appKey, { since, limit });
+  return c.json({ appKey, count: series.length, snapshots: series });
+});
+
+export default appsRouter;
diff --git a/packages/agents/src/routes/automations.ts b/packages/agents/src/routes/automations.ts
new file mode 100644
index 00000000..db2ddbbe
--- /dev/null
+++ b/packages/agents/src/routes/automations.ts
@@ -0,0 +1,204 @@
+import { Hono } from "hono";
+import {
+  cancelRunForUser,
+  getInboxView,
+  getWorkspaceInbox,
+  inspectForUser,
+  listForUser,
+  provisionAutomation,
+  removeAutomationForUser,
+  respondToCallbackForUser,
+  runAutomationById,
+  updateAutomationForUser,
+} from "../lib/automations/service";
+import type { InboxTriggerSpec } from "../lib/automations/types";
+import { validateParam } from "../lib/validation";
+import { authMiddleware } from "./middleware";
+import type { AppEnv } from "./types";
+
+/**
+ * Automation routes (foreman-l7xq M2) — workspace-scoped CRUD over durable
+ * automations, the web-facing twin of the agent's automation tools. Both go
+ * through lib/automations/service, so deploy+persist is one code path. All routes
+ * require auth; the workspace is the caller's active workspace.
+ *
+ *   GET    /automations           → list the workspace's automations
+ *   POST   /automations           → deploy + persist a new automation
+ *   GET    /automations/:id        → automation + recent runs
+ *   PATCH  /automations/:id        → rename / describe / enable-disable
+ *   POST   /automations/:id/run    → manually fire it
+ *   POST   /automations/runs/:runId/cancel   → cancel a running durable run
+ *   POST   /automations/runs/:runId/callback → approve/deny a human-approval gate
+ *   DELETE /automations/:id        → remove (row + best-effort Zapier workflow)
+ */
+const automations = new Hono<AppEnv>();
+
+automations.use("/*", authMiddleware);
+
+automations.get("/", async (c) => {
+  const userId = c.get("userId");
+  return c.json({ automations: await listForUser(userId) });
+});
+
+// Workspace-wide aggregate inbox (the /inbox page). MUST be registered before
+// "/:id" so it isn't captured as an automation id.
+automations.get("/inbox", async (c) => {
+  const userId = c.get("userId");
+  return c.json(await getWorkspaceInbox(userId));
+});
+
+// Cancel a running durable run (foreman-y4kc). The "runs/" prefix keeps it clear of
+// the "/:id" automation routes.
+automations.post("/runs/:runId/cancel", async (c) => {
+  const userId = c.get("userId");
+  const runId = validateParam(c.req.param("runId"), "runId");
+  if (!runId) {
+    return c.json({ error: "Invalid runId" }, 400);
+  }
+  const result = await cancelRunForUser(userId, runId);
+  if (!result) {
+    return c.json({ error: "Not found" }, 404);
+  }
+  return c.json(result);
+});
+
+// Respond to a durable human-approval gate (foreman-zfnj): approve = resume with a
+// payload; deny (cancel:true) = cancel the run. The callback URL is resolved
+// server-side and never returned to the client.
+automations.post("/runs/:runId/callback", async (c) => {
+  const userId = c.get("userId");
+  const runId = validateParam(c.req.param("runId"), "runId");
+  if (!runId) {
+    return c.json({ error: "Invalid runId" }, 400);
+  }
+  const body = (await c.req.json().catch(() => ({}))) as {
+    payload?: unknown;
+    cancel?: unknown;
+    callbackName?: unknown;
+  };
+  const result = await respondToCallbackForUser(userId, runId, {
+    payload: body.payload,
+    cancel: body.cancel === true,
+    callbackName: typeof body.callbackName === "string" ? body.callbackName : undefined,
+  });
+  if (!result) {
+    return c.json({ error: "Not found" }, 404);
+  }
+  if (!result.ok && result.action === "none") {
+    return c.json(result, 409);
+  }
+  return c.json(result);
+});
+
+automations.post("/", async (c) => {
+  const userId = c.get("userId");
+  const workspaceId = c.get("workspaceId");
+  const body = (await c.req.json().catch(() => ({}))) as {
+    name?: unknown;
+    description?: unknown;
+    source?: unknown;
+    connections?: unknown;
+    trigger?: unknown;
+    enabled?: unknown;
+    isPrivate?: unknown;
+  };
+  if (typeof body.name !== "string" || !body.name.trim()) {
+    return c.json({ error: "name is required" }, 400);
+  }
+  if (typeof body.source !== "string" || !body.source.trim()) {
+    return c.json({ error: "source is required" }, 400);
+  }
+
+  const result = await provisionAutomation({
+    userId,
+    workspaceId,
+    name: body.name,
+    description: typeof body.description === "string" ? body.description : undefined,
+    source: body.source,
+    connections: body.connections as Record<string, string | number> | undefined,
+    trigger: body.trigger as InboxTriggerSpec | undefined,
+    enabled: typeof body.enabled === "boolean" ? body.enabled : undefined,
+    isPrivate: typeof body.isPrivate === "boolean" ? body.isPrivate : undefined,
+  });
+  return c.json(result, 201);
+});
+
+automations.get("/:id", async (c) => {
+  const userId = c.get("userId");
+  const id = validateParam(c.req.param("id"), "id");
+  if (!id) {
+    return c.json({ error: "Invalid id" }, 400);
+  }
+  const result = await inspectForUser(userId, id);
+  if (!result) {
+    return c.json({ error: "Not found" }, 404);
+  }
+  return c.json(result);
+});
+
+automations.patch("/:id", async (c) => {
+  const userId = c.get("userId");
+  const id = validateParam(c.req.param("id"), "id");
+  if (!id) {
+    return c.json({ error: "Invalid id" }, 400);
+  }
+  const body = (await c.req.json().catch(() => ({}))) as {
+    name?: unknown;
+    description?: unknown;
+    enabled?: unknown;
+  };
+  const patch: { name?: string; description?: string | null; enabled?: boolean } = {};
+  if (typeof body.name === "string") patch.name = body.name;
+  if (typeof body.description === "string" || body.description === null) {
+    patch.description = body.description as string | null;
+  }
+  if (typeof body.enabled === "boolean") patch.enabled = body.enabled;
+
+  const ok = await updateAutomationForUser(userId, id, patch);
+  if (!ok) {
+    return c.json({ error: "Not found" }, 404);
+  }
+  return c.json({ updated: true });
+});
+
+automations.get("/:id/inbox", async (c) => {
+  const userId = c.get("userId");
+  const id = validateParam(c.req.param("id"), "id");
+  if (!id) {
+    return c.json({ error: "Invalid id" }, 400);
+  }
+  const view = await getInboxView(userId, id);
+  if (!view) {
+    return c.json({ error: "Not found" }, 404);
+  }
+  return c.json(view);
+});
+
+automations.post("/:id/run", async (c) => {
+  const userId = c.get("userId");
+  const id = validateParam(c.req.param("id"), "id");
+  if (!id) {
+    return c.json({ error: "Invalid id" }, 400);
+  }
+  const body = (await c.req.json().catch(() => ({}))) as { input?: Record<string, unknown> };
+  const result = await runAutomationById(userId, id, body.input);
+  if (!result) {
+    return c.json({ error: "Not found" }, 404);
+  }
+  return c.json(result);
+});
+
+automations.delete("/:id", async (c) => {
+  const userId = c.get("userId");
+  const id = validateParam(c.req.param("id"), "id");
+  if (!id) {
+    return c.json({ error: "Invalid id" }, 400);
+  }
+  const ok = await removeAutomationForUser(userId, id);
+  if (!ok) {
+    return c.json({ error: "Not found" }, 404);
+  }
+  return c.json({ deleted: true });
+});
+
+export default automations;
diff --git a/packages/agents/src/routes/capabilities.ts b/packages/agents/src/routes/capabilities.ts
index 8284ed93..a0b32c60 100644
--- a/packages/agents/src/routes/capabilities.ts
+++ b/packages/agents/src/routes/capabilities.ts
@@ -1,5 +1,5 @@
 import { Hono } from "hono";
-import { CAPABILITIES, getCapabilities, setCapability } from "@/lib/capabilities";
+import { CAPABILITIES, getCapabilities, setCapability } from "../lib/capabilities";
 import { authMiddleware } from "./middleware";
 import type { AppEnv } from "./types";
 
diff --git a/packages/agents/src/routes/channel-links.ts b/packages/agents/src/routes/channel-links.ts
index 01df57ea..7bf960db 100644
--- a/packages/agents/src/routes/channel-links.ts
+++ b/packages/agents/src/routes/channel-links.ts
@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { Hono } from "hono";
-import { getSupabase } from "@/lib/db";
+import { getSupabase } from "../lib/db";
 import { authMiddleware } from "./middleware";
 import type { AppEnv } from "./types";
 
diff --git a/packages/agents/src/routes/conversations.ts b/packages/agents/src/routes/conversations.ts
index 2913db06..e05a3eb4 100644
--- a/packages/agents/src/routes/conversations.ts
+++ b/packages/agents/src/routes/conversations.ts
@@ -1,15 +1,44 @@
 import { toAISdkV5Messages } from "@mastra/ai-sdk/ui";
 import { Hono } from "hono";
-import { getSupabase } from "@/lib/db";
-import { validateParam } from "@/lib/validation";
-import { getMastra } from "@/mastra";
+import {
+  createShare,
+  getConversationShareToken,
+  getSharedConversation,
+  revokeShare,
+} from "../lib/conversations/share";
+import { getSupabase } from "../lib/db";
+import { validateParam } from "../lib/validation";
+import { getMastra } from "../mastra";
 import { authMiddleware } from "./middleware";
 import type { AppEnv } from "./types";
 
 const conversations = new Hono<AppEnv>();
 
-// All routes require auth
-conversations.use("/*", authMiddleware);
+// Auth everything EXCEPT the public share read (`/conversations/public/:token`),
+// where the token itself is the capability — same model as /documents/public.
+conversations.use("*", (c, next) =>
+  c.req.path.includes("/conversations/public/") ? next() : authMiddleware(c, next),
+);
+
+// Mastra's generateTitle sometimes wraps the title in markdown (`# ...`,
+// `**...**`), prefixes it with a "Title:" label, or returns a whole sentence.
+// Normalize to a clean, short display title; return null for blank input so the
+// UI falls back to its "New conversation" placeholder.
+function cleanTitle(raw: string | null | undefined): string | null {
+  if (!raw) return null;
+  let t = raw.split("\n")[0].trim();
+  t = t
+    .replace(/^#+\s*/, "") // markdown heading
+    .replace(/^>\s*/, "") // blockquote
+    .replace(/^\*+\s*/, "")
+    .replace(/\*+$/, "") // bold markers
+    .replace(/^title:\s*/i, "") // "Title:" label
+    .replace(/^["'“”]+|["'“”]+$/g, "") // wrapping quotes
+    .replace(/\*\*/g, "")
+    .trim();
+  if (!t) return null;
+  return t.length > 60 ? `${t.slice(0, 57).trimEnd()}…` : t;
+}
 
 // POST / — create conversation
 conversations.post("/", async (c) => {
@@ -43,6 +72,9 @@ conversations.post("/", async (c) => {
   await supabase.from("conversation").insert({
     id,
     user_id: userId,
+    // Stamp the active workspace so the chat can later be shared to teammates
+    // (foreman-28cz); visibility defaults to 'private' in the DB.
+    workspace_id: c.get("workspaceId") ?? null,
     mastra_thread_id: id,
     title: null,
     created_at: now,
@@ -52,29 +84,176 @@ conversations.post("/", async (c) => {
   return c.json({ id, mastra_thread_id: id, title: null, created_at: now }, 201);
 });
 
-// GET / — list conversations
+// GET / — list conversations. `?archived=true` returns only archived ones;
+// otherwise archived conversations are excluded from the default history.
 conversations.get("/", async (c) => {
   const userId = c.get("userId");
+  const workspaceId = c.get("workspaceId");
   const supabase = getSupabase();
+  const onlyArchived = c.req.query("archived") === "true";
 
-  const { data: rows } = await supabase
-    .from("conversation")
-    .select("*")
-    .eq("user_id", userId)
-    .order("updated_at", { ascending: false });
+  // The caller's own chats (any visibility) PLUS teammates' workspace-visible
+  // chats in the active workspace (foreman-28cz). userId/workspaceId come from
+  // the validated JWT, not user input, so they're safe to interpolate.
+  const orClause = workspaceId
+    ? `user_id.eq.${userId},and(workspace_id.eq.${workspaceId},visibility.eq.workspace)`
+    : `user_id.eq.${userId}`;
+  let query = supabase.from("conversation").select("*").or(orClause);
+  query = onlyArchived ? query.not("archived_at", "is", null) : query.is("archived_at", null);
+
+  const { data: rows } = await query.order("updated_at", { ascending: false });
+
+  // Surface Mastra's auto-generated thread title in the sidebar when the user
+  // hasn't set an explicit one. Look up titles by thread id (NOT resourceId — a
+  // teammate's shared chat belongs to the OWNER's resourceId, so a resourceId
+  // filter would miss it).
+  const threadIds = (rows ?? []).map((r: any) => r.mastra_thread_id).filter(Boolean);
+  const threadTitle = new Map<string, string>();
+  if (threadIds.length) {
+    const { data: threads } = await supabase
+      .from("mastra_threads")
+      .select("id, title")
+      .in("id", threadIds);
+    for (const t of threads ?? []) threadTitle.set(t.id, t.title);
+  }
 
   return c.json(
     (rows ?? []).map((conv: any) => ({
       id: conv.id,
       mastra_thread_id: conv.mastra_thread_id,
-      title: conv.title,
+      title: (conv.title?.trim() || cleanTitle(threadTitle.get(conv.mastra_thread_id))) ?? null,
       created_at: conv.created_at,
       updated_at: conv.updated_at,
+      archived_at: conv.archived_at ?? null,
+      visibility: conv.visibility ?? "private",
+      is_owner: conv.user_id === userId,
     })),
   );
 });
 
-// GET /:id — get conversation with messages
+// Pull a short, human-readable excerpt out of a stored message around the match.
+// Stored content is JSON text (`{ parts: [...], content: "..." }`); fall back to
+// the raw string if it doesn't parse.
+function searchSnippet(content: string, q: string): string | null {
+  let text = content;
+  try {
+    const parsed = JSON.parse(content);
+    if (typeof parsed?.content === "string") text = parsed.content;
+    else if (Array.isArray(parsed?.parts)) {
+      text = parsed.parts
+        .filter((p: any) => p?.type === "text" && typeof p.text === "string")
+        .map((p: any) => p.text)
+        .join(" ");
+    }
+  } catch {}
+  text = text.trim();
+  if (!text) return null;
+  const idx = text.toLowerCase().indexOf(q.toLowerCase());
+  if (idx === -1) return text.slice(0, 100);
+  const start = Math.max(0, idx - 40);
+  const end = Math.min(text.length, idx + q.length + 60);
+  return `${start > 0 ? "…" : ""}${text.slice(start, end).trim()}${end < text.length ? "…" : ""}`;
+}
+
+// GET /search?q= — search the user's conversations by title and message content.
+// One pass: title matches + content matches (scoped to the user via resourceId),
+// merged and de-duped by conversation, newest first.
+conversations.get("/search", async (c) => {
+  const userId = c.get("userId");
+  const q = (c.req.query("q") ?? "").trim();
+  if (q.length < 2) return c.json({ results: [] });
+
+  const supabase = getSupabase();
+  // Escape LIKE wildcards so a literal % or _ in the query isn't treated as one.
+  const like = `%${q.replace(/[\\%_]/g, (m) => `\\${m}`)}%`;
+
+  const { data: byTitle } = await supabase
+    .from("conversation")
+    .select("id, mastra_thread_id, title, created_at, updated_at, archived_at")
+    .eq("user_id", userId)
+    .ilike("title", like);
+
+  const { data: msgHits } = await supabase
+    .from("mastra_messages")
+    .select("thread_id, content")
+    .eq("resourceId", userId)
+    .ilike("content", like)
+    .limit(200);
+
+  // First matching message per thread → content snippet.
+  const snippetByThread = new Map<string, string | null>();
+  for (const m of msgHits ?? []) {
+    if (!snippetByThread.has(m.thread_id)) {
+      snippetByThread.set(m.thread_id, searchSnippet(m.content, q));
+    }
+  }
+
+  // The sidebar shows Mastra's generated thread title, so search must cover it
+  // too (not just conversation.title + message content). Load the user's thread
+  // titles once — used both to match and to display the right title on results.
+  const { data: threads } = await supabase
+    .from("mastra_threads")
+    .select("id, title")
+    .eq("resourceId", userId);
+  const threadTitle = new Map<string, string>((threads ?? []).map((t: any) => [t.id, t.title]));
+  const qLower = q.toLowerCase();
+  const titleThreadIds = (threads ?? [])
+    .filter((t: any) => typeof t.title === "string" && t.title.toLowerCase().includes(qLower))
+    .map((t: any) => t.id);
+
+  // Threads matched by content or by generated title → their conversations.
+  const matchedThreadIds = new Set<string>([...snippetByThread.keys(), ...titleThreadIds]);
+  let byThread: any[] = [];
+  if (matchedThreadIds.size > 0) {
+    const { data } = await supabase
+      .from("conversation")
+      .select("id, mastra_thread_id, title, created_at, updated_at, archived_at")
+      .eq("user_id", userId)
+      .in("mastra_thread_id", [...matchedThreadIds]);
+    byThread = data ?? [];
+  }
+
+  const merged = new Map<string, any>();
+  for (const conv of byTitle ?? []) merged.set(conv.id, { ...conv, snippet: null });
+  for (const conv of byThread) {
+    const snippet = snippetByThread.get(conv.mastra_thread_id) ?? null;
+    const existing = merged.get(conv.id);
+    if (existing) existing.snippet ??= snippet;
+    else merged.set(conv.id, { ...conv, snippet });
+  }
+
+  const results = [...merged.values()]
+    .sort((a, b) => (a.updated_at < b.updated_at ? 1 : -1))
+    .slice(0, 30)
+    .map((conv) => ({
+      id: conv.id,
+      title: (conv.title?.trim() || cleanTitle(threadTitle.get(conv.mastra_thread_id))) ?? null,
+      created_at: conv.created_at,
+      updated_at: conv.updated_at,
+      archived_at: conv.archived_at ?? null,
+      snippet: conv.snippet,
+    }));
+
+  return c.json({ results });
+});
+
+/** Is `userId` a member of `workspaceId`? Used to gate teammate reads. */
+async function isWorkspaceMember(
+  workspaceId: string | null | undefined,
+  userId: string,
+): Promise<boolean> {
+  if (!workspaceId) return false;
+  const { data } = await getSupabase()
+    .from("workspace_members")
+    .select("workspace_member_id")
+    .eq("workspace_id", workspaceId)
+    .eq("workspace_member_id", userId)
+    .maybeSingle();
+  return !!data;
+}
+
+// GET /:id — get conversation with messages. The owner sees it; a workspace
+// member sees it READ-ONLY when it's shared to the workspace (foreman-28cz).
 conversations.get("/:id", async (c) => {
   const userId = c.get("userId");
   const id = validateParam(c.req.param("id"), "id");
@@ -85,12 +264,18 @@ conversations.get("/:id", async (c) => {
     .from("conversation")
     .select("*")
     .eq("id", id)
-    .eq("user_id", userId)
     .limit(1)
     .maybeSingle();
 
   if (!conv) return c.json({ error: "Not found" }, 404);
 
+  const isOwner = conv.user_id === userId;
+  if (!isOwner) {
+    const shared =
+      conv.visibility === "workspace" && (await isWorkspaceMember(conv.workspace_id, userId));
+    if (!shared) return c.json({ error: "Not found" }, 404);
+  }
+
   // Load messages from Mastra Memory (single source of truth)
   const mastra = getMastra();
   const memory = await mastra.getAgent("foreman").getMemory();
@@ -104,12 +289,13 @@ conversations.get("/:id", async (c) => {
     messages = toAISdkV5Messages(recalled.messages);
   }
 
-  // Sync title from Memory thread
-  let title = conv.title;
-  if (conv.mastra_thread_id && memory) {
+  // Prefer the user's explicit title (rename); otherwise fall back to Mastra's
+  // generated thread title, cleaned. Mirrors the list endpoint's precedence.
+  let title: string | null = conv.title?.trim() || null;
+  if (!title && conv.mastra_thread_id && memory) {
     try {
       const thread = await memory.getThreadById({ threadId: conv.mastra_thread_id });
-      if (thread?.title) title = thread.title;
+      title = cleanTitle(thread?.title);
     } catch {}
   }
 
@@ -120,12 +306,14 @@ conversations.get("/:id", async (c) => {
       title,
       created_at: conv.created_at,
       updated_at: conv.updated_at,
+      visibility: conv.visibility ?? "private",
+      is_owner: isOwner,
     },
     messages,
   });
 });
 
-// PATCH /:id — update conversation title
+// PATCH /:id — update a conversation's title and/or archived state.
 conversations.patch("/:id", async (c) => {
   const userId = c.get("userId");
   const id = validateParam(c.req.param("id"), "id");
@@ -148,15 +336,127 @@ conversations.patch("/:id", async (c) => {
     return c.json({ error: "Invalid JSON" }, 400);
   }
 
-  const title = typeof body.title === "string" ? body.title.trim().slice(0, 80) : undefined;
-  if (!title) return c.json({ error: "title is required" }, 400);
+  const update: {
+    title?: string;
+    archived_at?: string | null;
+    visibility?: string;
+    updated_at: string;
+  } = {
+    updated_at: new Date().toISOString(),
+  };
 
-  await supabase
-    .from("conversation")
-    .update({ title, updated_at: new Date().toISOString() })
-    .eq("id", id);
+  if (typeof body.title === "string") {
+    const title = body.title.trim().slice(0, 80);
+    if (!title) return c.json({ error: "title cannot be empty" }, 400);
+    update.title = title;
+  }
 
-  return c.json({ id, title });
+  // `archived: true` archives (sets the timestamp); `false` restores it.
+  if (typeof body.archived === "boolean") {
+    update.archived_at = body.archived ? new Date().toISOString() : null;
+  }
+
+  // Share to / unshare from the workspace (foreman-28cz). Owner-only — this
+  // handler is already scoped to the owner via the user_id check above.
+  if (typeof body.visibility === "string") {
+    if (!["private", "workspace", "public"].includes(body.visibility)) {
+      return c.json({ error: "visibility must be private, workspace, or public" }, 400);
+    }
+    update.visibility = body.visibility;
+  }
+
+  if (
+    update.title === undefined &&
+    update.archived_at === undefined &&
+    update.visibility === undefined
+  ) {
+    return c.json({ error: "title, archived, or visibility is required" }, 400);
+  }
+
+  await supabase.from("conversation").update(update).eq("id", id);
+
+  return c.json({
+    id,
+    ...(update.title !== undefined ? { title: update.title } : {}),
+    ...(typeof body.archived === "boolean" ? { archived: body.archived } : {}),
+    ...(update.visibility !== undefined ? { visibility: update.visibility } : {}),
+  });
+});
+
+// GET /:id/share — the chat's existing public link, or { token: null } if not
+// shared. Owner-only (createShare/getConversationShareToken gate on user_id).
+conversations.get("/:id/share", async (c) => {
+  const userId = c.get("userId");
+  const id = validateParam(c.req.param("id"), "id");
+  if (!id) return c.json({ error: "Invalid conversation id" }, 400);
+  const existing = await getConversationShareToken(userId, id);
+  if (!existing) return c.json({ token: null });
+  return c.json({
+    token: existing.token,
+    url: `/c/${existing.token}`,
+    expiresAt: existing.expiresAt,
+  });
+});
+
+// POST /:id/share — mint a public share token for a chat the caller owns.
+conversations.post("/:id/share", async (c) => {
+  const userId = c.get("userId");
+  const id = validateParam(c.req.param("id"), "id");
+  if (!id) return c.json({ error: "Invalid conversation id" }, 400);
+
+  const body = (await c.req.json().catch(() => ({}))) as { expiresInDays?: unknown };
+  let expiresInDays: number | undefined;
+  if (body.expiresInDays !== undefined) {
+    const n = Number(body.expiresInDays);
+    if (!Number.isFinite(n) || n <= 0 || n > 3650) {
+      return c.json({ error: "expiresInDays must be a positive number of days (<= 3650)" }, 400);
+    }
+    expiresInDays = n;
+  }
+
+  const share = await createShare(userId, id, { expiresInDays });
+  if (!share) return c.json({ error: "Not found" }, 404);
+  return c.json({ token: share.token, url: `/c/${share.token}`, expiresAt: share.expiresAt }, 201);
+});
+
+// DELETE /shares/:shareToken — revoke a share (owner-only).
+conversations.delete("/shares/:shareToken", async (c) => {
+  const userId = c.get("userId");
+  const token = validateParam(c.req.param("shareToken"), "shareToken");
+  if (!token) return c.json({ error: "Invalid share token" }, 400);
+  const revoked = await revokeShare(userId, token);
+  if (!revoked) return c.json({ error: "Not found" }, 404);
+  return c.json({ revoked: true });
+});
+
+// GET /public/:shareToken — public, logged-out chat read. NO auth: the token is
+// the capability (the auth middleware above exempts this path). The share lib
+// validates the token + resolves the thread; messages are loaded here from Mastra
+// Memory by thread id (recall is not resourceId-gated, so the anonymous read works).
+conversations.get("/public/:shareToken", async (c) => {
+  const token = validateParam(c.req.param("shareToken"), "shareToken");
+  if (!token) return c.json({ error: "Invalid share token" }, 400);
+  const ref = await getSharedConversation(token);
+  if (!ref) return c.json({ error: "Not found" }, 404);
+
+  const memory = await getMastra().getAgent("foreman").getMemory();
+  let messages: unknown[] = [];
+  let title = ref.title;
+  if (ref.threadId && memory) {
+    const recalled = await memory.recall({ threadId: ref.threadId, perPage: false });
+    messages = toAISdkV5Messages(recalled.messages);
+    if (!title) {
+      try {
+        const thread = await memory.getThreadById({ threadId: ref.threadId });
+        title = cleanTitle(thread?.title);
+      } catch {}
+    }
+  }
+
+  return c.json({
+    conversation: { id: ref.conversationId, title, created_at: ref.createdAt },
+    messages,
+  });
 });
 
 // DELETE /:id — delete conversation
diff --git a/packages/agents/src/routes/documents.ts b/packages/agents/src/routes/documents.ts
new file mode 100644
index 00000000..a458ccf3
--- /dev/null
+++ b/packages/agents/src/routes/documents.ts
@@ -0,0 +1,269 @@
+import { RequestContext } from "@mastra/core/request-context";
+import { Hono } from "hono";
+import {
+  createDocumentShare,
+  getDocumentShareToken,
+  getSharedDocument,
+  revokeDocumentShare,
+} from "../lib/documents/share";
+import {
+  canAccessDocPath,
+  type DocSpace,
+  docPath,
+  docsRoot,
+  spaceOfPath,
+} from "../lib/documents/spaces";
+import {
+  getVersionContent,
+  listVersions,
+  recordVersion,
+  restoreVersion,
+} from "../lib/documents/versions";
+import { resolveWorkspaceFilesystem } from "../mastra/agents/workspace";
+import { authMiddleware } from "./middleware";
+import type { AppEnv } from "./types";
+
+/**
+ * Knowledge documents (foreman-aqjx) — the "shared brain" knowledge layer, built
+ * directly on the per-tenant Mastra Workspace filesystem (foreman-jgme) instead
+ * of a bespoke documents table + RAG stack.
+ *
+ * A "document" is just a file under `documents/` in the caller's workspace
+ * filesystem. The agent creates/edits them with its existing approval-gated
+ * Workspace file tools, and shared docs are embedded into the workspace's
+ * `knowledge_<ws>` vector index on save (save_document → indexSharedDoc) so the
+ * agent gets semantic doc-RAG via `mastra_workspace_search`. This route only
+ * needs to LIST and READ them for the web viewer (the KnowledgePanel, which
+ * mirrors the live-preview side panel).
+ *
+ *   GET /documents                       → list documents (files under documents/)
+ *   GET /documents/content?path=documents/foo.md → read one document
+ *
+ * Resolving through `resolveWorkspaceFilesystem` (not node fs) keeps the
+ * containment guarantees and means the route works unchanged when jgme later
+ * swaps LocalFilesystem for S3/AgentFS on cloud deploys.
+ *
+ * Documents live in one of two Spaces (foreman-5e4f): the SHARED `documents/`
+ * (visible to the whole workspace) or the caller's PERSONAL
+ * `_private/<uid>/documents/` (private). `canAccessDocPath` gates every read.
+ */
+const documents = new Hono<AppEnv>();
+// Auth everything EXCEPT the public share read (`/documents/public/:token`),
+// where the token itself is the capability — same model as /apps/public.
+documents.use("*", (c, next) =>
+  c.req.path.includes("/documents/public/") ? next() : authMiddleware(c, next),
+);
+
+/** The caller's per-tenant workspace filesystem, resolved by workspace_id. */
+function resolveFs(workspaceId: string | undefined) {
+  const entries: Array<[string, string]> = [];
+  if (workspaceId) entries.push(["workspaceId", workspaceId]);
+  return resolveWorkspaceFilesystem(new RequestContext(entries));
+}
+
+// GET /documents — list knowledge documents in the caller's workspace: the
+// SHARED space (visible to the whole workspace) plus the caller's own PERSONAL
+// space (foreman-5e4f). Each doc is tagged with its space.
+async function listSpace(
+  fs: NonNullable<Awaited<ReturnType<typeof resolveFs>>>,
+  space: DocSpace,
+  userId: string | undefined,
+) {
+  if (space === "personal" && !userId) return [];
+  const root = docsRoot(space, userId);
+  try {
+    const entries = await fs.readdir(root);
+    return entries
+      .filter((e) => e.type === "file")
+      .map((e) => ({ name: e.name, path: `${root}/${e.name}`, size: e.size, space }));
+  } catch {
+    // dir not created yet — no docs in this space.
+    return [];
+  }
+}
+
+documents.get("/", async (c) => {
+  const fs = await resolveFs(c.get("workspaceId"));
+  if (!fs) {
+    return c.json({ documents: [] });
+  }
+  const userId = c.get("userId");
+  const [shared, personal] = await Promise.all([
+    listSpace(fs, "shared", userId),
+    listSpace(fs, "personal", userId),
+  ]);
+  return c.json({ documents: [...shared, ...personal] });
+});
+
+/** filename/title → a safe document slug (mirrors save_document's slugify). */
+function slugify(title: string): string {
+  const s = title
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 60);
+  return s || "untitled";
+}
+
+// POST /documents/import { name, content, space? } — create a document from an
+// uploaded text/markdown file (foreman-iznn follow-up). The client reads the file
+// as text and posts its content; the server writes it as documents/<slug>.md in
+// the chosen space and snapshots a first version. The slug is derived server-side
+// from the filename, so the client never constructs a path.
+documents.post("/import", async (c) => {
+  const userId = c.get("userId");
+  const body = (await c.req.json().catch(() => ({}))) as {
+    name?: unknown;
+    content?: unknown;
+    space?: unknown;
+  };
+  const name = typeof body.name === "string" ? body.name.trim() : "";
+  const content = typeof body.content === "string" ? body.content : "";
+  if (!name) return c.json({ error: "name is required" }, 400);
+  if (!content) return c.json({ error: "content is required" }, 400);
+  // Guard against oversized payloads (text docs only; ~1MB is generous).
+  if (content.length > 1_000_000) return c.json({ error: "file too large (max ~1MB)" }, 413);
+
+  const space: DocSpace = body.space === "personal" ? "personal" : "shared";
+  const fs = await resolveFs(c.get("workspaceId"));
+  if (!fs) return c.json({ error: "workspace filesystem unavailable" }, 500);
+
+  const title = name.replace(/\.(md|markdown|txt|text)$/i, "").trim() || "Imported document";
+  const path = docPath(space, userId, slugify(title));
+  await fs.writeFile(path, content);
+  // Best-effort version snapshot — a hiccup must not fail the import (live file
+  // is already written, same posture as save_document).
+  try {
+    await recordVersion(fs, path, { title, content });
+  } catch (err) {
+    console.error("import: recordVersion failed (doc still saved)", err);
+  }
+  return c.json({ path, title, space }, 201);
+});
+
+// GET /documents/content?path=… — read one document's content. The path must be
+// a doc the caller may access: a shared documents/ file or their own personal
+// _private/<uid>/documents/ file (canAccessDocPath).
+documents.get("/content", async (c) => {
+  const rel = c.req.query("path") ?? "";
+  if (!canAccessDocPath(rel, c.get("userId"))) {
+    return c.json({ error: "Invalid path" }, 400);
+  }
+  const fs = await resolveFs(c.get("workspaceId"));
+  if (!fs) {
+    return c.json({ error: "Not found" }, 404);
+  }
+  try {
+    const raw = await fs.readFile(rel);
+    const content = typeof raw === "string" ? raw : raw.toString("utf8");
+    return c.json({ path: rel, content, space: spaceOfPath(rel) });
+  } catch {
+    return c.json({ error: "Not found" }, 404);
+  }
+});
+
+// GET /documents/versions?path=… — list a document's revisions (newest first),
+// backed by the per-doc version manifest (foreman-udji).
+documents.get("/versions", async (c) => {
+  const path = c.req.query("path") ?? "";
+  if (!canAccessDocPath(path, c.get("userId"))) {
+    return c.json({ error: "Invalid path" }, 400);
+  }
+  const fs = await resolveFs(c.get("workspaceId"));
+  if (!fs) {
+    return c.json({ current: 0, title: "", versions: [] });
+  }
+  return c.json(await listVersions(fs, path));
+});
+
+// GET /documents/version?path=…&v=2 — read one revision's content from the Mastra
+// BlobStore (only hashes in the caller's manifest are fetched).
+documents.get("/version", async (c) => {
+  const path = c.req.query("path") ?? "";
+  const version = Number(c.req.query("v"));
+  if (!canAccessDocPath(path, c.get("userId")) || !Number.isInteger(version) || version < 1) {
+    return c.json({ error: "Invalid path or version" }, 400);
+  }
+  const fs = await resolveFs(c.get("workspaceId"));
+  if (!fs) {
+    return c.json({ error: "Not found" }, 404);
+  }
+  const result = await getVersionContent(fs, path, version);
+  if (!result) {
+    return c.json({ error: "Not found" }, 404);
+  }
+  return c.json({ path, version, content: result.content });
+});
+
+// POST /documents/restore { path, version } — write an older revision back as the
+// live document (recorded as a new revision so history stays append-only).
+documents.post("/restore", async (c) => {
+  const body = (await c.req.json().catch(() => ({}))) as { path?: string; version?: number };
+  const path = body.path ?? "";
+  const version = Number(body.version);
+  if (!canAccessDocPath(path, c.get("userId")) || !Number.isInteger(version) || version < 1) {
+    return c.json({ error: "Invalid path or version" }, 400);
+  }
+  const fs = await resolveFs(c.get("workspaceId"));
+  if (!fs) {
+    return c.json({ error: "Not found" }, 404);
+  }
+  const manifest = await restoreVersion(fs, path, version);
+  if (!manifest) {
+    return c.json({ error: "Not found" }, 404);
+  }
+  return c.json({ path, current: manifest.current });
+});
+
+// GET /documents/public/:token — read a publicly shared document. NO auth: a
+// valid, unexpired token is the grant (foreman-jz14). Content is read from the
+// owner's workspace fs using the workspace_id stored on the share row.
+documents.get("/public/:token", async (c) => {
+  const doc = await getSharedDocument(c.req.param("token"));
+  if (!doc) {
+    return c.json({ error: "Not found" }, 404);
+  }
+  return c.json(doc);
+});
+
+// GET /documents/share?path=… — the document's current share state (token if
+// shared, else null), so the UI can show "Shared"/"Share".
+documents.get("/share", async (c) => {
+  const path = c.req.query("path") ?? "";
+  if (!canAccessDocPath(path, c.get("userId"))) {
+    return c.json({ error: "Invalid path" }, 400);
+  }
+  const share = await getDocumentShareToken(c.get("workspaceId"), path);
+  return c.json({ share });
+});
+
+// POST /documents/share { path, expiresInDays? } — mint a public share token.
+documents.post("/share", async (c) => {
+  const body = (await c.req.json().catch(() => ({}))) as {
+    path?: string;
+    expiresInDays?: number;
+  };
+  const path = body.path ?? "";
+  const userId = c.get("userId");
+  if (!userId) {
+    return c.json({ error: "Unauthorized" }, 401);
+  }
+  if (!canAccessDocPath(path, userId)) {
+    return c.json({ error: "Invalid path" }, 400);
+  }
+  const share = await createDocumentShare(c.get("workspaceId"), userId, path, {
+    expiresInDays: body.expiresInDays,
+  });
+  if (!share) {
+    return c.json({ error: "Not found" }, 404);
+  }
+  return c.json(share);
+});
+
+// DELETE /documents/share/:token — revoke a share, workspace-scoped.
+documents.delete("/share/:token", async (c) => {
+  const revoked = await revokeDocumentShare(c.get("workspaceId"), c.req.param("token"));
+  return c.json({ revoked });
+});
+
+export default documents;
diff --git a/packages/agents/src/routes/guardrails.ts b/packages/agents/src/routes/guardrails.ts
index 187a95d2..b279374f 100644
--- a/packages/agents/src/routes/guardrails.ts
+++ b/packages/agents/src/routes/guardrails.ts
@@ -1,8 +1,8 @@
 import { Hono } from "hono";
-import { setCapability } from "@/lib/capabilities";
-import { checkAppAccess, checkRateLimit, SENSITIVE_APP_CATEGORIES } from "@/lib/guardrails";
-import { getOrgGuardrailConfig } from "@/lib/guardrails-config";
-import { validateParam } from "@/lib/validation";
+import { setCapability } from "../lib/capabilities";
+import { checkAppAccess, checkRateLimit, SENSITIVE_APP_CATEGORIES } from "../lib/guardrails";
+import { getOrgGuardrailConfig } from "../lib/guardrails-config";
+import { validateParam } from "../lib/validation";
 import { authMiddleware } from "./middleware";
 import type { AppEnv } from "./types";
 
diff --git a/packages/agents/src/routes/index.ts b/packages/agents/src/routes/index.ts
index 1217b3f3..4e8e83aa 100644
--- a/packages/agents/src/routes/index.ts
+++ b/packages/agents/src/routes/index.ts
@@ -5,15 +5,18 @@ import { handleSlackOAuth } from "../slack/oauth";
 import { handleSlackWebhook } from "../slack/webhook";
 import { handleTelegramWebhook } from "../telegram/webhook";
 import apiKeys from "./api-keys";
+import apps from "./apps";
+import automations from "./automations";
 import capabilities from "./capabilities";
 import channelLinks from "./channel-links";
 import conversations from "./conversations";
+import documents from "./documents";
 import guardrails from "./guardrails";
 import proposals from "./proposals";
 import storedAgents from "./stored-agents";
 import voice from "./voice";
 import webhooks from "./webhooks";
-import workflows from "./workflows";
+import workspaces from "./workspaces";
 import zapierConnect, { handleOAuthCallback } from "./zapier-connect";
 
 /**
@@ -38,7 +41,8 @@ app.use(
 );
 app.route("/conversations", conversations);
 app.route("/proposals", proposals);
-app.route("/workflows", workflows);
+app.route("/apps", apps);
+app.route("/documents", documents);
 app.route("/stored/agents", storedAgents);
 app.route("/zapier", zapierConnect);
 app.get("/oauth", handleOAuthCallback);
@@ -48,6 +52,8 @@ app.route("/guardrails", guardrails);
 app.route("/voice", voice);
 app.route("/api-keys", apiKeys);
 app.route("/channel-links", channelLinks);
+app.route("/workspaces", workspaces);
+app.route("/automations", automations);
 app.post("/telegram/webhook", handleTelegramWebhook);
 app.post("/slack/webhook", handleSlackWebhook);
 app.get("/slack/oauth", handleSlackOAuth);
diff --git a/packages/agents/src/routes/middleware.ts b/packages/agents/src/routes/middleware.ts
index 3370732c..69da3dc3 100644
--- a/packages/agents/src/routes/middleware.ts
+++ b/packages/agents/src/routes/middleware.ts
@@ -1,5 +1,5 @@
 import type { MiddlewareHandler } from "hono";
-import { resolveFromRequest } from "@/lib/identity";
+import { resolveFromRequest } from "../lib/identity";
 import type { AppEnv } from "./types";
 
 /**
@@ -19,6 +19,9 @@ export const authMiddleware: MiddlewareHandler<AppEnv> = async (c, next) => {
   }
 
   c.set("userId", identity.userId);
+  if (identity.workspaceId) {
+    c.set("workspaceId", identity.workspaceId);
+  }
   if (identity.orgId) {
     c.set("orgId", identity.orgId);
   }
diff --git a/packages/agents/src/routes/proposals.ts b/packages/agents/src/routes/proposals.ts
index 5d00d992..233acfe8 100644
--- a/packages/agents/src/routes/proposals.ts
+++ b/packages/agents/src/routes/proposals.ts
@@ -1,12 +1,12 @@
 import { Hono } from "hono";
-import { getSupabase } from "@/lib/db";
-import { loadOwnedProposal } from "@/lib/proposals";
-import { indexActionRun } from "@/lib/rag";
-import { encodeSSE, sseHeaders } from "@/lib/stream/sse";
-import type { AppChunk } from "@/lib/stream/types";
-import { validateParam } from "@/lib/validation";
-import { getInputFieldChoices, ZapierReauthRequired } from "@/lib/zapier";
-import { getMastra } from "@/mastra";
+import { getSupabase } from "../lib/db";
+import { loadOwnedProposal } from "../lib/proposals";
+import { indexActionRun } from "../lib/rag";
+import { encodeSSE, sseHeaders } from "../lib/stream/sse";
+import type { AppChunk } from "../lib/stream/types";
+import { validateParam } from "../lib/validation";
+import { getInputFieldChoices, ZapierReauthRequired } from "../lib/zapier";
+import { getMastra } from "../mastra";
 import { authMiddleware } from "./middleware";
 import type { AppEnv } from "./types";
 
diff --git a/packages/agents/src/routes/stored-agents.ts b/packages/agents/src/routes/stored-agents.ts
index 3656a2b9..a91ece51 100644
--- a/packages/agents/src/routes/stored-agents.ts
+++ b/packages/agents/src/routes/stored-agents.ts
@@ -1,8 +1,8 @@
 import { Hono } from "hono";
-import { getSupabase } from "@/lib/db";
-import type { Database } from "@/lib/db/database.types";
-import { getToolCatalog } from "@/lib/tool-catalog";
-import { validateParam } from "@/lib/validation";
+import { getSupabase } from "../lib/db";
+import type { Database } from "../lib/db/database.types";
+import { getToolCatalog } from "../lib/tool-catalog";
+import { validateParam } from "../lib/validation";
 import { authMiddleware } from "./middleware";
 import type { AppEnv } from "./types";
 
@@ -51,13 +51,16 @@ function serializeVersion(v: any) {
   };
 }
 
-async function loadAgent(id: string, userId: string): Promise<any | null> {
+// Agents are a SHARED workspace resource: any member of the workspace can load
+// and edit them (user_id is kept on the row only for creator attribution).
+async function loadAgent(id: string, workspaceId: string | undefined): Promise<any | null> {
+  if (!workspaceId) return null;
   const supabase = getSupabase();
   const { data } = await supabase
     .from("stored_agent")
     .select("*")
     .eq("id", id)
-    .eq("user_id", userId)
+    .eq("workspace_id", workspaceId)
     .limit(1)
     .maybeSingle();
   return data ?? null;
@@ -102,6 +105,8 @@ storedAgents.get("/tools", async (c) => {
 // POST / — create agent and its initial v1 draft
 storedAgents.post("/", async (c) => {
   const userId = c.get("userId");
+  const workspaceId = c.get("workspaceId");
+  if (!workspaceId) return c.json({ error: "No active workspace" }, 403);
   const supabase = getSupabase();
 
   let body: any;
@@ -139,6 +144,7 @@ storedAgents.post("/", async (c) => {
   await supabase.from("stored_agent").insert({
     id: agentId,
     user_id: userId,
+    workspace_id: workspaceId,
     name: name.trim(),
     description: description ?? null,
     current_version_id: null,
@@ -158,20 +164,21 @@ storedAgents.post("/", async (c) => {
     created_at: now,
   });
 
-  const agent = await loadAgent(agentId, userId);
+  const agent = await loadAgent(agentId, workspaceId);
   const latest = await getLatestVersion(agentId);
   return c.json(serializeAgent(agent!, latest), 201);
 });
 
 // GET / — list agents for current user
 storedAgents.get("/", async (c) => {
-  const userId = c.get("userId");
+  const workspaceId = c.get("workspaceId");
+  if (!workspaceId) return c.json([]);
   const supabase = getSupabase();
 
   const { data: agents } = await supabase
     .from("stored_agent")
     .select("*")
-    .eq("user_id", userId)
+    .eq("workspace_id", workspaceId)
     .order("updated_at", { ascending: false });
 
   const results = await Promise.all(
@@ -186,11 +193,11 @@ storedAgents.get("/", async (c) => {
 
 // GET /:id — detail with latest version
 storedAgents.get("/:id", async (c) => {
-  const userId = c.get("userId");
+  const workspaceId = c.get("workspaceId");
   const id = validateParam(c.req.param("id"), "id");
   if (!id) return c.json({ error: "Invalid agent id" }, 400);
 
-  const agent = await loadAgent(id, userId);
+  const agent = await loadAgent(id, workspaceId);
   if (!agent) return c.json({ error: "Not found" }, 404);
   const latest = await getLatestVersion(id);
   return c.json(serializeAgent(agent, latest));
@@ -198,7 +205,7 @@ storedAgents.get("/:id", async (c) => {
 
 // PATCH /:id — update metadata (name, description)
 storedAgents.patch("/:id", async (c) => {
-  const userId = c.get("userId");
+  const workspaceId = c.get("workspaceId");
   const id = validateParam(c.req.param("id"), "id");
   if (!id) return c.json({ error: "Invalid agent id" }, 400);
 
@@ -210,7 +217,7 @@ storedAgents.patch("/:id", async (c) => {
   }
 
   const supabase = getSupabase();
-  const agent = await loadAgent(id, userId);
+  const agent = await loadAgent(id, workspaceId);
   if (!agent) return c.json({ error: "Not found" }, 404);
 
   const patch: Database["public"]["Tables"]["stored_agent"]["Update"] = {};
@@ -239,19 +246,19 @@ storedAgents.patch("/:id", async (c) => {
     .update({ ...patch, updated_at: new Date().toISOString() })
     .eq("id", id);
 
-  const updated = await loadAgent(id, userId);
+  const updated = await loadAgent(id, workspaceId);
   const latest = await getLatestVersion(id);
   return c.json(serializeAgent(updated!, latest));
 });
 
 // DELETE /:id — cascade via FK on version table
 storedAgents.delete("/:id", async (c) => {
-  const userId = c.get("userId");
+  const workspaceId = c.get("workspaceId");
   const id = validateParam(c.req.param("id"), "id");
   if (!id) return c.json({ error: "Invalid agent id" }, 400);
   const supabase = getSupabase();
 
-  const agent = await loadAgent(id, userId);
+  const agent = await loadAgent(id, workspaceId);
   if (!agent) return c.json({ error: "Not found" }, 404);
 
   // Null out current_version_id first to avoid FK conflicts
@@ -265,12 +272,12 @@ storedAgents.delete("/:id", async (c) => {
 
 // GET /:id/versions — all versions, newest first
 storedAgents.get("/:id/versions", async (c) => {
-  const userId = c.get("userId");
+  const workspaceId = c.get("workspaceId");
   const id = validateParam(c.req.param("id"), "id");
   if (!id) return c.json({ error: "Invalid agent id" }, 400);
   const supabase = getSupabase();
 
-  const agent = await loadAgent(id, userId);
+  const agent = await loadAgent(id, workspaceId);
   if (!agent) return c.json({ error: "Not found" }, 404);
 
   const { data: versions } = await supabase
@@ -284,13 +291,13 @@ storedAgents.get("/:id/versions", async (c) => {
 
 // GET /:id/versions/:versionId
 storedAgents.get("/:id/versions/:versionId", async (c) => {
-  const userId = c.get("userId");
+  const workspaceId = c.get("workspaceId");
   const id = validateParam(c.req.param("id"), "id");
   const versionId = validateParam(c.req.param("versionId"), "versionId");
   if (!id || !versionId) return c.json({ error: "Invalid id" }, 400);
   const supabase = getSupabase();
 
-  const agent = await loadAgent(id, userId);
+  const agent = await loadAgent(id, workspaceId);
   if (!agent) return c.json({ error: "Not found" }, 404);
 
   const { data: v } = await supabase
@@ -306,7 +313,7 @@ storedAgents.get("/:id/versions/:versionId", async (c) => {
 
 // POST /:id/versions — create a new draft
 storedAgents.post("/:id/versions", async (c) => {
-  const userId = c.get("userId");
+  const workspaceId = c.get("workspaceId");
   const id = validateParam(c.req.param("id"), "id");
   if (!id) return c.json({ error: "Invalid agent id" }, 400);
 
@@ -316,7 +323,7 @@ storedAgents.post("/:id/versions", async (c) => {
   } catch {}
 
   const supabase = getSupabase();
-  const agent = await loadAgent(id, userId);
+  const agent = await loadAgent(id, workspaceId);
   if (!agent) return c.json({ error: "Not found" }, 404);
 
   const latest = await getLatestVersion(id);
@@ -367,7 +374,7 @@ storedAgents.post("/:id/versions", async (c) => {
 
 // PATCH /:id/versions/:versionId — edit draft content
 storedAgents.patch("/:id/versions/:versionId", async (c) => {
-  const userId = c.get("userId");
+  const workspaceId = c.get("workspaceId");
   const id = validateParam(c.req.param("id"), "id");
   const versionId = validateParam(c.req.param("versionId"), "versionId");
   if (!id || !versionId) return c.json({ error: "Invalid id" }, 400);
@@ -380,7 +387,7 @@ storedAgents.patch("/:id/versions/:versionId", async (c) => {
   }
 
   const supabase = getSupabase();
-  const agent = await loadAgent(id, userId);
+  const agent = await loadAgent(id, workspaceId);
   if (!agent) return c.json({ error: "Not found" }, 404);
 
   const { data: v } = await supabase
@@ -443,13 +450,13 @@ storedAgents.patch("/:id/versions/:versionId", async (c) => {
 
 // POST /:id/versions/:versionId/publish
 storedAgents.post("/:id/versions/:versionId/publish", async (c) => {
-  const userId = c.get("userId");
+  const workspaceId = c.get("workspaceId");
   const id = validateParam(c.req.param("id"), "id");
   const versionId = validateParam(c.req.param("versionId"), "versionId");
   if (!id || !versionId) return c.json({ error: "Invalid id" }, 400);
   const supabase = getSupabase();
 
-  const agent = await loadAgent(id, userId);
+  const agent = await loadAgent(id, workspaceId);
   if (!agent) return c.json({ error: "Not found" }, 404);
 
   const { data: v } = await supabase
@@ -476,7 +483,7 @@ storedAgents.post("/:id/versions/:versionId/publish", async (c) => {
     .eq("id", versionId)
     .limit(1)
     .single();
-  const updatedAgent = await loadAgent(id, userId);
+  const updatedAgent = await loadAgent(id, workspaceId);
   return c.json({
     agent: serializeAgent(updatedAgent!, updatedVersion),
     version: serializeVersion(updatedVersion),
diff --git a/packages/agents/src/routes/types.ts b/packages/agents/src/routes/types.ts
index 9d8660d7..27e0428c 100644
--- a/packages/agents/src/routes/types.ts
+++ b/packages/agents/src/routes/types.ts
@@ -3,6 +3,7 @@ import type { Env } from "hono";
 export interface AppEnv extends Env {
   Variables: {
     userId: string;
+    workspaceId?: string;
     orgId?: string;
     session: {
       id: string;
diff --git a/packages/agents/src/routes/voice.ts b/packages/agents/src/routes/voice.ts
index 0ec33f46..fccfc092 100644
--- a/packages/agents/src/routes/voice.ts
+++ b/packages/agents/src/routes/voice.ts
@@ -1,6 +1,6 @@
 import { Hono } from "hono";
-import { checkCapability } from "@/lib/capabilities";
-import { speechToText } from "@/lib/voice";
+import { checkCapability } from "../lib/capabilities";
+import { speechToText } from "../lib/voice";
 import { authMiddleware } from "./middleware";
 import type { AppEnv } from "./types";
 
diff --git a/packages/agents/src/routes/webhooks.ts b/packages/agents/src/routes/webhooks.ts
index c8b98538..db44abab 100644
--- a/packages/agents/src/routes/webhooks.ts
+++ b/packages/agents/src/routes/webhooks.ts
@@ -1,6 +1,6 @@
 import { Hono } from "hono";
-import { getMastra } from "@/mastra";
-import type { WebhookPayload } from "@/workflows/webhook-handler";
+import { getMastra } from "../mastra";
+import type { WebhookPayload } from "../workflows/webhook-handler";
 
 const webhooks = new Hono();
 
@@ -39,15 +39,17 @@ webhooks.post("/zapier", async (c) => {
   const mastra = getMastra();
   const workflow = mastra.getWorkflow("webhookHandler");
 
-  workflow
-    .createRun()
-    .start({ inputData: payload })
-    .then((result) => {
+  // createRun() is async in this Mastra version — await the run before start().
+  // Kept fire-and-forget (not awaited) so the webhook still returns 200 at once.
+  void (async () => {
+    try {
+      const run = await workflow.createRun();
+      const result = await run.start({ inputData: payload });
       console.log(`[Webhook] Workflow completed:`, JSON.stringify(result));
-    })
-    .catch((err) => {
+    } catch (err) {
       console.error(`[Webhook] Workflow failed:`, err);
-    });
+    }
+  })();
 
   return c.json({ received: true }, 200);
 });
diff --git a/packages/agents/src/routes/workflows.ts b/packages/agents/src/routes/workflows.ts
deleted file mode 100644
index b631c889..00000000
--- a/packages/agents/src/routes/workflows.ts
+++ /dev/null
@@ -1,543 +0,0 @@
-import { Hono } from "hono";
-import { getSupabase } from "@/lib/db";
-import type { Database } from "@/lib/db/database.types";
-import { encodeSSE, sseHeaders } from "@/lib/stream/sse";
-import { validateParam } from "@/lib/validation";
-import { executeWorkflow } from "@/lib/workflows/engine";
-import { extractParams } from "@/lib/workflows/params";
-import { saveWorkflowFromConversation } from "@/lib/workflows/save";
-import { authMiddleware } from "./middleware";
-import type { AppEnv } from "./types";
-
-const workflows = new Hono<AppEnv>();
-
-// All routes require auth
-workflows.use("/*", authMiddleware);
-
-// POST / — create workflow from a conversation
-workflows.post("/", async (c) => {
-  const userId = c.get("userId");
-  const orgId = c.get("orgId");
-
-  let body: any;
-  try {
-    body = await c.req.json();
-  } catch {
-    return c.json({ error: "Invalid JSON body" }, 400);
-  }
-
-  const { conversationId, name } = body;
-  if (!conversationId || typeof conversationId !== "string") {
-    return c.json({ error: "conversationId is required" }, 400);
-  }
-  if (!name || typeof name !== "string" || name.length > 200) {
-    return c.json({ error: "name is required (max 200 chars)" }, 400);
-  }
-
-  try {
-    const result = await saveWorkflowFromConversation(conversationId, userId, name, orgId);
-    return c.json(result, 201);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    return c.json({ error: msg }, 400);
-  }
-});
-
-// GET / — list workflows for current user
-workflows.get("/", async (c) => {
-  const userId = c.get("userId");
-  const supabase = getSupabase();
-
-  const { data: rows } = await supabase
-    .from("workflow")
-    .select("*")
-    .eq("user_id", userId)
-    .order("updated_at", { ascending: false });
-
-  return c.json(
-    (rows ?? []).map((w: any) => ({
-      id: w.id,
-      name: w.name,
-      source_conversation_id: w.source_conversation_id,
-      parameters: JSON.parse(w.parameters),
-      created_at: w.created_at,
-      updated_at: w.updated_at,
-    })),
-  );
-});
-
-// GET /templates — list all public workflow templates
-workflows.get("/templates", async (c) => {
-  const supabase = getSupabase();
-
-  const { data: rows } = await supabase
-    .from("workflow")
-    .select("*")
-    .eq("is_template", true)
-    .order("updated_at", { ascending: false });
-
-  return c.json(
-    (rows ?? []).map((w: any) => ({
-      id: w.id,
-      name: w.name,
-      owner_user_id: w.user_id,
-      parameters: JSON.parse(w.parameters),
-      created_at: w.created_at,
-      updated_at: w.updated_at,
-    })),
-  );
-});
-
-// DELETE /:id — irreversible. Cascades to workflow_step + workflow_run.
-workflows.delete("/:id", async (c) => {
-  const userId = c.get("userId");
-  const id = validateParam(c.req.param("id"), "id");
-  if (!id) {
-    return c.json({ error: "Invalid workflow id" }, 400);
-  }
-  const supabase = getSupabase();
-
-  // Verify ownership before deleting anything
-  const { data: existing } = await supabase
-    .from("workflow")
-    .select("id")
-    .eq("id", id)
-    .eq("user_id", userId)
-    .limit(1)
-    .maybeSingle();
-  if (!existing) {
-    return c.json({ error: "Not found" }, 404);
-  }
-
-  // Cascade manually: runs → steps → workflow.
-  // (FK cascade isn't declared on the schema today; explicit delete keeps
-  // the data path obvious and avoids surprises if migrations diverge.)
-  await supabase.from("workflow_run").delete().eq("workflow_id", id);
-  await supabase.from("workflow_step").delete().eq("workflow_id", id);
-  await supabase.from("workflow").delete().eq("id", id);
-
-  return c.json({ ok: true, id });
-});
-
-// PATCH /:id — update workflow metadata
-workflows.patch("/:id", async (c) => {
-  const userId = c.get("userId");
-  const id = validateParam(c.req.param("id"), "id");
-  if (!id) {
-    return c.json({ error: "Invalid workflow id" }, 400);
-  }
-
-  let body: any;
-  try {
-    body = await c.req.json();
-  } catch {
-    return c.json({ error: "Invalid JSON body" }, 400);
-  }
-
-  const supabase = getSupabase();
-  const { data: existing } = await supabase
-    .from("workflow")
-    .select("id, is_template")
-    .eq("id", id)
-    .eq("user_id", userId)
-    .limit(1)
-    .maybeSingle();
-
-  if (!existing) {
-    return c.json({ error: "Not found" }, 404);
-  }
-
-  const patch: Database["public"]["Tables"]["workflow"]["Update"] = {
-    updated_at: new Date().toISOString(),
-  };
-  if (typeof body.is_template === "boolean") {
-    patch.is_template = body.is_template;
-  }
-  if (typeof body.name === "string" && body.name.trim().length > 0) {
-    patch.name = body.name.trim();
-  }
-
-  await supabase.from("workflow").update(patch).eq("id", id);
-
-  return c.json({ ok: true, id, ...patch });
-});
-
-// POST /:id/clone — clone a template into caller's workspace
-workflows.post("/:id/clone", async (c) => {
-  const userId = c.get("userId");
-  const sourceId = validateParam(c.req.param("id"), "id");
-  if (!sourceId) {
-    return c.json({ error: "Invalid workflow id" }, 400);
-  }
-  const supabase = getSupabase();
-
-  const { data: source } = await supabase
-    .from("workflow")
-    .select("*")
-    .eq("id", sourceId)
-    .limit(1)
-    .maybeSingle();
-
-  if (!source) {
-    return c.json({ error: "Not found" }, 404);
-  }
-
-  if (!source.is_template && source.user_id !== userId) {
-    return c.json({ error: "Workflow is not a public template" }, 403);
-  }
-
-  const { data: sourceSteps } = await supabase
-    .from("workflow_step")
-    .select("*")
-    .eq("workflow_id", sourceId)
-    .order("order", { ascending: true });
-
-  const newWorkflowId = crypto.randomUUID();
-  const now = new Date().toISOString();
-
-  await supabase.from("workflow").insert({
-    id: newWorkflowId,
-    user_id: userId,
-    name: source.name,
-    source_conversation_id: null,
-    parameters: source.parameters,
-    is_template: false,
-    cloned_from: sourceId,
-    created_at: now,
-    updated_at: now,
-  });
-
-  const newSteps = (sourceSteps ?? []).map((s: any) => {
-    const template = JSON.parse(s.proposal_template) as Record<string, unknown>;
-    const rawConnection = template.connectionId;
-    if (
-      typeof rawConnection === "number" ||
-      (typeof rawConnection === "string" && /^\d+$/.test(rawConnection))
-    ) {
-      delete template.connectionId;
-    }
-    return {
-      id: crypto.randomUUID(),
-      workflow_id: newWorkflowId,
-      order: s.order,
-      proposal_template: JSON.stringify(template),
-    };
-  });
-
-  if (newSteps.length > 0) {
-    await supabase.from("workflow_step").insert(newSteps);
-  }
-
-  return c.json({ id: newWorkflowId, cloned_from: sourceId }, 201);
-});
-
-// GET /:id — get workflow with steps
-workflows.get("/:id", async (c) => {
-  const userId = c.get("userId");
-  const id = validateParam(c.req.param("id"), "id");
-  if (!id) {
-    return c.json({ error: "Invalid workflow id" }, 400);
-  }
-  const supabase = getSupabase();
-
-  const { data: wf } = await supabase
-    .from("workflow")
-    .select("*")
-    .eq("id", id)
-    .eq("user_id", userId)
-    .limit(1)
-    .maybeSingle();
-
-  if (!wf) {
-    return c.json({ error: "Not found" }, 404);
-  }
-
-  const { data: steps } = await supabase
-    .from("workflow_step")
-    .select("*")
-    .eq("workflow_id", id)
-    .order("order", { ascending: true });
-
-  const liveParams = new Set<string>();
-  const parsedSteps = (steps ?? []).map((s: any) => {
-    const template = JSON.parse(s.proposal_template) as Record<string, unknown>;
-    const inputs = (template.inputs ?? {}) as Record<string, unknown>;
-    for (const p of extractParams(inputs)) {
-      liveParams.add(p);
-    }
-    return { id: s.id, order: s.order, proposal_template: template };
-  });
-
-  return c.json({
-    workflow: {
-      id: wf.id,
-      name: wf.name,
-      source_conversation_id: wf.source_conversation_id,
-      parameters: [...liveParams],
-      created_at: wf.created_at,
-      updated_at: wf.updated_at,
-    },
-    steps: parsedSteps,
-  });
-});
-
-// GET /:id/runs — list past runs
-workflows.get("/:id/runs", async (c) => {
-  const userId = c.get("userId");
-  const id = validateParam(c.req.param("id"), "id");
-  if (!id) {
-    return c.json({ error: "Invalid workflow id" }, 400);
-  }
-  const supabase = getSupabase();
-
-  const { data: wf } = await supabase
-    .from("workflow")
-    .select("id")
-    .eq("id", id)
-    .eq("user_id", userId)
-    .limit(1)
-    .maybeSingle();
-
-  if (!wf) {
-    return c.json({ error: "Not found" }, 404);
-  }
-
-  const { data: runs } = await supabase
-    .from("workflow_run")
-    .select("*")
-    .eq("workflow_id", id)
-    .order("created_at", { ascending: false });
-
-  return c.json(
-    (runs ?? []).map((r: any) => ({
-      id: r.id,
-      workflow_id: r.workflow_id,
-      inputs: JSON.parse(r.inputs),
-      status: r.status,
-      created_at: r.created_at,
-      completed_at: r.completed_at ?? null,
-      error_message: r.error_message ?? null,
-      fired_by: r.fired_by ?? null,
-      trigger_id: r.trigger_id ?? null,
-    })),
-  );
-});
-
-// POST /:id/run — start a workflow run, stream SSE status updates
-workflows.post("/:id/run", async (c) => {
-  const userId = c.get("userId");
-  const workflowId = validateParam(c.req.param("id"), "id");
-  if (!workflowId) {
-    return c.json({ error: "Invalid workflow id" }, 400);
-  }
-  const supabase = getSupabase();
-
-  const { data: wf } = await supabase
-    .from("workflow")
-    .select("id")
-    .eq("id", workflowId)
-    .eq("user_id", userId)
-    .limit(1)
-    .maybeSingle();
-
-  if (!wf) {
-    return c.json({ error: "Not found" }, 404);
-  }
-
-  let body: any;
-  try {
-    body = await c.req.json();
-  } catch {
-    body = {};
-  }
-  const inputs = body.inputs ?? {};
-
-  const inputsStr = JSON.stringify(inputs);
-  if (inputsStr.length > 50000) {
-    return c.json({ error: "inputs payload too large (max 50KB)" }, 400);
-  }
-
-  const orgId = c.get("orgId");
-
-  const sseStream = new ReadableStream({
-    async start(controller) {
-      try {
-        for await (const event of executeWorkflow(workflowId, userId, inputs, orgId)) {
-          controller.enqueue(encodeSSE(event as any));
-        }
-      } catch (err) {
-        controller.enqueue(
-          encodeSSE({
-            type: "error",
-            code: "WORKFLOW_RUN_ERROR",
-            message: err instanceof Error ? err.message : String(err),
-          }),
-        );
-      } finally {
-        controller.close();
-      }
-    },
-  });
-
-  const headers = sseHeaders();
-  return new Response(sseStream, { headers });
-});
-
-// ─── Triggers ─────────────────────────────────────────────────────────────
-//
-// Triggers bind a saved workflow to an external event source. Three types:
-//   cron     — scheduled (config: { schedule, timezone? })
-//   channel  — chat-channel match (config: { channel, match })
-//   poll     — Zapier read action diffed by dedupeKey (deferred)
-//
-// Cron + poll are driven by a worker process. Channel triggers are matched
-// in-line by the channel webhook handlers. The agent uses these routes via
-// attach_trigger / list_workflow_triggers / detach_trigger tools.
-
-const TRIGGER_TYPES = new Set(["cron", "channel", "poll"]);
-
-// POST /:id/triggers — attach a trigger to a workflow
-workflows.post("/:id/triggers", async (c) => {
-  const userId = c.get("userId");
-  const workflowId = validateParam(c.req.param("id"), "id");
-  if (!workflowId) return c.json({ error: "Invalid workflow id" }, 400);
-
-  let body: any;
-  try {
-    body = await c.req.json();
-  } catch {
-    return c.json({ error: "Invalid JSON body" }, 400);
-  }
-  const { type, config, enabled } = body;
-  if (typeof type !== "string" || !TRIGGER_TYPES.has(type)) {
-    return c.json({ error: "type must be one of: cron, channel, poll" }, 400);
-  }
-  if (!config || typeof config !== "object") {
-    return c.json({ error: "config (object) is required" }, 400);
-  }
-
-  const supabase = getSupabase();
-  const { data: wf } = await supabase
-    .from("workflow")
-    .select("id")
-    .eq("id", workflowId)
-    .eq("user_id", userId)
-    .limit(1)
-    .maybeSingle();
-  if (!wf) return c.json({ error: "Not found" }, 404);
-
-  const id = crypto.randomUUID();
-  const now = new Date().toISOString();
-  const { error } = await supabase.from("workflow_trigger").insert({
-    id,
-    workflow_id: workflowId,
-    type,
-    config: JSON.stringify(config),
-    enabled: typeof enabled === "boolean" ? enabled : true,
-    created_at: now,
-    updated_at: now,
-  });
-  if (error) return c.json({ error: error.message }, 500);
-
-  return c.json({ id, type, config, enabled: enabled !== false }, 201);
-});
-
-// GET /:id/triggers — list triggers for a workflow
-workflows.get("/:id/triggers", async (c) => {
-  const userId = c.get("userId");
-  const workflowId = validateParam(c.req.param("id"), "id");
-  if (!workflowId) return c.json({ error: "Invalid workflow id" }, 400);
-
-  const supabase = getSupabase();
-  const { data: wf } = await supabase
-    .from("workflow")
-    .select("id")
-    .eq("id", workflowId)
-    .eq("user_id", userId)
-    .limit(1)
-    .maybeSingle();
-  if (!wf) return c.json({ error: "Not found" }, 404);
-
-  const { data: rows } = await supabase
-    .from("workflow_trigger")
-    .select("*")
-    .eq("workflow_id", workflowId)
-    .order("created_at", { ascending: true });
-
-  return c.json(
-    (rows ?? []).map((t: any) => ({
-      id: t.id,
-      type: t.type,
-      config: JSON.parse(t.config),
-      enabled: t.enabled,
-      lastFiredAt: t.last_fired_at,
-      createdAt: t.created_at,
-      updatedAt: t.updated_at,
-    })),
-  );
-});
-
-// PATCH /:id/triggers/:triggerId — toggle a trigger's enabled flag
-workflows.patch("/:id/triggers/:triggerId", async (c) => {
-  const userId = c.get("userId");
-  const workflowId = validateParam(c.req.param("id"), "id");
-  const triggerId = validateParam(c.req.param("triggerId"), "triggerId");
-  if (!workflowId || !triggerId) return c.json({ error: "Invalid id" }, 400);
-
-  let body: any;
-  try {
-    body = await c.req.json();
-  } catch {
-    return c.json({ error: "Invalid JSON body" }, 400);
-  }
-  if (typeof body.enabled !== "boolean") {
-    return c.json({ error: "enabled (boolean) is required" }, 400);
-  }
-
-  const supabase = getSupabase();
-  const { data: wf } = await supabase
-    .from("workflow")
-    .select("id")
-    .eq("id", workflowId)
-    .eq("user_id", userId)
-    .limit(1)
-    .maybeSingle();
-  if (!wf) return c.json({ error: "Not found" }, 404);
-
-  await supabase
-    .from("workflow_trigger")
-    .update({ enabled: body.enabled, updated_at: new Date().toISOString() })
-    .eq("id", triggerId)
-    .eq("workflow_id", workflowId);
-
-  return c.json({ ok: true, id: triggerId, enabled: body.enabled });
-});
-
-// DELETE /:id/triggers/:triggerId — detach a trigger
-workflows.delete("/:id/triggers/:triggerId", async (c) => {
-  const userId = c.get("userId");
-  const workflowId = validateParam(c.req.param("id"), "id");
-  const triggerId = validateParam(c.req.param("triggerId"), "triggerId");
-  if (!workflowId || !triggerId) return c.json({ error: "Invalid id" }, 400);
-
-  const supabase = getSupabase();
-  // Ownership check via workflow → user
-  const { data: wf } = await supabase
-    .from("workflow")
-    .select("id")
-    .eq("id", workflowId)
-    .eq("user_id", userId)
-    .limit(1)
-    .maybeSingle();
-  if (!wf) return c.json({ error: "Not found" }, 404);
-
-  await supabase
-    .from("workflow_trigger")
-    .delete()
-    .eq("id", triggerId)
-    .eq("workflow_id", workflowId);
-
-  return c.json({ ok: true, id: triggerId });
-});
-
-export default workflows;
diff --git a/packages/agents/src/routes/workspaces.ts b/packages/agents/src/routes/workspaces.ts
new file mode 100644
index 00000000..127bae0c
--- /dev/null
+++ b/packages/agents/src/routes/workspaces.ts
@@ -0,0 +1,584 @@
+import { randomUUID } from "node:crypto";
+import { Hono } from "hono";
+import { getSupabase } from "../lib/db";
+import { validateParam } from "../lib/validation";
+import { authMiddleware } from "./middleware";
+import type { AppEnv } from "./types";
+
+/**
+ * Workspace management routes (multi-tenant step 5, foreman-c24s).
+ *
+ * Foreman's web client is RLS-scoped and CANNOT write the active-workspace
+ * pointer (public."user".default_workspace_id lives on an RLS-locked,
+ * service-role-only surface). It also can't see co-member profiles or act on
+ * invitations as a not-yet-member invitee. So — matching Foreman's dominant
+ * pattern (web → agent server via fetch, like /stored/agents and /apps) —
+ * ALL workspace operations run here on the service_role client, with membership
+ * and admin checks enforced in code.
+ */
+const workspaces = new Hono<AppEnv>();
+
+workspaces.use("/*", authMiddleware);
+
+const ADMIN_ROLES = new Set(["owner", "admin"]);
+// owner is not assignable via UI. Tuple + type guard so a validated string
+// narrows to the role union the DB columns expect (no cast at the write site).
+const ASSIGNABLE_ROLES = ["admin", "member", "readonly"] as const;
+type AssignableRole = (typeof ASSIGNABLE_ROLES)[number];
+const isAssignableRole = (v: string): v is AssignableRole =>
+  (ASSIGNABLE_ROLES as readonly string[]).includes(v);
+const CONNECTION_MODES = new Set(["member-first", "shared", "personal"]);
+const MAX_NAME_LEN = 120;
+
+/** The caller's role in a workspace, or null if they're not a member. */
+async function memberRole(workspaceId: string, userId: string): Promise<string | null> {
+  const supabase = getSupabase();
+  const { data } = await supabase
+    .from("workspace_members")
+    .select("workspace_member_role")
+    .eq("workspace_id", workspaceId)
+    .eq("workspace_member_id", userId)
+    .maybeSingle();
+  return (data?.workspace_member_role as string | undefined) ?? null;
+}
+
+function slugify(name: string): string {
+  const base =
+    name
+      .toLowerCase()
+      .replace(/[^a-z0-9]+/g, "-")
+      .replace(/^-+|-+$/g, "") || "workspace";
+  return `${base}-${randomUUID().slice(0, 8)}`;
+}
+
+/** The caller's email (for matching email-addressed invitations). */
+async function callerEmail(userId: string): Promise<string | null> {
+  const supabase = getSupabase();
+  const { data } = await supabase.auth.admin.getUserById(userId);
+  return data?.user?.email ?? null;
+}
+
+// ─── My workspaces ───
+
+// GET / — workspaces the caller belongs to, with their role + which is active.
+workspaces.get("/", async (c) => {
+  const userId = c.get("userId");
+  const supabase = getSupabase();
+
+  const [{ data: rows }, { data: principal }] = await Promise.all([
+    supabase
+      .from("workspace_members")
+      .select("workspace_member_role, workspaces(id, slug, name, membership_type, created_at)")
+      .eq("workspace_member_id", userId),
+    supabase.from("user").select("default_workspace_id").eq("id", userId).maybeSingle(),
+  ]);
+
+  const activeId = (principal?.default_workspace_id as string | null) ?? null;
+  const result = (rows ?? [])
+    .map((r: any) => {
+      const w = r.workspaces;
+      if (!w) return null;
+      return {
+        id: w.id,
+        slug: w.slug,
+        name: w.name,
+        membership_type: w.membership_type,
+        role: r.workspace_member_role,
+        is_active: w.id === activeId,
+        created_at: w.created_at,
+      };
+    })
+    .filter(Boolean);
+
+  return c.json({ workspaces: result, active_workspace_id: activeId });
+});
+
+// POST / — create a team workspace and make the caller its owner.
+workspaces.post("/", async (c) => {
+  const userId = c.get("userId");
+  const body = (await c.req.json().catch(() => ({}))) as { name?: unknown; setActive?: unknown };
+  const name = typeof body.name === "string" ? body.name.trim() : "";
+  if (!name || name.length > MAX_NAME_LEN) {
+    return c.json({ error: "name is required (max 120 chars)" }, 400);
+  }
+
+  const supabase = getSupabase();
+  const id = randomUUID();
+  // companion rows (settings/credits) are created by the on_workspace_created trigger.
+  const { error: wsErr } = await supabase
+    .from("workspaces")
+    .insert({ id, slug: slugify(name), name, membership_type: "team" });
+  if (wsErr) return c.json({ error: `Failed to create workspace: ${wsErr.message}` }, 500);
+
+  const { error: memErr } = await supabase
+    .from("workspace_members")
+    .insert({ workspace_id: id, workspace_member_id: userId, workspace_member_role: "owner" });
+  if (memErr) return c.json({ error: `Failed to add owner: ${memErr.message}` }, 500);
+
+  if (body.setActive) {
+    await supabase.from("user").update({ default_workspace_id: id }).eq("id", userId);
+  }
+  return c.json({ id, name }, 201);
+});
+
+// POST /switch — set the caller's active workspace (the agent reads
+// user.default_workspace_id). Must be a member of the target.
+workspaces.post("/switch", async (c) => {
+  const userId = c.get("userId");
+  const body = (await c.req.json().catch(() => ({}))) as { workspaceId?: unknown };
+  const workspaceId = typeof body.workspaceId === "string" ? body.workspaceId : "";
+  if (!validateParam(workspaceId, "workspaceId")) {
+    return c.json({ error: "workspaceId is required" }, 400);
+  }
+  if (!(await memberRole(workspaceId, userId))) {
+    return c.json({ error: "Not a member of that workspace" }, 403);
+  }
+  const supabase = getSupabase();
+  const { error } = await supabase
+    .from("user")
+    .update({ default_workspace_id: workspaceId })
+    .eq("id", userId);
+  if (error) return c.json({ error: `Failed to switch: ${error.message}` }, 500);
+  return c.json({ active_workspace_id: workspaceId });
+});
+
+// ─── Invitee-side (the caller is the invitee, not yet a member) ───
+
+// GET /invitations/mine — pending invitations addressed to the caller's email.
+workspaces.get("/invitations/mine", async (c) => {
+  const userId = c.get("userId");
+  const email = await callerEmail(userId);
+  if (!email) return c.json({ invitations: [] });
+  const supabase = getSupabase();
+  const { data } = await supabase
+    .from("workspace_invitations")
+    .select("id, invitee_user_role, created_at, workspaces(id, slug, name)")
+    .eq("invitee_user_email", email)
+    .eq("status", "pending");
+  const invitations = (data ?? []).map((r: any) => ({
+    id: r.id,
+    role: r.invitee_user_role,
+    created_at: r.created_at,
+    workspace: r.workspaces
+      ? { id: r.workspaces.id, slug: r.workspaces.slug, name: r.workspaces.name }
+      : null,
+  }));
+  return c.json({ invitations });
+});
+
+// POST /invitations/:id/accept — accept; the DB trigger creates the membership.
+workspaces.post("/invitations/:id/accept", async (c) => {
+  const userId = c.get("userId");
+  const id = validateParam(c.req.param("id"), "id");
+  if (!id) return c.json({ error: "Invalid invitation id" }, 400);
+  const email = await callerEmail(userId);
+  const supabase = getSupabase();
+
+  const { data: inv } = await supabase
+    .from("workspace_invitations")
+    .select("id, invitee_user_email, status")
+    .eq("id", id)
+    .maybeSingle();
+  if (!inv) return c.json({ error: "Not found" }, 404);
+  if (inv.status !== "pending") return c.json({ error: "Not found" }, 404);
+  if (email && inv.invitee_user_email !== email)
+    return c.json({ error: "Not your invitation" }, 403);
+
+  // Set invitee_user_id THEN flip status — the accept trigger reads invitee_user_id.
+  const { error } = await supabase
+    .from("workspace_invitations")
+    .update({
+      invitee_user_id: userId,
+      status: "finished_accepted",
+      updated_at: new Date().toISOString(),
+    })
+    .eq("id", id);
+  if (error) return c.json({ error: `Failed to accept: ${error.message}` }, 500);
+  return c.json({ ok: true });
+});
+
+// POST /invitations/:id/decline
+workspaces.post("/invitations/:id/decline", async (c) => {
+  const userId = c.get("userId");
+  const id = validateParam(c.req.param("id"), "id");
+  if (!id) return c.json({ error: "Invalid invitation id" }, 400);
+  const email = await callerEmail(userId);
+  const supabase = getSupabase();
+
+  const { data: inv } = await supabase
+    .from("workspace_invitations")
+    .select("id, invitee_user_email, status")
+    .eq("id", id)
+    .maybeSingle();
+  if (!inv) return c.json({ error: "Not found" }, 404);
+  if (inv.status !== "pending") return c.json({ error: "Not found" }, 404);
+  if (email && inv.invitee_user_email !== email)
+    return c.json({ error: "Not your invitation" }, 403);
+
+  const { error } = await supabase
+    .from("workspace_invitations")
+    .update({
+      invitee_user_id: userId,
+      status: "finished_declined",
+      updated_at: new Date().toISOString(),
+    })
+    .eq("id", id);
+  if (error) return c.json({ error: `Failed to decline: ${error.message}` }, 500);
+  return c.json({ ok: true });
+});
+
+// ─── Per-workspace (membership/admin gated) ───
+
+// GET /:id — workspace detail + the caller's role (members only).
+workspaces.get("/:id", async (c) => {
+  const userId = c.get("userId");
+  const id = validateParam(c.req.param("id"), "id");
+  if (!id) return c.json({ error: "Invalid workspace id" }, 400);
+  const role = await memberRole(id, userId);
+  if (!role) return c.json({ error: "Not found" }, 404);
+  const supabase = getSupabase();
+  const { data: ws } = await supabase
+    .from("workspaces")
+    .select("id, slug, name, membership_type, created_at")
+    .eq("id", id)
+    .maybeSingle();
+  if (!ws) return c.json({ error: "Not found" }, 404);
+  return c.json({ ...ws, role });
+});
+
+// PATCH /:id — rename (admins only).
+workspaces.patch("/:id", async (c) => {
+  const userId = c.get("userId");
+  const id = validateParam(c.req.param("id"), "id");
+  if (!id) return c.json({ error: "Invalid workspace id" }, 400);
+  const role = await memberRole(id, userId);
+  if (!role || !ADMIN_ROLES.has(role)) return c.json({ error: "Admins only" }, 403);
+
+  const body = (await c.req.json().catch(() => ({}))) as { name?: unknown };
+  const name = typeof body.name === "string" ? body.name.trim() : "";
+  if (!name || name.length > MAX_NAME_LEN)
+    return c.json({ error: "name must be 1-120 chars" }, 400);
+
+  const supabase = getSupabase();
+  const { error } = await supabase.from("workspaces").update({ name }).eq("id", id);
+  if (error) return c.json({ error: `Failed to update: ${error.message}` }, 500);
+  return c.json({ id, name });
+});
+
+// DELETE /:id — delete the workspace (owner only; solo workspaces are not deletable here).
+workspaces.delete("/:id", async (c) => {
+  const userId = c.get("userId");
+  const id = validateParam(c.req.param("id"), "id");
+  if (!id) return c.json({ error: "Invalid workspace id" }, 400);
+  const role = await memberRole(id, userId);
+  if (role !== "owner") return c.json({ error: "Only the owner can delete a workspace" }, 403);
+
+  const supabase = getSupabase();
+  const { data: ws } = await supabase
+    .from("workspaces")
+    .select("membership_type")
+    .eq("id", id)
+    .maybeSingle();
+  if (ws?.membership_type === "solo") {
+    return c.json({ error: "Cannot delete your personal workspace" }, 400);
+  }
+
+  // Repoint anyone whose active workspace is this one (FK is ON DELETE SET NULL,
+  // but null active workspace degrades gracefully via resolveActiveWorkspace).
+  await supabase.from("user").update({ default_workspace_id: null }).eq("default_workspace_id", id);
+  const { error } = await supabase.from("workspaces").delete().eq("id", id);
+  if (error) return c.json({ error: `Failed to delete: ${error.message}` }, 500);
+  return c.json({ ok: true });
+});
+
+// GET /:id/members — members with their profile (members only).
+workspaces.get("/:id/members", async (c) => {
+  const userId = c.get("userId");
+  const id = validateParam(c.req.param("id"), "id");
+  if (!id) return c.json({ error: "Invalid workspace id" }, 400);
+  if (!(await memberRole(id, userId))) return c.json({ error: "Not found" }, 404);
+
+  const supabase = getSupabase();
+  const { data } = await supabase
+    .from("workspace_members")
+    .select("workspace_member_id, workspace_member_role, added_at, user_profiles(*)")
+    .eq("workspace_id", id)
+    .order("added_at", { ascending: true });
+  const members = (data ?? []).map((m: any) => ({
+    id: m.workspace_member_id,
+    role: m.workspace_member_role,
+    added_at: m.added_at,
+    name: m.user_profiles?.full_name ?? null,
+    avatar_url: m.user_profiles?.avatar_url ?? null,
+    is_self: m.workspace_member_id === userId,
+  }));
+  return c.json({ members });
+});
+
+// PATCH /:id/members/:memberId — change a member's role (admins only).
+workspaces.patch("/:id/members/:memberId", async (c) => {
+  const userId = c.get("userId");
+  const id = validateParam(c.req.param("id"), "id");
+  const memberId = validateParam(c.req.param("memberId"), "memberId");
+  if (!id || !memberId) return c.json({ error: "Invalid id" }, 400);
+  const role = await memberRole(id, userId);
+  if (!role || !ADMIN_ROLES.has(role)) return c.json({ error: "Admins only" }, 403);
+
+  const body = (await c.req.json().catch(() => ({}))) as { role?: unknown };
+  const newRole = typeof body.role === "string" ? body.role : "";
+  if (!isAssignableRole(newRole)) {
+    return c.json({ error: "role must be one of admin, member, readonly" }, 400);
+  }
+  const target = await memberRole(id, memberId);
+  if (target === "owner") return c.json({ error: "Cannot change the owner's role" }, 400);
+
+  const supabase = getSupabase();
+  const { error } = await supabase
+    .from("workspace_members")
+    .update({ workspace_member_role: newRole })
+    .eq("workspace_id", id)
+    .eq("workspace_member_id", memberId);
+  if (error) return c.json({ error: `Failed to update role: ${error.message}` }, 500);
+  return c.json({ id: memberId, role: newRole });
+});
+
+// DELETE /:id/members/:memberId — remove a member (admins only; not the owner).
+workspaces.delete("/:id/members/:memberId", async (c) => {
+  const userId = c.get("userId");
+  const id = validateParam(c.req.param("id"), "id");
+  const memberId = validateParam(c.req.param("memberId"), "memberId");
+  if (!id || !memberId) return c.json({ error: "Invalid id" }, 400);
+  const role = await memberRole(id, userId);
+  if (!role || !ADMIN_ROLES.has(role)) return c.json({ error: "Admins only" }, 403);
+  if ((await memberRole(id, memberId)) === "owner") {
+    return c.json({ error: "Cannot remove the owner" }, 400);
+  }
+
+  const supabase = getSupabase();
+  const { error } = await supabase
+    .from("workspace_members")
+    .delete()
+    .eq("workspace_id", id)
+    .eq("workspace_member_id", memberId);
+  if (error) return c.json({ error: `Failed to remove: ${error.message}` }, 500);
+  await supabase
+    .from("user")
+    .update({ default_workspace_id: null })
+    .eq("id", memberId)
+    .eq("default_workspace_id", id);
+  return c.json({ ok: true });
+});
+
+// POST /:id/leave — the caller leaves the workspace (the owner cannot leave).
+workspaces.post("/:id/leave", async (c) => {
+  const userId = c.get("userId");
+  const id = validateParam(c.req.param("id"), "id");
+  if (!id) return c.json({ error: "Invalid workspace id" }, 400);
+  const role = await memberRole(id, userId);
+  if (!role) return c.json({ error: "Not a member" }, 404);
+  if (role === "owner")
+    return c.json({ error: "The owner cannot leave; delete or transfer first" }, 400);
+
+  const supabase = getSupabase();
+  await supabase
+    .from("workspace_members")
+    .delete()
+    .eq("workspace_id", id)
+    .eq("workspace_member_id", userId);
+  await supabase
+    .from("user")
+    .update({ default_workspace_id: null })
+    .eq("id", userId)
+    .eq("default_workspace_id", id);
+  return c.json({ ok: true });
+});
+
+// GET /:id/invitations — pending invitations for a workspace (admins only).
+workspaces.get("/:id/invitations", async (c) => {
+  const userId = c.get("userId");
+  const id = validateParam(c.req.param("id"), "id");
+  if (!id) return c.json({ error: "Invalid workspace id" }, 400);
+  const role = await memberRole(id, userId);
+  if (!role || !ADMIN_ROLES.has(role)) return c.json({ error: "Admins only" }, 403);
+
+  const supabase = getSupabase();
+  const { data } = await supabase
+    .from("workspace_invitations")
+    .select("id, invitee_user_email, invitee_user_role, status, created_at")
+    .eq("workspace_id", id)
+    .eq("status", "pending")
+    .order("created_at", { ascending: false });
+  return c.json({ invitations: data ?? [] });
+});
+
+// POST /:id/invitations — invite someone by email (admins only).
+workspaces.post("/:id/invitations", async (c) => {
+  const userId = c.get("userId");
+  const id = validateParam(c.req.param("id"), "id");
+  if (!id) return c.json({ error: "Invalid workspace id" }, 400);
+  const role = await memberRole(id, userId);
+  if (!role || !ADMIN_ROLES.has(role)) return c.json({ error: "Admins only" }, 403);
+
+  const body = (await c.req.json().catch(() => ({}))) as { email?: unknown; role?: unknown };
+  const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : "";
+  const inviteRole = typeof body.role === "string" ? body.role : "member";
+  if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email))
+    return c.json({ error: "A valid email is required" }, 400);
+  if (!isAssignableRole(inviteRole)) return c.json({ error: "Invalid role" }, 400);
+
+  const supabase = getSupabase();
+  // Don't duplicate an outstanding invite for the same email.
+  const { data: existing } = await supabase
+    .from("workspace_invitations")
+    .select("id")
+    .eq("workspace_id", id)
+    .eq("invitee_user_email", email)
+    .eq("status", "pending")
+    .maybeSingle();
+  if (existing) return c.json({ error: "That email already has a pending invitation" }, 409);
+
+  const invitationId = randomUUID();
+  const { error } = await supabase.from("workspace_invitations").insert({
+    id: invitationId,
+    workspace_id: id,
+    inviter_user_id: userId,
+    invitee_user_email: email,
+    invitee_user_role: inviteRole,
+    status: "pending",
+  });
+  if (error) return c.json({ error: `Failed to invite: ${error.message}` }, 500);
+
+  // Inviting a teammate turns a personal (solo) workspace into a shared team one —
+  // so the inviter's existing shared documents/automations become team-visible
+  // (foreman-swfe). Idempotent; only flips solo → team.
+  await supabase
+    .from("workspaces")
+    .update({ membership_type: "team" })
+    .eq("id", id)
+    .eq("membership_type", "solo");
+
+  return c.json({ id: invitationId, email, role: inviteRole }, 201);
+});
+
+// DELETE /:id/invitations/:invId — revoke a pending invitation (admins only).
+workspaces.delete("/:id/invitations/:invId", async (c) => {
+  const userId = c.get("userId");
+  const id = validateParam(c.req.param("id"), "id");
+  const invId = validateParam(c.req.param("invId"), "invId");
+  if (!id || !invId) return c.json({ error: "Invalid id" }, 400);
+  const role = await memberRole(id, userId);
+  if (!role || !ADMIN_ROLES.has(role)) return c.json({ error: "Admins only" }, 403);
+
+  const supabase = getSupabase();
+  const { error } = await supabase
+    .from("workspace_invitations")
+    .delete()
+    .eq("id", invId)
+    .eq("workspace_id", id);
+  if (error) return c.json({ error: `Failed to revoke: ${error.message}` }, 500);
+  return c.json({ ok: true });
+});
+
+// GET /:id/settings — workspace settings incl. the Zapier connection mode (members).
+workspaces.get("/:id/settings", async (c) => {
+  const userId = c.get("userId");
+  const id = validateParam(c.req.param("id"), "id");
+  if (!id) return c.json({ error: "Invalid workspace id" }, 400);
+  if (!(await memberRole(id, userId))) return c.json({ error: "Not found" }, 404);
+
+  const supabase = getSupabase();
+  const { data } = await supabase
+    .from("workspace_settings")
+    .select("zapier_connection_mode, updated_at")
+    .eq("workspace_id", id)
+    .maybeSingle();
+  return c.json({
+    zapier_connection_mode: (data?.zapier_connection_mode as string) ?? "member-first",
+    updated_at: data?.updated_at ?? null,
+  });
+});
+
+// PATCH /:id/settings — update the Zapier connection mode (admins only).
+workspaces.patch("/:id/settings", async (c) => {
+  const userId = c.get("userId");
+  const id = validateParam(c.req.param("id"), "id");
+  if (!id) return c.json({ error: "Invalid workspace id" }, 400);
+  const role = await memberRole(id, userId);
+  if (!role || !ADMIN_ROLES.has(role)) return c.json({ error: "Admins only" }, 403);
+
+  const body = (await c.req.json().catch(() => ({}))) as { zapier_connection_mode?: unknown };
+  const mode = typeof body.zapier_connection_mode === "string" ? body.zapier_connection_mode : "";
+  if (!CONNECTION_MODES.has(mode)) {
+    return c.json({ error: "mode must be one of member-first, shared, personal" }, 400);
+  }
+  const supabase = getSupabase();
+  const { error } = await supabase
+    .from("workspace_settings")
+    .update({ zapier_connection_mode: mode, updated_at: new Date().toISOString() })
+    .eq("workspace_id", id);
+  if (error) return c.json({ error: `Failed to update settings: ${error.message}` }, 500);
+  return c.json({ zapier_connection_mode: mode });
+});
+
+// ─── Shared Zapier connection (which connection "shared" mode resolves to) ───
+
+// GET /:id/shared-connection — the workspace's designated connection (members),
+// plus whether the caller has a personal connection they could designate.
+workspaces.get("/:id/shared-connection", async (c) => {
+  const userId = c.get("userId");
+  const id = validateParam(c.req.param("id"), "id");
+  if (!id) return c.json({ error: "Invalid workspace id" }, 400);
+  if (!(await memberRole(id, userId))) return c.json({ error: "Not found" }, 404);
+
+  const supabase = getSupabase();
+  const [{ data: shared }, { data: mine }] = await Promise.all([
+    supabase.from("zapier_identity").select("user_id").eq("workspace_id", id).maybeSingle(),
+    supabase.from("zapier_identity").select("id").eq("user_id", userId).maybeSingle(),
+  ]);
+  return c.json({
+    shared: shared ? { owner_id: shared.user_id, is_self: shared.user_id === userId } : null,
+    caller_has_connection: Boolean(mine),
+  });
+});
+
+// POST /:id/shared-connection — designate the caller's own Zapier connection as
+// the workspace's shared one (admins only). Tags zapier_identity.workspace_id,
+// which getSdkForUser resolves for "shared"/"member-first" modes.
+workspaces.post("/:id/shared-connection", async (c) => {
+  const userId = c.get("userId");
+  const id = validateParam(c.req.param("id"), "id");
+  if (!id) return c.json({ error: "Invalid workspace id" }, 400);
+  const role = await memberRole(id, userId);
+  if (!role || !ADMIN_ROLES.has(role)) return c.json({ error: "Admins only" }, 403);
+
+  const supabase = getSupabase();
+  const { data: mine } = await supabase
+    .from("zapier_identity")
+    .select("id")
+    .eq("user_id", userId)
+    .maybeSingle();
+  if (!mine) return c.json({ error: "Connect your own Zapier account first" }, 400);
+
+  // Exactly one designated connection per workspace: clear the prior one, then tag the caller's.
+  await supabase.from("zapier_identity").update({ workspace_id: null }).eq("workspace_id", id);
+  const { error } = await supabase
+    .from("zapier_identity")
+    .update({ workspace_id: id })
+    .eq("user_id", userId);
+  if (error) return c.json({ error: `Failed: ${error.message}` }, 500);
+  return c.json({ ok: true });
+});
+
+// DELETE /:id/shared-connection — clear the workspace's designated connection (admins only).
+workspaces.delete("/:id/shared-connection", async (c) => {
+  const userId = c.get("userId");
+  const id = validateParam(c.req.param("id"), "id");
+  if (!id) return c.json({ error: "Invalid workspace id" }, 400);
+  const role = await memberRole(id, userId);
+  if (!role || !ADMIN_ROLES.has(role)) return c.json({ error: "Admins only" }, 403);
+  const supabase = getSupabase();
+  await supabase.from("zapier_identity").update({ workspace_id: null }).eq("workspace_id", id);
+  return c.json({ ok: true });
+});
+
+export default workspaces;
diff --git a/packages/agents/src/routes/zapier-connect.ts b/packages/agents/src/routes/zapier-connect.ts
index 272a5559..a0dc0a59 100644
--- a/packages/agents/src/routes/zapier-connect.ts
+++ b/packages/agents/src/routes/zapier-connect.ts
@@ -1,13 +1,13 @@
 import { randomBytes } from "node:crypto";
 import { Hono } from "hono";
-import { getSupabase } from "@/lib/db";
-import { ensureUserExists, resolveFromSupabaseJwt } from "@/lib/identity";
+import { getSupabase } from "../lib/db";
+import { ensureUserExists, resolveFromSupabaseJwt } from "../lib/identity";
 import {
   buildAuthorizeUrl,
   consumeConnectToken,
   exchangeCodeAndStore,
   webConnectStateMap,
-} from "@/lib/zapier/connect";
+} from "../lib/zapier/connect";
 
 const zapierConnect = new Hono();
 
diff --git a/packages/agents/src/slack/bot.ts b/packages/agents/src/slack/bot.ts
index 41b1ad43..1150c7ea 100644
--- a/packages/agents/src/slack/bot.ts
+++ b/packages/agents/src/slack/bot.ts
@@ -7,7 +7,6 @@ import { getSupabase } from "../lib/db";
 import { redeemChannelLinkCode, registerChannelUser } from "../lib/identity";
 import { requestUserContext } from "../lib/request-user-context";
 import { getMastra } from "../mastra";
-import { matchAndFireChannelTriggers } from "../workflows/channel-trigger";
 
 let _bot: Chat<{ slack: ReturnType<typeof createSlackAdapter> }> | undefined;
 let _slackAdapter: ReturnType<typeof createSlackAdapter> | undefined;
@@ -95,16 +94,6 @@ async function _createAndInitBot() {
     if (!message.text) return;
     if (/^\/?\s*link\s+[A-Z0-9]{8}$/i.test(message.text.trim())) return;
     try {
-      // Channel-trigger short-circuit: if a workflow_trigger matches the
-      // message, fire the workflow and skip the conversational reply.
-      const fired = await matchAndFireChannelTriggers({
-        channel: "slack",
-        text: message.text,
-        from: message.author.userId,
-        dedupeKey: message.id,
-        room: thread.channelId,
-      });
-      if (fired > 0) return;
       console.log("[slack] DM from", message.author.userId, ":", message.text);
       await thread.startTyping().catch(() => {});
       const reply = await generateReply(
@@ -125,14 +114,6 @@ async function _createAndInitBot() {
   bot.onNewMention(async (thread, message) => {
     if (!message.text) return;
     try {
-      const fired = await matchAndFireChannelTriggers({
-        channel: "slack",
-        text: message.text,
-        from: message.author.userId,
-        dedupeKey: message.id,
-        room: thread.id,
-      });
-      if (fired > 0) return;
       console.log("[slack] Mention from", message.author.userId, ":", message.text);
       await thread.subscribe();
       await thread.startTyping().catch(() => {});
diff --git a/packages/agents/src/teams/bot.ts b/packages/agents/src/teams/bot.ts
index ab010a00..c7532ca8 100644
--- a/packages/agents/src/teams/bot.ts
+++ b/packages/agents/src/teams/bot.ts
@@ -5,7 +5,6 @@ import { Chat } from "chat";
 import { registerChannelUser } from "../lib/identity";
 import { requestUserContext } from "../lib/request-user-context";
 import { getMastra } from "../mastra";
-import { matchAndFireChannelTriggers } from "../workflows/channel-trigger";
 
 let _bot: Chat<{ teams: ReturnType<typeof createTeamsAdapter> }> | undefined;
 let _teamsAdapter: ReturnType<typeof createTeamsAdapter> | undefined;
@@ -58,14 +57,6 @@ export async function getTeamsBot() {
   bot.onDirectMessage(async (thread, message) => {
     if (!message.text) return;
     try {
-      const fired = await matchAndFireChannelTriggers({
-        channel: "teams",
-        text: message.text,
-        from: message.author.userId,
-        dedupeKey: message.id,
-        room: thread.channelId,
-      });
-      if (fired > 0) return;
       console.log("[teams] DM from", message.author.userId, ":", message.text);
       await thread.startTyping().catch(() => {});
       const reply = await generateReply(
@@ -85,14 +76,6 @@ export async function getTeamsBot() {
   bot.onNewMention(async (thread, message) => {
     if (!message.text) return;
     try {
-      const fired = await matchAndFireChannelTriggers({
-        channel: "teams",
-        text: message.text,
-        from: message.author.userId,
-        dedupeKey: message.id,
-        room: thread.id,
-      });
-      if (fired > 0) return;
       console.log("[teams] Mention from", message.author.userId, ":", message.text);
       await thread.subscribe();
       await thread.startTyping().catch(() => {});
diff --git a/packages/agents/src/telegram/bot.ts b/packages/agents/src/telegram/bot.ts
index 63f463b0..3727de8b 100644
--- a/packages/agents/src/telegram/bot.ts
+++ b/packages/agents/src/telegram/bot.ts
@@ -5,7 +5,6 @@ import { Chat } from "chat";
 import { redeemChannelLinkCode, registerChannelUser } from "../lib/identity";
 import { requestUserContext } from "../lib/request-user-context";
 import { getMastra } from "../mastra";
-import { matchAndFireChannelTriggers } from "../workflows/channel-trigger";
 
 let _bot: Chat<{ telegram: ReturnType<typeof createTelegramAdapter> }> | undefined;
 let _telegramAdapter: ReturnType<typeof createTelegramAdapter> | undefined;
@@ -71,7 +70,7 @@ export async function getTelegramBot() {
       );
       if (result.ok) {
         await thread.post(
-          "Your Telegram account is now linked to Foreman! 🎉 Try sending me a message — I can take actions across 9,000+ apps for you.",
+          "Your Telegram account is now linked to Foreman! 🎉 Try sending me a message — I can take actions across 10,000+ apps for you.",
         );
       } else if (result.error === "expired") {
         await thread.post("That code has expired. Generate a new one from your Foreman settings.");
@@ -88,14 +87,6 @@ export async function getTelegramBot() {
   bot.onDirectMessage(async (thread, message) => {
     if (!message.text) return;
     if (message.text.trim().startsWith("/link")) return;
-    const fired = await matchAndFireChannelTriggers({
-      channel: "telegram",
-      text: message.text,
-      from: message.author.userId,
-      dedupeKey: message.id,
-      room: thread.channelId,
-    });
-    if (fired > 0) return;
     await thread.startTyping().catch(() => {});
     const reply = await generateReply(
       thread.channelId,
@@ -109,14 +100,6 @@ export async function getTelegramBot() {
   // Handle @-mentions in group chats.
   bot.onNewMention(async (thread, message) => {
     if (!message.text) return;
-    const fired = await matchAndFireChannelTriggers({
-      channel: "telegram",
-      text: message.text,
-      from: message.author.userId,
-      dedupeKey: message.id,
-      room: thread.id,
-    });
-    if (fired > 0) return;
     await thread.subscribe();
     await thread.startTyping().catch(() => {});
     const reply = await generateReply(
diff --git a/packages/agents/src/telegram/webhook.ts b/packages/agents/src/telegram/webhook.ts
index 516c0b39..086d5bce 100644
--- a/packages/agents/src/telegram/webhook.ts
+++ b/packages/agents/src/telegram/webhook.ts
@@ -7,6 +7,6 @@ import { getTelegramBot } from "./bot";
  * verifies the secret token and dispatches to registered handlers.
  */
 export async function handleTelegramWebhook(c: Context): Promise<Response> {
-  const bot = getTelegramBot();
+  const bot = await getTelegramBot();
   return bot.webhooks.telegram(c.req.raw);
 }
diff --git a/packages/agents/src/webhook-server.ts b/packages/agents/src/webhook-server.ts
index 614c8139..664d083d 100644
--- a/packages/agents/src/webhook-server.ts
+++ b/packages/agents/src/webhook-server.ts
@@ -5,7 +5,6 @@ import { getGitHubBot } from "./github/bot";
 import { getiMessageBot } from "./imessage/bot";
 import { getLinearBot } from "./linear/bot";
 import { getMastra } from "./mastra";
-import { channelTriggerProvider } from "./mastra/signals/channel-trigger-provider";
 import { getSlackBot } from "./slack/bot";
 import { getTeamsBot } from "./teams/bot";
 import { getTelegramBot } from "./telegram/bot";
@@ -52,7 +51,7 @@ const server = http.createServer(async (req, res) => {
     }
 
     if (path === "/telegram/webhook" && req.method === "POST") {
-      const bot = getTelegramBot();
+      const bot = await getTelegramBot();
       const request = new Request(url, {
         method: "POST",
         headers: Object.fromEntries(
@@ -70,7 +69,7 @@ const server = http.createServer(async (req, res) => {
     }
 
     if (path === "/teams/webhook" && req.method === "POST") {
-      const bot = getTeamsBot();
+      const bot = await getTeamsBot();
       const request = new Request(url, {
         method: "POST",
         headers: Object.fromEntries(
@@ -88,7 +87,7 @@ const server = http.createServer(async (req, res) => {
     }
 
     if (path === "/gchat/webhook" && req.method === "POST") {
-      const bot = getGoogleChatBot();
+      const bot = await getGoogleChatBot();
       const request = new Request(url, {
         method: "POST",
         headers: Object.fromEntries(
@@ -106,7 +105,7 @@ const server = http.createServer(async (req, res) => {
     }
 
     if (path === "/whatsapp/webhook" && (req.method === "POST" || req.method === "GET")) {
-      const bot = getWhatsAppBot();
+      const bot = await getWhatsAppBot();
       const request = new Request(url, {
         method: req.method!,
         headers: Object.fromEntries(
@@ -124,7 +123,7 @@ const server = http.createServer(async (req, res) => {
     }
 
     if (path === "/github/webhook" && req.method === "POST") {
-      const bot = getGitHubBot();
+      const bot = await getGitHubBot();
       const request = new Request(url, {
         method: "POST",
         headers: Object.fromEntries(
@@ -142,7 +141,7 @@ const server = http.createServer(async (req, res) => {
     }
 
     if (path === "/linear/webhook" && req.method === "POST") {
-      const bot = getLinearBot();
+      const bot = await getLinearBot();
       const request = new Request(url, {
         method: "POST",
         headers: Object.fromEntries(
@@ -178,7 +177,7 @@ const server = http.createServer(async (req, res) => {
     }
 
     if (path === "/imessage/webhook" && req.method === "POST") {
-      const bot = getiMessageBot();
+      const bot = await getiMessageBot();
       const request = new Request(url, {
         method: "POST",
         headers: Object.fromEntries(
@@ -235,12 +234,9 @@ const server = http.createServer(async (req, res) => {
 server.listen(port, () => {
   console.log(`Webhook server running on port ${port}`);
 
-  // Build the foreman agent up front so the channel SignalProvider is connected
-  // before the first inbound message — otherwise matchAndFireChannelTriggers
-  // runs before any generateReply() has lazily built the agent, and the
-  // channel notify() is a no-op for trigger-only messages. (foreman notify-wiring)
+  // Pre-build the foreman agent so the first inbound message doesn't pay the
+  // lazy Mastra construction cost.
   getMastra();
-  console.log(`[webhook] channel provider connected: ${channelTriggerProvider.isConnected}`);
 
   // Initialize Slack bot — getSlackBot() handles init + rehydration internally
   if (process.env.SLACK_SIGNING_SECRET) {
diff --git a/packages/agents/src/whatsapp/bot.ts b/packages/agents/src/whatsapp/bot.ts
index dec0c730..e2f5cb72 100644
--- a/packages/agents/src/whatsapp/bot.ts
+++ b/packages/agents/src/whatsapp/bot.ts
@@ -5,7 +5,6 @@ import { Chat } from "chat";
 import { registerChannelUser } from "../lib/identity";
 import { requestUserContext } from "../lib/request-user-context";
 import { getMastra } from "../mastra";
-import { matchAndFireChannelTriggers } from "../workflows/channel-trigger";
 
 let _bot: Chat<{ whatsapp: ReturnType<typeof createWhatsAppAdapter> }> | undefined;
 let _whatsappAdapter: ReturnType<typeof createWhatsAppAdapter> | undefined;
@@ -59,14 +58,6 @@ export async function getWhatsAppBot() {
   bot.onDirectMessage(async (thread, message) => {
     if (!message.text) return;
     try {
-      const fired = await matchAndFireChannelTriggers({
-        channel: "whatsapp",
-        text: message.text,
-        from: message.author.userId,
-        dedupeKey: message.id,
-        room: thread.channelId,
-      });
-      if (fired > 0) return;
       console.log("[whatsapp] Message from", message.author.userId, ":", message.text);
       await thread.startTyping().catch(() => {});
       const reply = await generateReply(
@@ -87,14 +78,6 @@ export async function getWhatsAppBot() {
   bot.onNewMention(async (thread, message) => {
     if (!message.text) return;
     try {
-      const fired = await matchAndFireChannelTriggers({
-        channel: "whatsapp",
-        text: message.text,
-        from: message.author.userId,
-        dedupeKey: message.id,
-        room: thread.id,
-      });
-      if (fired > 0) return;
       console.log("[whatsapp] Mention from", message.author.userId, ":", message.text);
       await thread.subscribe();
       await thread.startTyping().catch(() => {});
diff --git a/packages/agents/src/workflows/channel-trigger.ts b/packages/agents/src/workflows/channel-trigger.ts
deleted file mode 100644
index 6280b93a..00000000
--- a/packages/agents/src/workflows/channel-trigger.ts
+++ /dev/null
@@ -1,42 +0,0 @@
-/**
- * Channel-trigger entrypoint. Channel webhook handlers (slack/discord/telegram/
- * etc.) call `matchAndFireChannelTriggers` on every inbound message. The match +
- * fire + dedup logic lives in the ChannelTriggerSignalProvider (a Mastra
- * SignalProvider hosted on the foreman agent); this wrapper keeps the existing
- * call-site signature stable and delegates to it.
- *
- * Match semantics:
- *   - `channel` field MUST equal the inbound channel name.
- *   - `match.command` (optional): exact text match against the message body.
- *     Leading slashes, bangs and surrounding whitespace are tolerated so
- *     "!standup", "/standup", " standup " all match the rule "!standup".
- *   - `match.from` (optional): regex on the sender id/handle.
- *   - `match.room` (optional): exact match on room/channel/DM target.
- *
- * All provided criteria must pass — empty match = matches every message on that
- * channel (rarely what you want, but supported).
- */
-
-import { channelTriggerProvider } from "@/mastra/signals/channel-trigger-provider";
-
-export interface ChannelMessage {
-  channel: "slack" | "discord" | "telegram" | "linear" | "github" | "gchat" | "teams" | "whatsapp";
-  text: string;
-  /** Sender handle/userId — used by `match.from`. */
-  from: string;
-  /** Channel/room/DM target — used by `match.room`. */
-  room?: string;
-  /**
-   * Stable per-delivery key for idempotency (the platform message id). Every
-   * channel bot passes `message.id` (the normalized Chat SDK `Message.id`), so
-   * a retried webhook carries the same key and the workflow fires once — while
-   * two legitimately-repeated identical messages keep distinct ids and both
-   * fire. When omitted, the provider falls back to a content hash (which would
-   * coalesce repeated identical text).
-   */
-  dedupeKey?: string;
-}
-
-export async function matchAndFireChannelTriggers(msg: ChannelMessage): Promise<number> {
-  return channelTriggerProvider.handleMessage(msg);
-}
diff --git a/packages/agents/src/workflows/cron-driver.ts b/packages/agents/src/workflows/cron-driver.ts
deleted file mode 100644
index 81a48a73..00000000
--- a/packages/agents/src/workflows/cron-driver.ts
+++ /dev/null
@@ -1,248 +0,0 @@
-/**
- * Cron driver — long-running worker that fires workflow_trigger rows of
- * type='cron' when their schedule matches the current minute.
- *
- * Resolution is one minute. We tick at the top of each wall-clock minute
- * (with a tiny offset so we land just after, never before). For each enabled
- * cron trigger we evaluate the 5-field expression against `now` in the
- * trigger's timezone (defaulting to UTC) and dispatch via executeWorkflow.
- *
- * `last_fired_at` is set to the minute boundary that fired, so a tick that
- * happens twice in the same minute (process restart, clock skew) won't
- * double-fire.
- *
- * The driver is intentionally simple — no missed-tick catch-up, no
- * distributed locking. If the process is down for a minute, that minute's
- * fires are skipped. If two drivers run, both could fire — only run one.
- */
-
-import { getSupabase } from "@/lib/db";
-import { executeWorkflow } from "@/lib/workflows/engine";
-
-/**
- * Match a 5-field cron expression against a Date interpreted in the given
- * IANA timezone. Supports: `*`, exact numbers, comma lists, ranges (`a-b`),
- * step values (`* /n`, `a-b/n`). Field order: minute, hour, dom, month, dow.
- *
- * Day-of-week: 0=Sunday..6=Saturday (Cron-classic). 7 also accepted as Sunday.
- *
- * When both DOM and DOW are restricted, fires when EITHER matches — that's
- * the standard cron behavior.
- */
-export function cronMatches(expr: string, when: Date, timezone = "UTC"): boolean {
-  const parts = expr.trim().split(/\s+/);
-  if (parts.length !== 5) {
-    throw new Error(`Invalid cron expression (need 5 fields): ${expr}`);
-  }
-  const [minF, hourF, domF, monF, dowF] = parts;
-
-  // Extract calendar fields in the target timezone.
-  const fmt = new Intl.DateTimeFormat("en-US", {
-    timeZone: timezone,
-    year: "numeric",
-    month: "numeric",
-    day: "numeric",
-    hour: "numeric",
-    minute: "numeric",
-    weekday: "short",
-    hour12: false,
-  });
-  const parts2 = Object.fromEntries(fmt.formatToParts(when).map((p) => [p.type, p.value]));
-  const minute = Number(parts2.minute);
-  const hour = Number(parts2.hour) % 24; // hour12:false sometimes returns 24
-  const day = Number(parts2.day);
-  const month = Number(parts2.month);
-  const weekdayMap: Record<string, number> = {
-    Sun: 0,
-    Mon: 1,
-    Tue: 2,
-    Wed: 3,
-    Thu: 4,
-    Fri: 5,
-    Sat: 6,
-  };
-  const dow = weekdayMap[parts2.weekday as string];
-
-  const minOk = matchField(minF, minute, 0, 59);
-  const hourOk = matchField(hourF, hour, 0, 23);
-  const monOk = matchField(monF, month, 1, 12);
-  const domOk = matchField(domF, day, 1, 31);
-  const dowOk = matchField(dowF, dow === 0 ? 0 : dow, 0, 7, (n) => (n === 7 ? 0 : n));
-
-  // DOM/DOW: restricted-OR rule
-  const bothRestricted = domF !== "*" && dowF !== "*";
-  const dayOk = bothRestricted ? domOk || dowOk : domOk && dowOk;
-  return minOk && hourOk && monOk && dayOk;
-}
-
-function matchField(
-  field: string,
-  value: number,
-  min: number,
-  max: number,
-  normalize: (n: number) => number = (n) => n,
-): boolean {
-  for (const part of field.split(",")) {
-    let range = part;
-    let step = 1;
-    if (part.includes("/")) {
-      const [r, s] = part.split("/");
-      range = r;
-      step = Number(s);
-      if (!Number.isFinite(step) || step <= 0) return false;
-    }
-    let lo = min;
-    let hi = max;
-    if (range !== "*") {
-      if (range.includes("-")) {
-        const [a, b] = range.split("-").map(Number);
-        lo = normalize(a);
-        hi = normalize(b);
-      } else {
-        const n = normalize(Number(range));
-        lo = n;
-        hi = n;
-      }
-    }
-    if (!Number.isFinite(lo) || !Number.isFinite(hi)) return false;
-    if (value >= lo && value <= hi && (value - lo) % step === 0) return true;
-  }
-  return false;
-}
-
-interface CronTriggerRow {
-  id: string;
-  workflow_id: string;
-  config: string;
-  last_fired_at: string | null;
-}
-
-/**
- * Round a Date down to the current minute (zero seconds + ms). Used as the
- * fingerprint for `last_fired_at` so the same cron tick can't fire twice.
- */
-function minuteFloor(d: Date): Date {
-  const out = new Date(d);
-  out.setSeconds(0, 0);
-  return out;
-}
-
-/** Single-tick handler. Exported for testing. */
-export async function tickCron(now: Date = new Date()): Promise<{ fired: number }> {
-  const supabase = getSupabase();
-  const tickMinute = minuteFloor(now);
-  const tickIso = tickMinute.toISOString();
-
-  const { data: rows, error } = await supabase
-    .from("workflow_trigger")
-    .select("id, workflow_id, config, last_fired_at")
-    .eq("type", "cron")
-    .eq("enabled", true);
-  if (error) throw new Error(`cron-driver: ${error.message}`);
-
-  let fired = 0;
-  for (const row of (rows ?? []) as unknown as CronTriggerRow[]) {
-    let cfg: { schedule: string; timezone?: string };
-    try {
-      cfg = JSON.parse(row.config);
-    } catch {
-      console.warn(`[cron-driver] trigger ${row.id} has invalid config — skipping`);
-      continue;
-    }
-    if (!cfg.schedule) continue;
-
-    let matches = false;
-    try {
-      matches = cronMatches(cfg.schedule, tickMinute, cfg.timezone ?? "UTC");
-    } catch (e) {
-      console.warn(`[cron-driver] trigger ${row.id} has invalid schedule '${cfg.schedule}':`, e);
-      continue;
-    }
-    if (!matches) continue;
-
-    // Find the workflow's owner so executeWorkflow can run with the right userId.
-    const { data: wf } = await supabase
-      .from("workflow")
-      .select("user_id")
-      .eq("id", row.workflow_id)
-      .maybeSingle();
-    if (!wf) {
-      console.warn(`[cron-driver] trigger ${row.id} → workflow ${row.workflow_id} missing`);
-      continue;
-    }
-
-    // Atomic same-minute claim: set last_fired_at=tickIso only if this trigger
-    // hasn't already fired this minute. The conditional UPDATE is the lock —
-    // two overlapping ticks (e.g. a process restart mid-minute, or briefly
-    // co-existing drivers) can't both claim the same minute, so the workflow
-    // fires exactly once even when last_fired_at hadn't yet been persisted.
-    const { data: claimed, error: claimErr } = await supabase
-      .from("workflow_trigger")
-      .update({ last_fired_at: tickIso, updated_at: tickIso })
-      .eq("id", row.id)
-      .or(`last_fired_at.is.null,last_fired_at.lt.${tickIso}`)
-      .select("id");
-    if (claimErr) {
-      console.warn(`[cron-driver] trigger ${row.id} claim failed: ${claimErr.message}`);
-      continue;
-    }
-    if (!claimed || claimed.length === 0) continue; // another tick already fired it
-
-    // Fire and forget — we don't await full completion to keep the tick fast.
-    void runOne(row.workflow_id, wf.user_id as string, row.id);
-    fired++;
-  }
-  return { fired };
-}
-
-async function runOne(workflowId: string, userId: string, triggerId: string) {
-  // last_fired_at was already set by the atomic claim in tickCron, so the run is
-  // dedup'd before we get here. We just execute and surface errors.
-  try {
-    for await (const ev of executeWorkflow(workflowId, userId, {}, undefined, {
-      firedBy: "cron",
-      triggerId,
-    })) {
-      if (ev.type === "error") {
-        console.warn(`[cron-driver] ${triggerId} workflow error: ${ev.message}`);
-      }
-    }
-  } catch (err) {
-    console.error(`[cron-driver] trigger ${triggerId} failed:`, err);
-  }
-}
-
-/**
- * Start the driver. Returns a stop function. The driver self-aligns to wall-
- * clock minute boundaries — the first tick lands at the next :00 + 500ms.
- */
-export function startCronDriver(): () => void {
-  let stopped = false;
-  let timer: NodeJS.Timeout | null = null;
-
-  const scheduleNext = () => {
-    if (stopped) return;
-    const now = new Date();
-    const next = new Date(now);
-    next.setSeconds(0, 500);
-    if (next.getTime() <= now.getTime()) next.setMinutes(next.getMinutes() + 1);
-    const wait = next.getTime() - now.getTime();
-    timer = setTimeout(async () => {
-      try {
-        const { fired } = await tickCron(new Date());
-        if (fired > 0) console.log(`[cron-driver] fired ${fired} trigger(s)`);
-      } catch (err) {
-        console.error("[cron-driver] tick failed:", err);
-      }
-      scheduleNext();
-    }, wait);
-  };
-
-  scheduleNext();
-  console.log("[cron-driver] started");
-  return () => {
-    stopped = true;
-    if (timer) clearTimeout(timer);
-    console.log("[cron-driver] stopped");
-  };
-}
diff --git a/packages/agents/src/workflows/daily-digest.ts b/packages/agents/src/workflows/daily-digest.ts
new file mode 100644
index 00000000..3df56cde
--- /dev/null
+++ b/packages/agents/src/workflows/daily-digest.ts
@@ -0,0 +1,121 @@
+/**
+ * Daily digest as a native Mastra Workflow (foreman-bhb5). Replaces the custom
+ * worker digest routing. Fired by Mastra's WorkflowScheduler via an imperative
+ * per-workspace schedule (schedulesStore.createSchedule) carrying `inputData`
+ * `{ workspaceId, automationId }`. Steps: gather recent runs → synthesize a
+ * deterministic prioritized digest → narrate (registry agent) → store it as a
+ * `finished` automation_run whose output the inbox reads (getLatestDigest).
+ *
+ * The evented import must load so `createWorkflow` promotes to the evented engine
+ * (required for scheduling).
+ */
+import "@mastra/core/workflows/evented";
+import { createStep, createWorkflow } from "@mastra/core/workflows";
+import { z } from "zod";
+import { buildDigest, type DigestInputRun } from "../lib/automations/digest";
+import { narrateDigest } from "../lib/automations/digest-narrator";
+import * as store from "../lib/automations/store";
+
+const DIGEST_PERIOD_MS = 24 * 60 * 60 * 1000;
+
+const triggerSchema = z.object({
+  workspaceId: z.string(),
+  /** The digest automation to record the run under (the FK anchor + /inbox source). */
+  automationId: z.string().optional(),
+});
+
+// The digest object is plain JSON (buildDigest output); passed between steps as-is.
+const gatheredSchema = triggerSchema.extend({
+  periodStart: z.string(),
+  periodEnd: z.string(),
+  runs: z.array(z.any()),
+});
+const synthesizedSchema = gatheredSchema.extend({ digest: z.any() });
+const resultSchema = z.object({ runId: z.string().nullable(), total: z.number() });
+
+const gatherRuns = createStep({
+  id: "gather-runs",
+  description: "Collect the workspace's automation runs over the digest period",
+  inputSchema: triggerSchema,
+  outputSchema: gatheredSchema,
+  execute: async ({ inputData }) => {
+    const periodEnd = new Date().toISOString();
+    const periodStart = new Date(Date.now() - DIGEST_PERIOD_MS).toISOString();
+    const rows = await store.listRecentRunsForWorkspace(inputData.workspaceId, periodStart, {
+      excludeAutomationId: inputData.automationId,
+    });
+    const names = new Map(
+      (await store.getAutomationsByIds([...new Set(rows.map((r) => r.automation_id))])).map((a) => [
+        a.id,
+        a.name,
+      ]),
+    );
+    const runs: DigestInputRun[] = rows.map((r) => ({
+      automationId: r.automation_id,
+      automationName: names.get(r.automation_id) ?? "(deleted automation)",
+      status: r.status,
+      error: r.error,
+      createdAt: r.created_at,
+    }));
+    return { ...inputData, periodStart, periodEnd, runs };
+  },
+});
+
+const synthesize = createStep({
+  id: "synthesize",
+  description: "Aggregate the runs into a deterministic, prioritized digest",
+  inputSchema: gatheredSchema,
+  outputSchema: synthesizedSchema,
+  execute: async ({ inputData }) => {
+    const digest = buildDigest(
+      inputData.runs as DigestInputRun[],
+      inputData.periodStart,
+      inputData.periodEnd,
+    );
+    return { ...inputData, digest };
+  },
+});
+
+const narrate = createStep({
+  id: "narrate",
+  description: "Add an LLM prose summary (registry agent; fails soft to null)",
+  inputSchema: synthesizedSchema,
+  outputSchema: synthesizedSchema,
+  execute: async ({ inputData }) => {
+    const digest = inputData.digest as ReturnType<typeof buildDigest>;
+    digest.narrative = await narrateDigest(digest);
+    return { ...inputData, digest };
+  },
+});
+
+const persist = createStep({
+  id: "store-digest",
+  description: "Record the digest as a finished automation_run (the /inbox source)",
+  inputSchema: synthesizedSchema,
+  outputSchema: resultSchema,
+  execute: async ({ inputData }) => {
+    const digest = inputData.digest as ReturnType<typeof buildDigest>;
+    if (!inputData.automationId) return { runId: null, total: digest.totals.total };
+    const runId = await store.recordRun({
+      automationId: inputData.automationId,
+      workspaceId: inputData.workspaceId,
+      status: "finished",
+      output: digest,
+      input: { scheduledAt: digest.periodEnd },
+    });
+    return { runId, total: digest.totals.total };
+  },
+});
+
+export const dailyDigestWorkflow = createWorkflow({
+  id: "daily-digest",
+  description:
+    "Synthesize a workspace's recent automation activity into a prioritized inbox digest",
+  inputSchema: triggerSchema,
+  outputSchema: resultSchema,
+})
+  .then(gatherRuns)
+  .then(synthesize)
+  .then(narrate)
+  .then(persist)
+  .commit();
diff --git a/packages/agents/src/workflows/poll-driver.ts b/packages/agents/src/workflows/poll-driver.ts
deleted file mode 100644
index c4302f8f..00000000
--- a/packages/agents/src/workflows/poll-driver.ts
+++ /dev/null
@@ -1,56 +0,0 @@
-/**
- * Poll driver scheduler — the single-process tick that drives the
- * ZapierPollSignalProvider.
- *
- * The provider itself lives on the foreman agent (a Mastra SignalProvider). It
- * deliberately has no `pollInterval` (which would auto-poll in every process the
- * agent is built in). This scheduler — run only inside cron-driver-server — is
- * the one place that calls `runDuePolls()`, self-aligned to wall-clock minute
- * boundaries (a hair after the cron driver so the two don't contend on the same
- * trigger-table read).
- */
-
-import { zapierPollProvider } from "@/mastra/signals/zapier-poll-provider";
-
-/**
- * Start the poll scheduler. Returns a stop function. First tick lands at the
- * next :00 + 750ms.
- */
-export function startPollDriver(): () => void {
-  let stopped = false;
-  let timer: NodeJS.Timeout | null = null;
-  let running = false;
-
-  const scheduleNext = () => {
-    if (stopped) return;
-    const now = new Date();
-    const next = new Date(now);
-    next.setSeconds(0, 750);
-    if (next.getTime() <= now.getTime()) next.setMinutes(next.getMinutes() + 1);
-    const wait = next.getTime() - now.getTime();
-    timer = setTimeout(async () => {
-      if (!running) {
-        running = true;
-        try {
-          const { fired, polled } = await zapierPollProvider.runDuePolls(new Date());
-          if (fired > 0) {
-            console.log(`[poll-driver] fired ${fired} run(s) across ${polled} trigger(s)`);
-          }
-        } catch (err) {
-          console.error("[poll-driver] tick failed:", err);
-        } finally {
-          running = false;
-        }
-      }
-      scheduleNext();
-    }, wait);
-  };
-
-  scheduleNext();
-  console.log("[poll-driver] started");
-  return () => {
-    stopped = true;
-    if (timer) clearTimeout(timer);
-    console.log("[poll-driver] stopped");
-  };
-}
diff --git a/packages/agents/src/workflows/run-automation.ts b/packages/agents/src/workflows/run-automation.ts
new file mode 100644
index 00000000..b45d1c9b
--- /dev/null
+++ b/packages/agents/src/workflows/run-automation.ts
@@ -0,0 +1,55 @@
+/**
+ * Run a scheduled durable automation (foreman-bhb5). The native replacement for
+ * the non-digest branch of the retired `runDueSchedules`. Fired by Mastra's
+ * WorkflowScheduler via a per-automation schedule carrying `inputData`
+ * `{ workspaceId, automationId }`: triggers the automation's Zapier durable and
+ * records the run as "started" — the inbox worker's reconcile advances it to
+ * terminal, exactly like an event-fired run.
+ */
+import "@mastra/core/workflows/evented";
+import { createStep, createWorkflow } from "@mastra/core/workflows";
+import { z } from "zod";
+import * as store from "../lib/automations/store";
+import { triggerAutomation } from "../lib/durable";
+import { getExperimentalSdkForUser } from "../lib/zapier/sdk";
+
+const triggerSchema = z.object({
+  workspaceId: z.string().nullable().optional(),
+  automationId: z.string(),
+});
+
+const fire = createStep({
+  id: "fire-automation",
+  description: "Trigger the automation's durable on schedule and record the run",
+  inputSchema: triggerSchema,
+  outputSchema: z.object({ runId: z.string().nullable(), status: z.string() }),
+  execute: async ({ inputData }) => {
+    const [automation] = await store.getAutomationsByIds([inputData.automationId]);
+    if (!automation) return { runId: null, status: "missing" };
+
+    const sdk = await getExperimentalSdkForUser(automation.user_id);
+    const input = { scheduledAt: new Date().toISOString() };
+    const { triggerId } = await triggerAutomation({
+      sdk,
+      workflowId: automation.zapier_workflow_id,
+      input,
+    });
+    const runId = await store.recordRun({
+      automationId: automation.id,
+      workspaceId: automation.workspace_id,
+      triggerId,
+      status: "started",
+      input,
+    });
+    return { runId, status: "started" };
+  },
+});
+
+export const runAutomationWorkflow = createWorkflow({
+  id: "run-automation",
+  description: "Fire a scheduled durable automation and record the run",
+  inputSchema: triggerSchema,
+  outputSchema: z.object({ runId: z.string().nullable(), status: z.string() }),
+})
+  .then(fire)
+  .commit();
diff --git a/packages/agents/tests/aimock-setup.ts b/packages/agents/tests/aimock-setup.ts
index 1d9a7507..24046775 100644
--- a/packages/agents/tests/aimock-setup.ts
+++ b/packages/agents/tests/aimock-setup.ts
@@ -32,7 +32,7 @@ export default async function setup() {
   if (config.llm?.fixtures && !path.isAbsolute(config.llm.fixtures)) {
     config.llm.fixtures = path.resolve(PACKAGE_ROOT, config.llm.fixtures);
   }
-  const { aimock: instance, url } = await startFromConfig(config, { port: 0 });
+  const { llmock: instance, url } = await startFromConfig(config, { port: 0 });
   aimock = instance;
 
   process.env.ANTHROPIC_BASE_URL = `${url}/v1`;
diff --git a/packages/agents/tests/integration/api-routes.test.ts b/packages/agents/tests/integration/api-routes.test.ts
index aca88acf..1c110255 100644
--- a/packages/agents/tests/integration/api-routes.test.ts
+++ b/packages/agents/tests/integration/api-routes.test.ts
@@ -1,5 +1,5 @@
 import { Hono } from "hono";
-import { beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
 
 // ─── Module mocks (must be before imports) ───
 
@@ -22,7 +22,7 @@ vi.mock("@/discord/webhook", () => ({
   handleDiscordWebhook: vi.fn((c: any) => c.json({ ok: true })),
 }));
 
-// Mock stream utilities used by conversations/workflows
+// Mock stream utilities used by conversations
 vi.mock("@/lib/stream/transformer", () => ({
   createChunkTransformer: vi.fn(),
 }));
@@ -115,8 +115,16 @@ function createQueryBuilder(data: any = null) {
   return builder;
 }
 
+// Authed requests resolve an active workspace from public.user.default_workspace_id
+// (lib/identity resolveActiveWorkspace). Default the principal row so the
+// workspace-scoped routes (dashboards, stored agents) have a workspace in tests.
+function defaultFrom(table: string) {
+  if (table === "user") return createQueryBuilder({ default_workspace_id: "test-ws-1" });
+  return createQueryBuilder();
+}
+
 const mockSupabase = {
-  from: vi.fn(() => createQueryBuilder()),
+  from: vi.fn(defaultFrom),
   auth: {
     getUser: vi.fn().mockImplementation((token: string) => {
       try {
@@ -216,7 +224,7 @@ describe("API route integration tests", () => {
         headers: { Authorization: AUTH_HEADER },
       });
       expect(res.status).toBe(200);
-      const body = await res.json();
+      const body = (await res.json()) as { capabilities: Record<string, boolean> };
       expect(body).toHaveProperty("capabilities");
       expect(body.capabilities).toHaveProperty("search", true);
       expect(body.capabilities).toHaveProperty("voice", true);
@@ -259,7 +267,7 @@ describe("API route integration tests", () => {
         body: JSON.stringify({ enabled: true }),
       });
       expect(res.status).toBe(400);
-      const body = await res.json();
+      const body = (await res.json()) as { error: string };
       expect(body.error).toContain("Unknown capability");
     });
 
@@ -273,7 +281,7 @@ describe("API route integration tests", () => {
         body: JSON.stringify({ value: true }),
       });
       expect(res.status).toBe(400);
-      const body = await res.json();
+      const body = (await res.json()) as { error: string };
       expect(body.error).toContain("enabled");
     });
   });
@@ -291,7 +299,11 @@ describe("API route integration tests", () => {
         headers: { Authorization: AUTH_HEADER },
       });
       expect(res.status).toBe(200);
-      const body = await res.json();
+      const body = (await res.json()) as {
+        rateLimit: { allowed: boolean; limits: { perMinute: number; perHour: number } };
+        appAccess: Record<string, { allowed: boolean; apps: string[] }>;
+        config: { requireApprovalForWrites: boolean; maxBulkItems: number };
+      };
 
       // Rate limit section
       expect(body).toHaveProperty("rateLimit");
@@ -353,7 +365,7 @@ describe("API route integration tests", () => {
         body: JSON.stringify({ enabled: true }),
       });
       expect(res.status).toBe(400);
-      const body = await res.json();
+      const body = (await res.json()) as { error: string };
       expect(body.error).toContain("not a sensitive app");
     });
 
@@ -367,27 +379,142 @@ describe("API route integration tests", () => {
         body: JSON.stringify({}),
       });
       expect(res.status).toBe(400);
-      const body = await res.json();
+      const body = (await res.json()) as { error: string };
       expect(body.error).toContain("enabled");
     });
   });
 
-  // ── Workflows ─────────────────────────────────────────────────────────
+  // ── Dashboards (snapshot reads) ───────────────────────────────────────
+
+  describe("GET /apps/snapshots/:appKey", () => {
+    const snapshotRow = {
+      id: "snap-1",
+      app_key: "hubspot",
+      source_config: JSON.stringify({ app: "hubspot" }),
+      records: JSON.stringify([{ id: "1", name: "Acme" }]),
+      row_count: 1,
+      refreshed_at: "2026-06-19T12:00:00.000Z",
+    };
+
+    // The auth middleware calls from("user") (ensureUserExists) before the
+    // handler runs, so we can't use mockReturnValueOnce — it'd be consumed by
+    // auth. Target the snapshot table by name instead, and restore the default
+    // builder after each test so nothing leaks.
+    function withSnapshotData(data: any) {
+      mockSupabase.from.mockImplementation((t: string) =>
+        t === "app_data_snapshot" ? createQueryBuilder(data) : defaultFrom(t),
+      );
+    }
+    afterEach(() => {
+      mockSupabase.from.mockImplementation(defaultFrom);
+    });
 
-  describe("GET /workflows", () => {
     it("returns 401 without auth", async () => {
-      const res = await app.request("/workflows");
+      const res = await app.request("/apps/snapshots/hubspot");
       expect(res.status).toBe(401);
     });
 
-    it("returns empty array for a user with no workflows", async () => {
-      // mockDb.select already returns empty rows by default
-      const res = await app.request("/workflows", {
+    it("returns the latest snapshot with auth", async () => {
+      withSnapshotData(snapshotRow);
+      const res = await app.request("/apps/snapshots/hubspot", {
         headers: { Authorization: AUTH_HEADER },
       });
       expect(res.status).toBe(200);
       const body = await res.json();
-      expect(body).toEqual([]);
+      expect(body).toMatchObject({
+        id: "snap-1",
+        appKey: "hubspot",
+        rowCount: 1,
+        records: [{ id: "1", name: "Acme" }],
+        sourceConfig: { app: "hubspot" },
+      });
+    });
+
+    it("returns 404 when the user has no snapshot for the app", async () => {
+      // default mock builder resolves to data: null → getLatestSnapshot → null
+      const res = await app.request("/apps/snapshots/hubspot", {
+        headers: { Authorization: AUTH_HEADER },
+      });
+      expect(res.status).toBe(404);
+    });
+
+    it("returns the history series with ?history=true", async () => {
+      withSnapshotData([snapshotRow, snapshotRow]);
+      const res = await app.request("/apps/snapshots/hubspot?history=true", {
+        headers: { Authorization: AUTH_HEADER },
+      });
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as { appKey: string; count: number; snapshots: unknown[] };
+      expect(body).toMatchObject({ appKey: "hubspot", count: 2 });
+      expect(Array.isArray(body.snapshots)).toBe(true);
+    });
+
+    it("returns 400 for an invalid since timestamp", async () => {
+      const res = await app.request("/apps/snapshots/hubspot?history=true&since=notadate", {
+        headers: { Authorization: AUTH_HEADER },
+      });
+      expect(res.status).toBe(400);
+      const body = (await res.json()) as { error: string };
+      expect(body.error).toContain("since");
+    });
+
+    it("returns 400 for a non-numeric limit", async () => {
+      const res = await app.request("/apps/snapshots/hubspot?history=true&limit=abc", {
+        headers: { Authorization: AUTH_HEADER },
+      });
+      expect(res.status).toBe(400);
+      const body = (await res.json()) as { error: string };
+      expect(body.error).toContain("limit");
+    });
+  });
+
+  // ── Apps (dashboards): public sharing (Phase 3) ───────────────────────
+
+  describe("apps public sharing", () => {
+    const VALID_SPEC = {
+      title: "Leads",
+      blocks: [{ type: "kpi", label: "Total", agg: "count" }],
+    };
+    const shareRow = { artifact_id: "art-1", workspace_id: "test-ws-1", expires_at: null };
+    const artifactRow = {
+      id: "art-1",
+      kind: "dashboard",
+      title: "Leads",
+      spec: JSON.stringify(VALID_SPEC),
+      snapshot_id: null, // no snapshot → records default to []
+      updated_at: "2026-06-20T00:00:00.000Z",
+    };
+
+    // Resolve from() per-table so getSharedArtifact reads the share row then the
+    // artifact row. Default (unset tables) → null builder.
+    function withTables(map: Record<string, any>) {
+      mockSupabase.from.mockImplementation((t: string) =>
+        map[t] !== undefined ? createQueryBuilder(map[t]) : defaultFrom(t),
+      );
+    }
+    afterEach(() => {
+      mockSupabase.from.mockImplementation(defaultFrom);
+    });
+
+    it("GET /apps/public/:token returns 200 WITHOUT auth (token is the grant)", async () => {
+      withTables({ dashboard_share: shareRow, artifact: artifactRow });
+      // Deliberately NO Authorization header — the public carve-out must allow it.
+      const res = await app.request("/apps/public/sometoken");
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as { spec: { title: string } };
+      expect(body).toMatchObject({ id: "art-1", title: "Leads", records: [] });
+      expect(body.spec.title).toBe("Leads");
+    });
+
+    it("GET /apps/public/:token returns 404 for an unknown token", async () => {
+      // default builder → dashboard_share lookup is null → getSharedArtifact null
+      const res = await app.request("/apps/public/nope");
+      expect(res.status).toBe(404);
+    });
+
+    it("POST /apps/artifacts/:id/share still requires auth (401)", async () => {
+      const res = await app.request("/apps/artifacts/art-1/share", { method: "POST" });
+      expect(res.status).toBe(401);
     });
   });
 
diff --git a/packages/agents/tests/integration/protocols.test.ts b/packages/agents/tests/integration/protocols.test.ts
index 2e877d49..c1046b45 100644
--- a/packages/agents/tests/integration/protocols.test.ts
+++ b/packages/agents/tests/integration/protocols.test.ts
@@ -46,7 +46,7 @@ describe("Protocol endpoints", () => {
       const res = await fetch(`${AGENT_URL}/.well-known/foreman/agent-card.json`);
       expect(res.status).toBe(200);
 
-      const card = await res.json();
+      const card = (await res.json()) as { name: string; description: string };
       expect(card.name).toBe("Foreman");
       expect(card.description).toContain("Zapier");
     });
@@ -101,7 +101,7 @@ describe("Protocol endpoints", () => {
       });
 
       expect(res.status).toBe(200);
-      const body = await res.json();
+      const body = (await res.json()) as { error: { code: number; message: string } };
       // JSON-RPC errors are returned as 200 with an error field
       expect(body).toHaveProperty("error");
       expect(body.error).toHaveProperty("code");
diff --git a/packages/agents/tests/live/dashboards-snapshot.test.ts b/packages/agents/tests/live/dashboards-snapshot.test.ts
new file mode 100644
index 00000000..043a7809
--- /dev/null
+++ b/packages/agents/tests/live/dashboards-snapshot.test.ts
@@ -0,0 +1,138 @@
+import { randomUUID } from "node:crypto";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { getLatestSnapshot, getSnapshotHistory, saveSnapshot } from "@/lib/dashboards/snapshot";
+import { getSupabase } from "@/lib/db";
+
+/**
+ * Live Supabase round-trip for the dashboards snapshot lib.
+ *
+ * Unlike the mocked unit tests (tests/unit/dashboards-snapshot.test.ts), this
+ * drives the REAL lib against the REAL migrated `app_data_snapshot` table — so
+ * it proves what mocks can't: the actual column names, NOT NULL constraints, the
+ * JSON-as-text round-trip through Postgres, and refreshed_at DESC ordering.
+ *
+ * Requires:
+ *   npx supabase start                 # local Supabase on :54421
+ *   SUPABASE_URL + SUPABASE_SERVICE_ROLE_KEY in .env.local (loaded by test:live)
+ *
+ * Auto-skips if Supabase is not reachable. Run: npm run test:live
+ */
+
+const SUPABASE_URL = process.env.SUPABASE_URL ?? "http://127.0.0.1:54421";
+
+async function supabaseIsReachable(): Promise<boolean> {
+  try {
+    const res = await fetch(`${SUPABASE_URL}/rest/v1/`, {
+      headers: { apikey: process.env.SUPABASE_SERVICE_ROLE_KEY ?? "" },
+      signal: AbortSignal.timeout(2000),
+    });
+    return res.status < 500;
+  } catch {
+    return false;
+  }
+}
+
+describe("dashboards snapshot — live Supabase round-trip", () => {
+  let reachable = false;
+  const testUserId = `live-test-dash-${Date.now()}`;
+  const testWorkspaceId = randomUUID();
+  const appKey = "hubspot";
+
+  beforeAll(async () => {
+    reachable = await supabaseIsReachable();
+    if (!reachable) {
+      console.warn(
+        `\n⚠  Supabase not reachable at ${SUPABASE_URL}. Skipping live snapshot tests.\n` +
+          `   Start it with: npx supabase start\n`,
+      );
+      return;
+    }
+    // Snapshots are workspace-scoped (FK to workspaces); create a real workspace
+    // to hang them on so the FK + the workspace-scoped reads have a match.
+    await getSupabase()
+      .from("workspaces")
+      .insert({
+        id: testWorkspaceId,
+        slug: `live-test-dash-${Date.now()}`,
+        name: "Live Test Dashboards",
+        membership_type: "solo",
+      });
+  });
+
+  afterAll(async () => {
+    if (!reachable) return;
+    // Cleanup: remove every row this test wrote, then the workspace.
+    await getSupabase().from("app_data_snapshot").delete().eq("user_id", testUserId);
+    await getSupabase().from("workspaces").delete().eq("id", testWorkspaceId);
+  });
+
+  it("saves a snapshot and reads it back with JSON payloads intact", async ({ skip }) => {
+    if (!reachable) skip();
+
+    const records = [
+      { id: "1", name: "Acme", value: 42 },
+      { id: "2", name: "Globex", value: 7 },
+    ];
+    const sourceConfig = { app: appKey, action: "new_contact", inputs: { limit: 100 } };
+
+    const id = await saveSnapshot({
+      userId: testUserId,
+      workspaceId: testWorkspaceId,
+      appKey,
+      sourceConfig,
+      records,
+      triggerId: "live-trig-1",
+    });
+    expect(id).toBeTruthy();
+
+    const latest = await getLatestSnapshot(testWorkspaceId, appKey);
+    expect(latest).not.toBeNull();
+    expect(latest?.id).toBe(id);
+    expect(latest?.appKey).toBe(appKey);
+    expect(latest?.rowCount).toBe(2);
+    // JSON-as-text survives the Postgres round-trip exactly.
+    expect(latest?.records).toEqual(records);
+    expect(latest?.sourceConfig).toEqual(sourceConfig);
+    expect(typeof latest?.refreshedAt).toBe("string");
+  });
+
+  it("is append-only: a second save returns as the latest, history keeps both newest-first", async ({
+    skip,
+  }) => {
+    if (!reachable) skip();
+
+    // A timestamp strictly between the two saves — robust for the `since` filter
+    // regardless of how close the two refreshed_at values land.
+    const between = new Date().toISOString();
+    await new Promise((r) => setTimeout(r, 5));
+
+    const id2 = await saveSnapshot({
+      userId: testUserId,
+      workspaceId: testWorkspaceId,
+      appKey,
+      sourceConfig: { app: appKey, action: "new_contact" },
+      records: [{ id: "3", name: "Initech" }],
+    });
+
+    // Latest is now the second snapshot (append-only, not an upsert).
+    const latest = await getLatestSnapshot(testWorkspaceId, appKey);
+    expect(latest?.id).toBe(id2);
+    expect(latest?.rowCount).toBe(1);
+
+    // Full history has both rows, newest first.
+    const all = await getSnapshotHistory(testWorkspaceId, appKey);
+    expect(all.length).toBeGreaterThanOrEqual(2);
+    expect(all[0].id).toBe(id2);
+
+    // since filter returns only the newer snapshot.
+    const recent = await getSnapshotHistory(testWorkspaceId, appKey, { since: between });
+    expect(recent.map((s) => s.id)).toContain(id2);
+    expect(recent.map((s) => s.id)).not.toContain(all[all.length - 1].id);
+  });
+
+  it("returns null for an app the user has no snapshots for", async ({ skip }) => {
+    if (!reachable) skip();
+    expect(await getLatestSnapshot(testWorkspaceId, "no-such-app")).toBeNull();
+    expect(await getSnapshotHistory(testWorkspaceId, "no-such-app")).toEqual([]);
+  });
+});
diff --git a/packages/agents/tests/live/poll-driver.test.ts b/packages/agents/tests/live/poll-driver.test.ts
deleted file mode 100644
index f60ab042..00000000
--- a/packages/agents/tests/live/poll-driver.test.ts
+++ /dev/null
@@ -1,198 +0,0 @@
-/**
- * Live integration test for the poll driver (foreman-ueep).
- *
- * Exercises the full poll-trigger path against REAL local Supabase:
- *   attach_trigger(type='poll') → zapierPollProvider.runDuePolls() →
- *   executeWorkflow → workflow_run rows.
- *
- * The only thing stubbed is the external Zapier read (`runAction`): the local DB
- * was reset and there's no OAuth-connected app to create records in, so we
- * control what the "read" returns (and stub the workflow's write step so
- * executeWorkflow completes). Everything else — cursor persistence, firing,
- * dedup, workflow_run inserts with fired_by/trigger_id — is real Postgres.
- *
- * Auto-skips if Supabase isn't reachable. Run: npm run test:live
- */
-import { RequestContext } from "@mastra/core/request-context";
-import { createClient } from "@supabase/supabase-js";
-import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
-import type { Database } from "@/lib/db/database.types";
-
-const SUPABASE_URL = process.env.SUPABASE_URL ?? "http://127.0.0.1:54421";
-const SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY ?? "";
-
-// Control the Zapier read the poll driver sees; stub the workflow's write step.
-let readRecords: Array<Record<string, unknown>> = [];
-vi.mock("@/lib/zapier/execution", () => ({
-  runAction: vi.fn(async (_userId: string, _app: string, actionType: string) =>
-    actionType === "read" ? { data: readRecords } : { ok: true },
-  ),
-  rawFetch: vi.fn(),
-}));
-
-async function supabaseIsReachable(): Promise<boolean> {
-  try {
-    const res = await fetch(`${SUPABASE_URL}/rest/v1/`, {
-      headers: { apikey: SUPABASE_SERVICE_ROLE_KEY },
-      signal: AbortSignal.timeout(2000),
-    });
-    return res.status < 500;
-  } catch {
-    return false;
-  }
-}
-
-function ctx({ userId, conversationId }: { userId: string; conversationId?: string }) {
-  const entries: [string, string][] = [["userId", userId]];
-  if (conversationId) entries.push(["threadId", conversationId]);
-  return { requestContext: new RequestContext(entries) } as any;
-}
-
-describe("poll driver — live Supabase (foreman-ueep)", () => {
-  let reachable = false;
-  let supabase: ReturnType<typeof createClient<Database>>;
-
-  const testRunId = `poll-${Date.now()}`;
-  const userId = `${testRunId}-user`;
-  const conversationId = `${testRunId}-conv`;
-  let workflowId = "";
-  let triggerId = "";
-
-  async function runsForWorkflow() {
-    const { data } = await supabase.from("workflow_run").select("*").eq("workflow_id", workflowId);
-    return data ?? [];
-  }
-  async function triggerRow() {
-    const { data } = await supabase
-      .from("workflow_trigger")
-      .select("last_dedupe_key, last_fired_at")
-      .eq("id", triggerId)
-      .maybeSingle();
-    return data;
-  }
-
-  beforeAll(async () => {
-    reachable = await supabaseIsReachable();
-    if (!reachable) {
-      console.warn(`\n⚠  Supabase not reachable at ${SUPABASE_URL}. Skipping live poll tests.\n`);
-      return;
-    }
-    supabase = createClient<Database>(SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY);
-    const now = new Date().toISOString();
-
-    await supabase.from("user").insert({
-      id: userId,
-      name: "live-poll-test",
-      email: `${testRunId}@test.local`,
-      emailVerified: true,
-      image: null,
-      createdAt: now,
-      updatedAt: now,
-    });
-    await supabase.from("conversation").insert({
-      id: conversationId,
-      user_id: userId,
-      mastra_thread_id: null,
-      title: null,
-      created_at: now,
-      updated_at: now,
-    });
-    // An executed proposal → save_workflow turns it into a real workflow + step.
-    await supabase.from("action_proposal").insert({
-      id: crypto.randomUUID(),
-      conversation_id: conversationId,
-      mastra_run_id: null,
-      app_key: "slack",
-      action_type: "write",
-      action_key: "send_message",
-      human_label: "slack.send_message",
-      inputs: JSON.stringify({ channel: "#ops", text: "poll fired" }),
-      input_schema: "{}",
-      connection_id: null,
-      status: "executed",
-      created_at: now,
-      updated_at: now,
-    });
-
-    const { saveWorkflowTool } = await import("@/mastra/tools/save-workflow");
-    const saved = (await saveWorkflowTool.execute!(
-      { name: "Live poll workflow" } as any,
-      ctx({ userId, conversationId }),
-    )) as { workflowId: string };
-    workflowId = saved.workflowId;
-
-    const { attachTriggerTool } = await import("@/mastra/tools/attach-trigger");
-    const attached = (await attachTriggerTool.execute!(
-      {
-        workflowId,
-        type: "poll",
-        poll: { app: "gmail", action: "new_email", dedupeKey: "id", intervalMinutes: 5 },
-      } as any,
-      ctx({ userId }),
-    )) as { id: string; type: string };
-    triggerId = attached.id;
-    expect(attached.type).toBe("poll");
-  });
-
-  afterAll(async () => {
-    if (!reachable) return;
-    await supabase.from("workflow_run").delete().eq("workflow_id", workflowId);
-    await supabase.from("workflow_trigger").delete().eq("workflow_id", workflowId);
-    await supabase.from("workflow_step").delete().eq("workflow_id", workflowId);
-    await supabase.from("workflow").delete().eq("id", workflowId);
-    await supabase.from("action_proposal").delete().eq("conversation_id", conversationId);
-    await supabase.from("conversation").delete().eq("id", conversationId);
-    await supabase.from("user").delete().eq("id", userId);
-  });
-
-  it("persists the poll trigger config", async ({ skip }) => {
-    if (!reachable) skip();
-    const { data } = await supabase
-      .from("workflow_trigger")
-      .select("type, config")
-      .eq("id", triggerId)
-      .maybeSingle();
-    expect(data?.type).toBe("poll");
-    expect(JSON.parse(data?.config as string)).toMatchObject({
-      app: "gmail",
-      action: "new_email",
-      dedupeKey: "id",
-    });
-  });
-
-  it("first poll establishes the baseline — fires nothing, sets the cursor", async ({ skip }) => {
-    if (!reachable) skip();
-    readRecords = [{ id: "2" }, { id: "1" }];
-    const { zapierPollProvider } = await import("@/mastra/signals/zapier-poll-provider");
-    const out = await zapierPollProvider.runDuePolls(new Date("2026-06-12T12:00:00Z"));
-
-    expect(out.fired).toBe(0);
-    expect(await runsForWorkflow()).toHaveLength(0);
-    expect((await triggerRow())?.last_dedupe_key).toBe("2");
-  });
-
-  it("fires the workflow once for a new record, recording fired_by=poll + trigger_id", async ({
-    skip,
-  }) => {
-    if (!reachable) skip();
-    readRecords = [{ id: "3" }, { id: "2" }, { id: "1" }]; // "3" is new
-    const { zapierPollProvider } = await import("@/mastra/signals/zapier-poll-provider");
-    const out = await zapierPollProvider.runDuePolls(new Date("2026-06-12T12:10:00Z"));
-
-    expect(out.fired).toBe(1);
-    const runs = await runsForWorkflow();
-    expect(runs).toHaveLength(1);
-    expect(runs[0]).toMatchObject({ fired_by: "poll", trigger_id: triggerId, status: "success" });
-    expect((await triggerRow())?.last_dedupe_key).toBe("3");
-  });
-
-  it("does not double-fire when no new record appears (dedup)", async ({ skip }) => {
-    if (!reachable) skip();
-    readRecords = [{ id: "3" }, { id: "2" }]; // newest "3" == cursor
-    const { zapierPollProvider } = await import("@/mastra/signals/zapier-poll-provider");
-    const out = await zapierPollProvider.runDuePolls(new Date("2026-06-12T12:20:00Z"));
-
-    expect(out.fired).toBe(0);
-    expect(await runsForWorkflow()).toHaveLength(1); // still just the one
-  });
-});
diff --git a/packages/agents/tests/live/supabase-health.test.ts b/packages/agents/tests/live/supabase-health.test.ts
index 33556612..7970be87 100644
--- a/packages/agents/tests/live/supabase-health.test.ts
+++ b/packages/agents/tests/live/supabase-health.test.ts
@@ -62,9 +62,9 @@ describe("Supabase live integration", () => {
       expect(error).toBeNull();
     });
 
-    it("can query workflow table", async ({ skip }) => {
+    it("can query automation table", async ({ skip }) => {
       if (!reachable) skip();
-      const { error } = await supabase.from("workflow").select("*").limit(1);
+      const { error } = await supabase.from("automation").select("*").limit(1);
       expect(error).toBeNull();
     });
   });
diff --git a/packages/agents/tests/live/workflow-tools.test.ts b/packages/agents/tests/live/workflow-tools.test.ts
deleted file mode 100644
index 28c2bd87..00000000
--- a/packages/agents/tests/live/workflow-tools.test.ts
+++ /dev/null
@@ -1,259 +0,0 @@
-/**
- * Live integration tests for the workflow CRUD agent tools.
- *
- * Exercises save/list/get/update/delete against a real local Supabase.
- * run_workflow is NOT covered here because it would invoke real Zapier;
- * its execution path is unit-tested separately in workflow-tools-rud.test.ts.
- *
- * Each test seeds its own user + conversation + executed proposal rows,
- * runs the tool's execute() with a real RequestContext, and asserts
- * against the DB. Cleanup happens in afterAll.
- */
-import { RequestContext } from "@mastra/core/request-context";
-import { createClient } from "@supabase/supabase-js";
-import { afterAll, beforeAll, describe, expect, it } from "vitest";
-import type { Database } from "@/lib/db/database.types";
-
-const SUPABASE_URL = process.env.SUPABASE_URL ?? "http://127.0.0.1:54421";
-const SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY ?? "";
-
-async function supabaseIsReachable(): Promise<boolean> {
-  try {
-    const res = await fetch(`${SUPABASE_URL}/rest/v1/`, {
-      headers: { apikey: SUPABASE_SERVICE_ROLE_KEY },
-      signal: AbortSignal.timeout(2000),
-    });
-    return res.status < 500;
-  } catch {
-    return false;
-  }
-}
-
-function ctx({ userId, conversationId }: { userId: string; conversationId?: string }) {
-  const entries: [string, string][] = [["userId", userId]];
-  if (conversationId) entries.push(["threadId", conversationId]);
-  return { requestContext: new RequestContext(entries) } as any;
-}
-
-describe("workflow tools — live Supabase", () => {
-  let reachable = false;
-  let supabase: ReturnType<typeof createClient<Database>>;
-
-  // Single user + conversation reused by tests, cleaned up in afterAll.
-  // Unique per run so concurrent test runs don't collide.
-  const testRunId = `wf-live-${Date.now()}`;
-  const userId = `${testRunId}-user`;
-  const conversationId = `${testRunId}-conv`;
-  const createdWorkflowIds: string[] = [];
-
-  beforeAll(async () => {
-    reachable = await supabaseIsReachable();
-    if (!reachable) {
-      console.warn(
-        `\n⚠  Supabase not reachable at ${SUPABASE_URL}. Skipping live workflow tests.\n` +
-          `   Start it with: npx supabase start\n`,
-      );
-      return;
-    }
-    supabase = createClient<Database>(SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY);
-
-    // Seed: user + conversation. Tests that need executed proposals will
-    // insert them on-demand so we can vary the fixture per test.
-    // The `user` table uses camelCase columns (emailVerified, createdAt,
-    // updatedAt); every other Foreman table is snake_case. The generated
-    // Database types reflect that — so do these fixtures.
-    const now = new Date().toISOString();
-    const { error: userErr } = await supabase.from("user").insert({
-      id: userId,
-      name: "live-test",
-      email: `${testRunId}@test.local`,
-      emailVerified: true,
-      image: null,
-      createdAt: now,
-      updatedAt: now,
-    });
-    if (userErr) throw new Error(`seed user failed: ${userErr.message}`);
-    const { error: convErr } = await supabase.from("conversation").insert({
-      id: conversationId,
-      user_id: userId,
-      mastra_thread_id: null,
-      title: null,
-      created_at: now,
-      updated_at: now,
-    });
-    if (convErr) throw new Error(`seed conversation failed: ${convErr.message}`);
-  });
-
-  afterAll(async () => {
-    if (!reachable) return;
-    // Cascade: delete in reverse-FK order. The DELETE /workflows/:id
-    // cascade isn't FK-driven so we replicate it here for the test.
-    for (const wfId of createdWorkflowIds) {
-      await supabase.from("workflow_run").delete().eq("workflow_id", wfId);
-      await supabase.from("workflow_step").delete().eq("workflow_id", wfId);
-      await supabase.from("workflow").delete().eq("id", wfId);
-    }
-    await supabase.from("action_proposal").delete().eq("conversation_id", conversationId);
-    await supabase.from("conversation").delete().eq("id", conversationId);
-    await supabase.from("user").delete().eq("id", userId);
-  });
-
-  /** Seed N executed proposals into the test conversation. Returns their ids. */
-  async function seedExecutedProposals(
-    specs: Array<{ app: string; action: string; inputs: Record<string, unknown> }>,
-  ) {
-    const ids: string[] = [];
-    const now = Date.now();
-    for (let i = 0; i < specs.length; i++) {
-      const id = crypto.randomUUID();
-      ids.push(id);
-      await supabase.from("action_proposal").insert({
-        id,
-        conversation_id: conversationId,
-        mastra_run_id: null,
-        app_key: specs[i].app,
-        action_type: "write",
-        action_key: specs[i].action,
-        human_label: `${specs[i].app}.${specs[i].action}`,
-        inputs: JSON.stringify(specs[i].inputs),
-        input_schema: "{}",
-        connection_id: null,
-        status: "executed",
-        // monotonically increasing so the saver preserves order
-        created_at: new Date(now + i).toISOString(),
-        updated_at: new Date(now + i).toISOString(),
-      });
-    }
-    return ids;
-  }
-
-  it("save_workflow → list_workflows → get_workflow round-trip", async ({ skip }) => {
-    if (!reachable) skip();
-
-    await seedExecutedProposals([
-      { app: "slack", action: "send_message", inputs: { channel: "#ops", text: "standup in 5" } },
-      { app: "gmail", action: "send_email", inputs: { to: "team@acme.com", subject: "Heads up" } },
-    ]);
-
-    const { saveWorkflowTool } = await import("@/mastra/tools/save-workflow");
-    const { listWorkflowsTool } = await import("@/mastra/tools/list-workflows");
-    const { getWorkflowTool } = await import("@/mastra/tools/get-workflow");
-
-    const saved = (await saveWorkflowTool.execute!(
-      { name: "Standup post" } as any,
-      ctx({ userId, conversationId }),
-    )) as { workflowId: string; steps: number; parameters: string[] };
-
-    expect(saved.workflowId).toMatch(/^[0-9a-f-]{36}$/);
-    expect(saved.steps).toBe(2);
-    expect(saved.parameters).toContain("to"); // 'team@acme.com' triggers the email pattern
-    createdWorkflowIds.push(saved.workflowId);
-
-    // Verify in DB directly
-    const { data: dbRows } = await supabase
-      .from("workflow_step")
-      .select("order, proposal_template")
-      .eq("workflow_id", saved.workflowId);
-    expect(dbRows).toHaveLength(2);
-
-    // list_workflows includes the new one
-    const list = (await listWorkflowsTool.execute!({ limit: 20 } as any, ctx({ userId }))) as {
-      workflows: Array<{ id: string; name: string }>;
-    };
-
-    expect(list.workflows.find((w) => w.id === saved.workflowId)).toMatchObject({
-      name: "Standup post",
-    });
-
-    // get_workflow returns parsed steps in order
-    const got = (await getWorkflowTool.execute!(
-      { workflowId: saved.workflowId } as any,
-      ctx({ userId }),
-    )) as {
-      id: string;
-      steps: Array<{ order: number; appKey: string | null; actionKey: string | null }>;
-    };
-
-    expect(got.id).toBe(saved.workflowId);
-    expect(got.steps).toHaveLength(2);
-    expect(got.steps[0]).toMatchObject({ order: 0, appKey: "slack", actionKey: "send_message" });
-    expect(got.steps[1]).toMatchObject({ order: 1, appKey: "gmail", actionKey: "send_email" });
-  });
-
-  it("update_workflow renames and toggles isTemplate", async ({ skip }) => {
-    if (!reachable) skip();
-
-    await seedExecutedProposals([
-      { app: "slack", action: "send_message", inputs: { channel: "#x", text: "hi" } },
-    ]);
-
-    const { saveWorkflowTool } = await import("@/mastra/tools/save-workflow");
-    const { updateWorkflowTool } = await import("@/mastra/tools/update-workflow");
-
-    const saved = (await saveWorkflowTool.execute!(
-      { name: "Original" } as any,
-      ctx({ userId, conversationId }),
-    )) as { workflowId: string };
-    createdWorkflowIds.push(saved.workflowId);
-
-    const renamed = (await updateWorkflowTool.execute!(
-      { workflowId: saved.workflowId, name: "Renamed" } as any,
-      ctx({ userId }),
-    )) as { name: string; isTemplate: boolean };
-    expect(renamed.name).toBe("Renamed");
-    expect(renamed.isTemplate).toBe(false);
-
-    const published = (await updateWorkflowTool.execute!(
-      { workflowId: saved.workflowId, isTemplate: true } as any,
-      ctx({ userId }),
-    )) as { name: string; isTemplate: boolean };
-    expect(published.name).toBe("Renamed"); // unchanged
-    expect(published.isTemplate).toBe(true);
-  });
-
-  it("delete_workflow cascades to step + run rows", async ({ skip }) => {
-    if (!reachable) skip();
-
-    await seedExecutedProposals([
-      { app: "slack", action: "send_message", inputs: { channel: "#del", text: "del" } },
-    ]);
-
-    const { saveWorkflowTool } = await import("@/mastra/tools/save-workflow");
-    const { deleteWorkflowTool } = await import("@/mastra/tools/delete-workflow");
-
-    const saved = (await saveWorkflowTool.execute!(
-      { name: "To be deleted" } as any,
-      ctx({ userId, conversationId }),
-    )) as { workflowId: string };
-
-    // Insert a fake workflow_run so we exercise the cascade
-    await supabase.from("workflow_run").insert({
-      id: crypto.randomUUID(),
-      workflow_id: saved.workflowId,
-      inputs: "{}",
-      status: "success",
-      created_at: new Date().toISOString(),
-      completed_at: new Date().toISOString(),
-    });
-
-    const out = (await deleteWorkflowTool.execute!(
-      { workflowId: saved.workflowId } as any,
-      ctx({ userId }),
-    )) as { deleted: true };
-    expect(out.deleted).toBe(true);
-
-    // All three tables should be empty for this workflow
-    const { data: wf } = await supabase.from("workflow").select("id").eq("id", saved.workflowId);
-    const { data: steps } = await supabase
-      .from("workflow_step")
-      .select("id")
-      .eq("workflow_id", saved.workflowId);
-    const { data: runs } = await supabase
-      .from("workflow_run")
-      .select("id")
-      .eq("workflow_id", saved.workflowId);
-    expect(wf).toEqual([]);
-    expect(steps).toEqual([]);
-    expect(runs).toEqual([]);
-  });
-});
diff --git a/packages/agents/tests/live/workflow-triggers.test.ts b/packages/agents/tests/live/workflow-triggers.test.ts
deleted file mode 100644
index 8901a7c4..00000000
--- a/packages/agents/tests/live/workflow-triggers.test.ts
+++ /dev/null
@@ -1,219 +0,0 @@
-/**
- * Live integration tests for the workflow trigger tools.
- *
- * Mirrors workflow-tools.test.ts: seeds user + conversation + executed
- * proposals, calls save_workflow to get a real workflow, then exercises
- * attach/list/detach against the real workflow_trigger table.
- */
-import { RequestContext } from "@mastra/core/request-context";
-import { createClient } from "@supabase/supabase-js";
-import { afterAll, beforeAll, describe, expect, it } from "vitest";
-import type { Database } from "@/lib/db/database.types";
-
-const SUPABASE_URL = process.env.SUPABASE_URL ?? "http://127.0.0.1:54421";
-const SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY ?? "";
-
-async function supabaseIsReachable(): Promise<boolean> {
-  try {
-    const res = await fetch(`${SUPABASE_URL}/rest/v1/`, {
-      headers: { apikey: SUPABASE_SERVICE_ROLE_KEY },
-      signal: AbortSignal.timeout(2000),
-    });
-    return res.status < 500;
-  } catch {
-    return false;
-  }
-}
-
-function ctx({ userId, conversationId }: { userId: string; conversationId?: string }) {
-  const entries: [string, string][] = [["userId", userId]];
-  if (conversationId) entries.push(["threadId", conversationId]);
-  return { requestContext: new RequestContext(entries) } as any;
-}
-
-describe("workflow trigger tools — live Supabase", () => {
-  let reachable = false;
-  let supabase: ReturnType<typeof createClient<Database>>;
-
-  const testRunId = `wf-trig-${Date.now()}`;
-  const userId = `${testRunId}-user`;
-  const conversationId = `${testRunId}-conv`;
-  const createdWorkflowIds: string[] = [];
-
-  beforeAll(async () => {
-    reachable = await supabaseIsReachable();
-    if (!reachable) {
-      console.warn(
-        `\n⚠  Supabase not reachable at ${SUPABASE_URL}. Skipping live trigger tests.\n`,
-      );
-      return;
-    }
-    supabase = createClient<Database>(SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY);
-
-    const now = new Date().toISOString();
-    const { error: userErr } = await supabase.from("user").insert({
-      id: userId,
-      name: "live-trigger-test",
-      email: `${testRunId}@test.local`,
-      emailVerified: true,
-      image: null,
-      createdAt: now,
-      updatedAt: now,
-    });
-    if (userErr) throw new Error(`seed user failed: ${userErr.message}`);
-    const { error: convErr } = await supabase.from("conversation").insert({
-      id: conversationId,
-      user_id: userId,
-      mastra_thread_id: null,
-      title: null,
-      created_at: now,
-      updated_at: now,
-    });
-    if (convErr) throw new Error(`seed conversation failed: ${convErr.message}`);
-  });
-
-  afterAll(async () => {
-    if (!reachable) return;
-    for (const wfId of createdWorkflowIds) {
-      await supabase.from("workflow_trigger").delete().eq("workflow_id", wfId);
-      await supabase.from("workflow_step").delete().eq("workflow_id", wfId);
-      await supabase.from("workflow").delete().eq("id", wfId);
-    }
-    await supabase.from("action_proposal").delete().eq("conversation_id", conversationId);
-    await supabase.from("conversation").delete().eq("id", conversationId);
-    await supabase.from("user").delete().eq("id", userId);
-  });
-
-  async function seedWorkflow(name: string): Promise<string> {
-    const now = Date.now();
-    await supabase.from("action_proposal").insert({
-      id: crypto.randomUUID(),
-      conversation_id: conversationId,
-      mastra_run_id: null,
-      app_key: "slack",
-      action_type: "write",
-      action_key: "send_message",
-      human_label: "slack.send_message",
-      inputs: JSON.stringify({ channel: "#ops", text: "hi" }),
-      input_schema: "{}",
-      connection_id: null,
-      status: "executed",
-      created_at: new Date(now).toISOString(),
-      updated_at: new Date(now).toISOString(),
-    });
-    const { saveWorkflowTool } = await import("@/mastra/tools/save-workflow");
-    const saved = (await saveWorkflowTool.execute!(
-      { name } as any,
-      ctx({ userId, conversationId }),
-    )) as { workflowId: string };
-    createdWorkflowIds.push(saved.workflowId);
-    return saved.workflowId;
-  }
-
-  it("attach_trigger → list_workflow_triggers → detach_trigger round-trip (cron)", async ({
-    skip,
-  }) => {
-    if (!reachable) skip();
-    const workflowId = await seedWorkflow("Cron trigger test");
-
-    const { attachTriggerTool } = await import("@/mastra/tools/attach-trigger");
-    const { listWorkflowTriggersTool } = await import("@/mastra/tools/list-workflow-triggers");
-    const { detachTriggerTool } = await import("@/mastra/tools/detach-trigger");
-
-    const attached = (await attachTriggerTool.execute!(
-      {
-        workflowId,
-        type: "cron",
-        cron: { schedule: "0 9 * * 1-5", timezone: "America/Los_Angeles" },
-      } as any,
-      ctx({ userId }),
-    )) as { id: string; type: string; enabled: boolean };
-
-    expect(attached.type).toBe("cron");
-    expect(attached.enabled).toBe(true);
-
-    // Verify in DB directly
-    const { data: dbRow } = await supabase
-      .from("workflow_trigger")
-      .select("id, type, config")
-      .eq("id", attached.id)
-      .maybeSingle();
-    expect(dbRow).toMatchObject({ type: "cron" });
-    expect(JSON.parse(dbRow?.config as string)).toMatchObject({
-      schedule: "0 9 * * 1-5",
-      timezone: "America/Los_Angeles",
-    });
-
-    const list = (await listWorkflowTriggersTool.execute!(
-      { workflowId } as any,
-      ctx({ userId }),
-    )) as { triggers: Array<{ id: string; type: string; config: any }> };
-    expect(list.triggers).toHaveLength(1);
-    expect(list.triggers[0]).toMatchObject({ id: attached.id, type: "cron" });
-    expect(list.triggers[0].config).toMatchObject({ schedule: "0 9 * * 1-5" });
-
-    const detached = (await detachTriggerTool.execute!(
-      { workflowId, triggerId: attached.id } as any,
-      ctx({ userId }),
-    )) as { deleted: true };
-    expect(detached.deleted).toBe(true);
-
-    const after = (await listWorkflowTriggersTool.execute!(
-      { workflowId } as any,
-      ctx({ userId }),
-    )) as { triggers: any[] };
-    expect(after.triggers).toEqual([]);
-  });
-
-  it("attach_trigger persists a channel trigger", async ({ skip }) => {
-    if (!reachable) skip();
-    const workflowId = await seedWorkflow("Channel trigger test");
-
-    const { attachTriggerTool } = await import("@/mastra/tools/attach-trigger");
-    const attached = (await attachTriggerTool.execute!(
-      {
-        workflowId,
-        type: "channel",
-        channel: { channel: "slack", match: { command: "!standup", room: "#ops" } },
-      } as any,
-      ctx({ userId }),
-    )) as { id: string; type: string };
-
-    expect(attached.type).toBe("channel");
-
-    const { data: dbRow } = await supabase
-      .from("workflow_trigger")
-      .select("type, config")
-      .eq("id", attached.id)
-      .maybeSingle();
-    expect(JSON.parse(dbRow?.config as string)).toMatchObject({
-      channel: "slack",
-      match: { command: "!standup", room: "#ops" },
-    });
-  });
-
-  it("workflow delete cascades to triggers", async ({ skip }) => {
-    if (!reachable) skip();
-    const workflowId = await seedWorkflow("Cascade trigger test");
-
-    const { attachTriggerTool } = await import("@/mastra/tools/attach-trigger");
-    const attached = (await attachTriggerTool.execute!(
-      {
-        workflowId,
-        type: "cron",
-        cron: { schedule: "0 * * * *" },
-      } as any,
-      ctx({ userId }),
-    )) as { id: string };
-
-    // Delete the parent workflow directly
-    await supabase.from("workflow_step").delete().eq("workflow_id", workflowId);
-    await supabase.from("workflow").delete().eq("id", workflowId);
-
-    const { data: orphan } = await supabase
-      .from("workflow_trigger")
-      .select("id")
-      .eq("id", attached.id);
-    expect(orphan).toEqual([]);
-  });
-});
diff --git a/packages/agents/tests/sdk/zapier-sdk.test.ts b/packages/agents/tests/sdk/zapier-sdk.test.ts
index 119a2794..37b1dca0 100644
--- a/packages/agents/tests/sdk/zapier-sdk.test.ts
+++ b/packages/agents/tests/sdk/zapier-sdk.test.ts
@@ -234,7 +234,7 @@ describe("SDK Read Tests", () => {
   );
 
   it(
-    "get-input-fields-schema — gets input schema for an action",
+    "get-action-input-fields-schema — gets input schema for an action",
     async () => {
       if (!firstApp) {
         console.log("  SKIP: no connected app");
@@ -250,13 +250,13 @@ describe("SDK Read Tests", () => {
       const actionKey = items[0].key ?? items[0].id;
       const actionType = items[0].action_type ?? items[0].actionType;
       // getInputFieldsSchema uses: app, actionType, action
-      const result = await exec("get-input-fields-schema", {
+      const result = await exec("get-action-input-fields-schema", {
         app: firstApp,
         actionType: actionType ?? "read",
         action: actionKey,
       });
-      log("get-input-fields-schema", result);
-      assertNotValidationError(result, "get-input-fields-schema");
+      log("get-action-input-fields-schema", result);
+      assertNotValidationError(result, "get-action-input-fields-schema");
       expect(result).toBeDefined();
     },
     TIMEOUT,
@@ -296,7 +296,7 @@ describe("SDK Read Tests", () => {
   );
 
   it(
-    "list-input-field-choices — gets enum options for an action field",
+    "list-action-input-field-choices — gets enum options for an action field",
     async () => {
       if (!firstApp) {
         console.log("  SKIP: no connected app");
@@ -313,12 +313,12 @@ describe("SDK Read Tests", () => {
       const actionType = items[0].action_type ?? items[0].actionType ?? "read";
 
       // Get schema to find a field name
-      const schema = await exec("get-input-fields-schema", {
+      const schema = await exec("get-action-input-fields-schema", {
         app: firstApp,
         actionType,
         action: actionKey,
       });
-      assertNotValidationError(schema, "get-input-fields-schema (for choices)");
+      assertNotValidationError(schema, "get-action-input-fields-schema (for choices)");
       // JSON Schema response: { type: "object", properties: { fieldKey: {...} }, ... }
       const fieldKeys = Object.keys(schema.properties ?? {});
       if (fieldKeys.length === 0) {
@@ -328,14 +328,14 @@ describe("SDK Read Tests", () => {
       const fieldKey = fieldKeys[0];
       console.log(`  Fetching choices for field: ${fieldKey}`);
       // listInputFieldChoices uses: app, actionType, action, inputField
-      const result = await exec("list-input-field-choices", {
+      const result = await exec("list-action-input-field-choices", {
         app: firstApp,
         actionType,
         action: actionKey,
         inputField: fieldKey,
       });
-      log("list-input-field-choices", result);
-      assertNotValidationError(result, "list-input-field-choices");
+      log("list-action-input-field-choices", result);
+      assertNotValidationError(result, "list-action-input-field-choices");
       expect(result).toBeDefined();
     },
     TIMEOUT,
@@ -429,8 +429,8 @@ describe("SDK Error Handling", () => {
       "list-actions",
       "get-action",
       "get-app",
-      "get-input-fields-schema",
-      "list-input-field-choices",
+      "get-action-input-fields-schema",
+      "list-action-input-field-choices",
       "run-action",
       "fetch",
       "find-first-connection",
@@ -491,7 +491,9 @@ describe("SDK Write Tests", () => {
     // 3. List fields to verify
     const listFields = await exec("list-table-fields", { table: createdTableId });
     assertNotValidationError(listFields, "list-table-fields");
-    const fields = listFields?.data ?? listFields;
+    // SDK 0.79.0 returns the paginated envelope `{ items, count }`; older
+    // shapes used `.data` or a bare array — accept all three.
+    const fields = listFields?.items ?? listFields?.data ?? listFields;
     expect(Array.isArray(fields)).toBe(true);
     console.log(`  Table has ${fields.length} field(s)`);
 
@@ -511,7 +513,8 @@ describe("SDK Write Tests", () => {
     // 5. List records to verify
     const listRecords = await exec("list-table-records", { table: createdTableId });
     assertNotValidationError(listRecords, "list-table-records");
-    const records = listRecords?.data ?? listRecords;
+    // SDK 0.79.0 paginated envelope `{ items, count }` (see list-table-fields above).
+    const records = listRecords?.items ?? listRecords?.data ?? listRecords;
     expect(Array.isArray(records)).toBe(true);
     expect(records.length).toBeGreaterThanOrEqual(3);
     console.log(`  Found ${records.length} record(s)`);
diff --git a/packages/agents/tests/unit/automation-tools.test.ts b/packages/agents/tests/unit/automation-tools.test.ts
new file mode 100644
index 00000000..a9c05a07
--- /dev/null
+++ b/packages/agents/tests/unit/automation-tools.test.ts
@@ -0,0 +1,42 @@
+/**
+ * Unit tests for the durable-automation agent tools (foreman-l7xq M1).
+ * Confirms the tools are registered with the right ids, approval gating, and
+ * schemas — the surface the foreman agent exposes for authoring automations.
+ */
+import { describe, expect, it } from "vitest";
+import {
+  createAutomationTool,
+  inspectAutomationTool,
+  listAutomationsTool,
+  runAutomationTool,
+} from "../../src/mastra/tools/automations";
+
+const allTools = [
+  createAutomationTool,
+  runAutomationTool,
+  listAutomationsTool,
+  inspectAutomationTool,
+];
+
+describe("automation tools", () => {
+  it("expose the expected tool ids", () => {
+    expect(createAutomationTool.id).toBe("create_automation");
+    expect(runAutomationTool.id).toBe("run_automation");
+    expect(listAutomationsTool.id).toBe("list_automations");
+    expect(inspectAutomationTool.id).toBe("inspect_automation");
+  });
+
+  it("gate the write tools behind approval and leave reads open", () => {
+    expect(createAutomationTool.requireApproval).toBe(true);
+    expect(runAutomationTool.requireApproval).toBe(true);
+    expect(listAutomationsTool.requireApproval).toBeFalsy();
+    expect(inspectAutomationTool.requireApproval).toBeFalsy();
+  });
+
+  it("declare input and output schemas", () => {
+    for (const tool of allTools) {
+      expect(tool.inputSchema, `${tool.id} inputSchema`).toBeDefined();
+      expect(tool.outputSchema, `${tool.id} outputSchema`).toBeDefined();
+    }
+  });
+});
diff --git a/packages/agents/tests/unit/automations-service.test.ts b/packages/agents/tests/unit/automations-service.test.ts
new file mode 100644
index 00000000..68de71c4
--- /dev/null
+++ b/packages/agents/tests/unit/automations-service.test.ts
@@ -0,0 +1,396 @@
+/**
+ * Unit tests for the automation service (foreman-l7xq M2) — the deploy+persist
+ * orchestration shared by the agent tools and the web routes. Mocks the durable
+ * layer, the store, identity, and the SDK resolver.
+ */
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@/lib/identity", () => ({ resolveActiveWorkspace: vi.fn(async () => "ws-1") }));
+vi.mock("@/lib/zapier/sdk", () => ({
+  getExperimentalSdkForUser: vi.fn(async (userId: string) => ({ __owner: userId })),
+}));
+vi.mock("@/lib/trigger-inbox", () => ({ getInbox: vi.fn(), listInboxMessages: vi.fn() }));
+vi.mock("@/lib/automations/schedules", () => ({
+  registerAutomationSchedule: vi.fn(async () => true),
+  unregisterAutomationSchedule: vi.fn(async () => {}),
+  assertValidCron: vi.fn(),
+}));
+vi.mock("@/lib/durable", () => ({
+  deployAutomation: vi.fn(async () => ({
+    workflowId: "wf_1",
+    versionId: "ver_1",
+    enabled: true,
+    isPrivate: true,
+    editorUrl: "https://zapier.com/durables-editor/wf_1",
+    triggerUrl: "https://trig/x",
+    triggerClaimFailed: false,
+    disabledReason: null,
+  })),
+  triggerAutomation: vi.fn(async () => ({ triggerId: "trig_1" })),
+  getTriggerRunStatus: vi.fn(async () => ({
+    status: "finished",
+    durableRunId: "dr_1",
+    output: null,
+    error: null,
+  })),
+  setAutomationEnabled: vi.fn(async () => false),
+  deleteAutomation: vi.fn(async () => {}),
+  cancelDurableRun: vi.fn(async () => "cancelled"),
+  resolveCallbackUrl: vi.fn(),
+  postCallback: vi.fn(async () => ({ ok: true, status: 200 })),
+}));
+vi.mock("@/lib/automations/store", () => ({
+  createAutomation: vi.fn(async () => "auto_1"),
+  getAutomation: vi.fn(),
+  listAutomations: vi.fn(async () => [{ id: "auto_1" }]),
+  listRuns: vi.fn(async () => []),
+  getLatestDigest: vi.fn(async () => null),
+  getRun: vi.fn(),
+  recordRun: vi.fn(async () => "run_1"),
+  updateRun: vi.fn(async () => {}),
+  deleteAutomation: vi.fn(),
+  updateAutomation: vi.fn(async () => true),
+}));
+
+import { registerAutomationSchedule } from "@/lib/automations/schedules";
+import {
+  cancelRunForUser,
+  getWorkspaceInbox,
+  provisionAutomation,
+  removeAutomationForUser,
+  respondToCallbackForUser,
+  runAutomationById,
+} from "@/lib/automations/service";
+import * as store from "@/lib/automations/store";
+import {
+  cancelDurableRun,
+  deleteAutomation as deleteZapierWorkflow,
+  deployAutomation,
+  postCallback,
+  resolveCallbackUrl,
+} from "@/lib/durable";
+import { getInbox, listInboxMessages } from "@/lib/trigger-inbox";
+import { getExperimentalSdkForUser } from "@/lib/zapier/sdk";
+
+describe("provisionAutomation", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("deploys then persists, mapping a clean deploy to status=active", async () => {
+    const result = await provisionAutomation({
+      userId: "user-1",
+      name: "Notify",
+      source: "SRC",
+      connections: { slack: "123" },
+    });
+
+    expect(result.id).toBe("auto_1");
+    expect(result.workflowId).toBe("wf_1");
+
+    const persisted = vi.mocked(store.createAutomation).mock.calls[0][0];
+    expect(persisted).toMatchObject({
+      userId: "user-1",
+      workspaceId: "ws-1",
+      zapierWorkflowId: "wf_1",
+      zapierVersionId: "ver_1",
+      status: "active",
+      enabled: true,
+    });
+  });
+
+  it("stores an inbox trigger spec (deployed as a manual durable — the worker arms it)", async () => {
+    await provisionAutomation({
+      userId: "user-1",
+      name: "On new issue",
+      source: "SRC",
+      trigger: { app: "github", action: "new_issue", inputs: { repo: "owner/name" } },
+    });
+
+    // The durable is deployed WITHOUT a Zapier-claimed trigger.
+    const deployArg = vi.mocked(deployAutomation).mock.calls[0][0];
+    expect(deployArg.trigger).toBeUndefined();
+
+    // The inbox subscription is persisted on the automation for the worker.
+    const persisted = vi.mocked(store.createAutomation).mock.calls[0][0];
+    expect(persisted.trigger).toEqual({
+      app: "github",
+      action: "new_issue",
+      inputs: { repo: "owner/name" },
+    });
+  });
+
+  it("creates a digest WITHOUT a durable + registers a daily-digest schedule (foreman-bhb5)", async () => {
+    const result = await provisionAutomation({
+      userId: "user-1",
+      name: "Morning digest",
+      schedule: { cron: "0 9 * * *" },
+      digest: true,
+    });
+
+    expect(result.id).toBe("auto_1");
+    expect(deployAutomation).not.toHaveBeenCalled(); // no Zapier durable for a digest
+
+    const persisted = vi.mocked(store.createAutomation).mock.calls[0][0];
+    expect(persisted.trigger).toEqual({ schedule: { cron: "0 9 * * *" }, digest: true });
+    expect(persisted.zapierWorkflowId).toMatch(/^foreman:digest:/); // unique sentinel
+    expect(persisted.status).toBe("active");
+
+    // Mastra owns the firing — a schedule targeting the digest workflow is registered.
+    expect(registerAutomationSchedule).toHaveBeenCalledWith(
+      expect.objectContaining({
+        automationId: "auto_1",
+        workflow: "daily-digest",
+        cron: "0 9 * * *",
+      }),
+    );
+  });
+
+  it("deploys a durable for a scheduled automation + registers a run-automation schedule", async () => {
+    await provisionAutomation({
+      userId: "user-1",
+      name: "Nightly sync",
+      source: "SRC",
+      schedule: { cron: "0 3 * * *", timezone: "America/New_York" },
+    });
+
+    expect(deployAutomation).toHaveBeenCalled();
+    const persisted = vi.mocked(store.createAutomation).mock.calls[0][0];
+    expect(persisted.trigger).toEqual({
+      schedule: { cron: "0 3 * * *", timezone: "America/New_York" },
+    });
+    expect(registerAutomationSchedule).toHaveBeenCalledWith(
+      expect.objectContaining({ automationId: "auto_1", workflow: "run-automation" }),
+    );
+  });
+});
+
+describe("runAutomationById", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("returns null when the automation isn't in the workspace", async () => {
+    vi.mocked(store.getAutomation).mockResolvedValueOnce(null);
+    const result = await runAutomationById("user-1", "missing");
+    expect(result).toBeNull();
+  });
+
+  it("triggers and records a run for an existing automation", async () => {
+    vi.mocked(store.getAutomation).mockResolvedValueOnce({
+      id: "auto_1",
+      zapier_workflow_id: "wf_1",
+    } as never);
+
+    const result = await runAutomationById("user-1", "auto_1", { x: 1 });
+    expect(result).toEqual({
+      runId: "run_1",
+      triggerId: "trig_1",
+      status: "finished",
+      durableRunId: "dr_1",
+    });
+    expect(store.recordRun).toHaveBeenCalledWith(
+      expect.objectContaining({
+        automationId: "auto_1",
+        triggerId: "trig_1",
+        durableRunId: "dr_1",
+      }),
+    );
+  });
+});
+
+describe("cancelRunForUser (foreman-y4kc)", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("returns null when the run isn't in the workspace", async () => {
+    vi.mocked(store.getRun).mockResolvedValueOnce(null);
+    expect(await cancelRunForUser("user-1", "missing")).toBeNull();
+    expect(cancelDurableRun).not.toHaveBeenCalled();
+  });
+
+  it("no-ops on an already-terminal run", async () => {
+    vi.mocked(store.getRun).mockResolvedValueOnce({
+      id: "run_1",
+      status: "finished",
+      durable_run_id: "dr_1",
+    } as never);
+    expect(await cancelRunForUser("user-1", "run_1")).toEqual({
+      cancelled: false,
+      status: "finished",
+    });
+    expect(cancelDurableRun).not.toHaveBeenCalled();
+    expect(store.updateRun).not.toHaveBeenCalled();
+  });
+
+  it("cancels the durable and records the status for a running run", async () => {
+    vi.mocked(store.getRun).mockResolvedValueOnce({
+      id: "run_1",
+      status: "started",
+      durable_run_id: "dr_1",
+    } as never);
+    const result = await cancelRunForUser("user-1", "run_1");
+    expect(result).toEqual({ cancelled: true, status: "cancelled" });
+    expect(cancelDurableRun).toHaveBeenCalledWith(expect.anything(), "dr_1");
+    expect(store.updateRun).toHaveBeenCalledWith("run_1", { status: "cancelled" });
+  });
+
+  it("cancels locally (no SDK) when the durable hasn't linked yet", async () => {
+    vi.mocked(store.getRun).mockResolvedValueOnce({
+      id: "run_1",
+      status: "started",
+      durable_run_id: null,
+    } as never);
+    const result = await cancelRunForUser("user-1", "run_1");
+    expect(result).toEqual({ cancelled: true, status: "cancelled" });
+    expect(cancelDurableRun).not.toHaveBeenCalled();
+    expect(store.updateRun).toHaveBeenCalledWith("run_1", { status: "cancelled" });
+  });
+});
+
+describe("respondToCallbackForUser (foreman-zfnj)", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("returns null when the run isn't in the workspace", async () => {
+    vi.mocked(store.getRun).mockResolvedValueOnce(null);
+    expect(await respondToCallbackForUser("user-1", "missing", {})).toBeNull();
+  });
+
+  it("no-ops (action=none) when the run isn't waiting", async () => {
+    vi.mocked(store.getRun).mockResolvedValueOnce({
+      id: "run_1",
+      status: "started",
+      durable_run_id: "dr_1",
+    } as never);
+    const r = await respondToCallbackForUser("user-1", "run_1", { payload: { approved: true } });
+    expect(r).toMatchObject({ ok: false, action: "none" });
+    expect(resolveCallbackUrl).not.toHaveBeenCalled();
+  });
+
+  it("approve → resolves the URL server-side + POSTs the payload", async () => {
+    vi.mocked(store.getRun).mockResolvedValueOnce({
+      id: "run_1",
+      status: "waiting",
+      durable_run_id: "dr_1",
+    } as never);
+    vi.mocked(resolveCallbackUrl).mockResolvedValueOnce({
+      url: "https://cb.example/abc",
+      name: "approve",
+    } as never);
+    const r = await respondToCallbackForUser("user-1", "run_1", { payload: { approved: true } });
+    expect(r).toEqual({ ok: true, action: "resumed", status: 200 });
+    expect(postCallback).toHaveBeenCalledWith("https://cb.example/abc", { approved: true });
+  });
+
+  it("approve but no reported URL → action=none (nothing POSTed)", async () => {
+    vi.mocked(store.getRun).mockResolvedValueOnce({
+      id: "run_1",
+      status: "waiting",
+      durable_run_id: "dr_1",
+    } as never);
+    vi.mocked(resolveCallbackUrl).mockResolvedValueOnce(null);
+    const r = await respondToCallbackForUser("user-1", "run_1", { payload: { approved: true } });
+    expect(r).toMatchObject({ ok: false, action: "none" });
+    expect(postCallback).not.toHaveBeenCalled();
+  });
+
+  it("deny (cancel) → cancels the durable run, no callback POST", async () => {
+    vi.mocked(store.getRun).mockResolvedValueOnce({
+      id: "run_1",
+      status: "waiting",
+      durable_run_id: "dr_1",
+    } as never);
+    const r = await respondToCallbackForUser("user-1", "run_1", { cancel: true });
+    expect(r).toEqual({ ok: true, action: "cancelled" });
+    expect(cancelDurableRun).toHaveBeenCalledWith(expect.anything(), "dr_1");
+    expect(store.updateRun).toHaveBeenCalledWith("run_1", { status: "cancelled" });
+    expect(postCallback).not.toHaveBeenCalled();
+  });
+});
+
+describe("getWorkspaceInbox (foreman-6r9y)", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  const automations = [
+    // teammate-owned, trigger broken → should rank highest
+    {
+      id: "auto_b",
+      user_id: "user-2",
+      name: "Teammate broken",
+      enabled: true,
+      status: "trigger_failed",
+      trigger: { app: "gmail", action: "new_email" },
+      trigger_inbox_id: "inbox-b",
+    },
+    // self-owned, quiet → low priority
+    {
+      id: "auto_a",
+      user_id: "user-1",
+      name: "My quiet automation",
+      enabled: true,
+      status: "active",
+      trigger: { app: "sheets", action: "new_row" },
+      trigger_inbox_id: "inbox-a",
+    },
+    // self-owned but no inbox → filtered out entirely
+    { id: "auto_c", user_id: "user-1", trigger_inbox_id: null },
+  ];
+
+  it("aggregates teammate inboxes with owner attribution and ranks by priority", async () => {
+    vi.mocked(store.listAutomations).mockResolvedValueOnce(automations as never);
+    vi.mocked(getInbox).mockResolvedValue({ status: "active", paused_reason: null } as never);
+    vi.mocked(listInboxMessages).mockResolvedValue([] as never);
+
+    const { entries } = await getWorkspaceInbox("user-1");
+
+    // auto_c has no inbox → dropped; the other two remain.
+    expect(entries.map((e) => e.automation.id)).toEqual(["auto_b", "auto_a"]);
+
+    // Highest-priority first: the teammate's broken trigger outranks the quiet one.
+    expect(entries[0].automation.id).toBe("auto_b");
+    expect(entries[0].priority.level).toBe("high");
+    expect(entries[0].owner).toEqual({ userId: "user-2", isSelf: false });
+
+    expect(entries[1].priority.level).toBe("low");
+    expect(entries[1].owner).toEqual({ userId: "user-1", isSelf: true });
+
+    // Each inbox is read with its OWNER's SDK, resolved once per distinct owner.
+    expect(getExperimentalSdkForUser).toHaveBeenCalledWith("user-1");
+    expect(getExperimentalSdkForUser).toHaveBeenCalledWith("user-2");
+    expect(getExperimentalSdkForUser).toHaveBeenCalledTimes(2);
+  });
+
+  it("degrades an un-connected owner to an empty entry instead of failing", async () => {
+    vi.mocked(store.listAutomations).mockResolvedValueOnce([automations[1]] as never);
+    vi.mocked(getExperimentalSdkForUser).mockRejectedValueOnce(new Error("reauth required"));
+
+    const { entries } = await getWorkspaceInbox("user-1");
+
+    expect(entries).toHaveLength(1);
+    expect(entries[0].inbox).toBeNull();
+    expect(entries[0].messages).toEqual([]);
+    expect(getInbox).not.toHaveBeenCalled();
+  });
+
+  it("returns no entries but still the latest digest when there are no inbox automations", async () => {
+    vi.mocked(store.listAutomations).mockResolvedValueOnce([automations[2]] as never);
+    const fakeDigest = { kind: "automation_digest", headline: "2 runs · 2 ok" };
+    vi.mocked(store.getLatestDigest).mockResolvedValueOnce(fakeDigest as never);
+    expect(await getWorkspaceInbox("user-1")).toEqual({ entries: [], digest: fakeDigest });
+    expect(getExperimentalSdkForUser).not.toHaveBeenCalled();
+  });
+});
+
+describe("removeAutomationForUser", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("returns false when nothing was deleted", async () => {
+    vi.mocked(store.deleteAutomation).mockResolvedValueOnce(null);
+    expect(await removeAutomationForUser("user-1", "missing")).toBe(false);
+    expect(deleteZapierWorkflow).not.toHaveBeenCalled();
+  });
+
+  it("deletes the row and best-effort removes the Zapier workflow", async () => {
+    vi.mocked(store.deleteAutomation).mockResolvedValueOnce({
+      id: "auto_1",
+      zapier_workflow_id: "wf_1",
+    } as never);
+    expect(await removeAutomationForUser("user-1", "auto_1")).toBe(true);
+    expect(deleteZapierWorkflow).toHaveBeenCalledWith(expect.anything(), "wf_1");
+  });
+});
diff --git a/packages/agents/tests/unit/automations-store.test.ts b/packages/agents/tests/unit/automations-store.test.ts
new file mode 100644
index 00000000..7cbe5133
--- /dev/null
+++ b/packages/agents/tests/unit/automations-store.test.ts
@@ -0,0 +1,150 @@
+/**
+ * Unit tests for the automation store (foreman-l7xq M2). Mocks the Supabase
+ * client; asserts insert shape, workspace scoping, and the idempotent inbox claim.
+ */
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+let nextResult: { data: unknown; error: unknown } = { data: null, error: null };
+let lastInsert: Record<string, unknown> | null = null;
+let lastTable: string | null = null;
+
+function createChain() {
+  const builder: Record<string, unknown> = {};
+  for (const m of ["select", "eq", "order", "limit", "update", "delete"]) {
+    builder[m] = vi.fn().mockReturnValue(builder);
+  }
+  builder.insert = vi.fn().mockImplementation((payload: Record<string, unknown>) => {
+    lastInsert = payload;
+    return builder;
+  });
+  builder.maybeSingle = vi.fn().mockImplementation(() => Promise.resolve(nextResult));
+  // biome-ignore lint/suspicious/noThenProperty: deliberate — makes the query builder awaitable
+  builder.then = (resolve: (v: unknown) => unknown) => resolve(nextResult);
+  return builder;
+}
+
+const mockSupabase = {
+  from: vi.fn((t: string) => {
+    lastTable = t;
+    return createChain();
+  }),
+};
+
+vi.mock("@/lib/db", () => ({ getSupabase: () => mockSupabase }));
+
+import {
+  claimInboxMessage,
+  createAutomation,
+  getAutomationByZapierWorkflowId,
+  listAutomations,
+} from "@/lib/automations/store";
+
+describe("createAutomation", () => {
+  beforeEach(() => {
+    nextResult = { data: null, error: null };
+    lastInsert = null;
+    lastTable = null;
+  });
+
+  it("inserts a workspace-scoped row with sane defaults", async () => {
+    const id = await createAutomation({
+      userId: "user-1",
+      workspaceId: "ws-1",
+      name: "Notify",
+      source: "SRC",
+      zapierWorkflowId: "wf_1",
+      zapierVersionId: "ver_1",
+    });
+    expect(typeof id).toBe("string");
+    expect(lastTable).toBe("automation");
+    expect(lastInsert).toMatchObject({
+      user_id: "user-1",
+      workspace_id: "ws-1",
+      name: "Notify",
+      zapier_workflow_id: "wf_1",
+      zapier_version_id: "ver_1",
+      source: "SRC",
+      connections: {},
+      trigger: null,
+      enabled: false,
+      status: "active",
+    });
+  });
+
+  it("throws when the insert errors", async () => {
+    nextResult = { data: null, error: { message: "boom" } };
+    await expect(
+      createAutomation({
+        userId: "u",
+        workspaceId: "ws-1",
+        name: "n",
+        source: "s",
+        zapierWorkflowId: "wf",
+      }),
+    ).rejects.toThrow(/createAutomation failed: boom/);
+  });
+});
+
+describe("listAutomations", () => {
+  beforeEach(() => {
+    nextResult = { data: null, error: null };
+  });
+
+  it("returns rows for a workspace", async () => {
+    nextResult = { data: [{ id: "a1" }, { id: "a2" }], error: null };
+    const rows = await listAutomations("ws-1");
+    expect(rows).toHaveLength(2);
+  });
+
+  it("returns empty (no query) when no workspace", async () => {
+    const rows = await listAutomations(undefined);
+    expect(rows).toEqual([]);
+  });
+});
+
+describe("claimInboxMessage — idempotency", () => {
+  beforeEach(() => {
+    nextResult = { data: null, error: null };
+    lastInsert = null;
+  });
+
+  it("claims a fresh message (returns a run id)", async () => {
+    nextResult = { data: { id: "row" }, error: null };
+    const id = await claimInboxMessage({
+      automationId: "a1",
+      workspaceId: "ws-1",
+      inboxMessageId: "m1",
+    });
+    expect(typeof id).toBe("string");
+    expect(lastInsert).toMatchObject({
+      automation_id: "a1",
+      inbox_message_id: "m1",
+      status: "initialized",
+    });
+  });
+
+  it("returns null on a unique-violation (already claimed → skip)", async () => {
+    nextResult = { data: null, error: { code: "23505", message: "duplicate key" } };
+    const id = await claimInboxMessage({
+      automationId: "a1",
+      workspaceId: "ws-1",
+      inboxMessageId: "m1",
+    });
+    expect(id).toBeNull();
+  });
+
+  it("rethrows non-conflict errors", async () => {
+    nextResult = { data: null, error: { code: "42P01", message: "no table" } };
+    await expect(
+      claimInboxMessage({ automationId: "a1", workspaceId: "ws-1", inboxMessageId: "m1" }),
+    ).rejects.toThrow(/claimInboxMessage failed/);
+  });
+});
+
+describe("getAutomationByZapierWorkflowId", () => {
+  it("resolves a Zapier workflow id back to its automation", async () => {
+    nextResult = { data: { id: "a1", zapier_workflow_id: "wf_1" }, error: null };
+    const row = await getAutomationByZapierWorkflowId("wf_1");
+    expect(row?.id).toBe("a1");
+  });
+});
diff --git a/packages/agents/tests/unit/automations-worker.test.ts b/packages/agents/tests/unit/automations-worker.test.ts
new file mode 100644
index 00000000..eb9f694a
--- /dev/null
+++ b/packages/agents/tests/unit/automations-worker.test.ts
@@ -0,0 +1,424 @@
+/**
+ * Unit tests for the trigger-inbox worker (foreman-l7xq M3). Mocks the store, the
+ * trigger-inbox layer, and the durable layer. The dedup assertion is the point: a
+ * redelivered (already-claimed) message must not re-fire the durable.
+ */
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@/lib/zapier/sdk", () => ({ getExperimentalSdkForUser: vi.fn(async () => ({})) }));
+vi.mock("@/lib/durable", () => ({
+  triggerAutomation: vi.fn(async () => ({ triggerId: "trig_1" })),
+  getTriggerRunStatus: vi.fn(async () => ({
+    status: "started",
+    durableRunId: "dr_1",
+    output: null,
+    error: null,
+  })),
+  getDurableRunStatus: vi.fn(async () => ({
+    status: "finished",
+    output: { ok: true },
+    error: null,
+    detail: null,
+  })),
+}));
+vi.mock("@/lib/trigger-inbox", () => ({
+  ensureInbox: vi.fn(async () => ({ id: "inbox_1", status: "active" })),
+  leaseMessages: vi.fn(),
+  ackMessages: vi.fn(async () => ({})),
+  releaseMessages: vi.fn(async () => ({})),
+}));
+vi.mock("@/lib/automations/store", () => ({
+  claimInboxMessage: vi.fn(),
+  updateRun: vi.fn(async () => {}),
+  updateAutomation: vi.fn(async () => true),
+  listActiveInboxAutomations: vi.fn(async () => []),
+  listPendingRuns: vi.fn(async () => []),
+  getAutomationsByIds: vi.fn(async () => []),
+}));
+
+import * as store from "@/lib/automations/store";
+import {
+  dispatchMessage,
+  reconcilePendingRuns,
+  runInboxCycleForAutomation,
+} from "@/lib/automations/worker";
+import { getDurableRunStatus, getTriggerRunStatus, triggerAutomation } from "@/lib/durable";
+import { ackMessages, ensureInbox, leaseMessages, releaseMessages } from "@/lib/trigger-inbox";
+
+const automation = {
+  id: "auto_1",
+  user_id: "user-1",
+  workspace_id: "ws-1",
+  zapier_workflow_id: "wf_1",
+  trigger: { app: "github", action: "new_issue" },
+  trigger_inbox_id: null,
+  enabled: true,
+} as never;
+
+function msg(id: string) {
+  return {
+    id,
+    created_at: "t",
+    status: "leased",
+    message_attributes: { lease_count: 1, error_message: null, possible_duplicate_data: false },
+    payload: { id },
+  };
+}
+
+function leaseOf(results: ReturnType<typeof msg>[], leaseId: string | null = "lease_1") {
+  return {
+    lease_id: leaseId,
+    leased_until: "t",
+    results,
+    inbox_attributes: { status: "active", paused_reason: null },
+  };
+}
+
+describe("dispatchMessage", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("skips an already-claimed (redelivered) message without firing", async () => {
+    vi.mocked(store.claimInboxMessage).mockResolvedValueOnce(null);
+    const out = await dispatchMessage({ sdk: {} as never, automation, message: msg("m1") });
+    expect(out).toBe("skipped");
+    expect(triggerAutomation).not.toHaveBeenCalled();
+  });
+
+  it("fires + records the run as 'started' (no blocking poll — reconcile finishes it)", async () => {
+    vi.mocked(store.claimInboxMessage).mockResolvedValueOnce("run_1");
+    const out = await dispatchMessage({ sdk: {} as never, automation, message: msg("m1") });
+    expect(out).toBe("processed");
+    expect(triggerAutomation).toHaveBeenCalledWith(
+      expect.objectContaining({ workflowId: "wf_1", input: { id: "m1" } }),
+    );
+    expect(store.updateRun).toHaveBeenCalledWith(
+      "run_1",
+      expect.objectContaining({ status: "started", triggerId: "trig_1" }),
+    );
+    // It must NOT block on the trigger/durable status at dispatch time.
+    expect(getTriggerRunStatus).not.toHaveBeenCalled();
+  });
+
+  it("marks failed + records the error when the trigger throws", async () => {
+    vi.mocked(store.claimInboxMessage).mockResolvedValueOnce("run_2");
+    vi.mocked(triggerAutomation).mockRejectedValueOnce(new Error("boom"));
+    const out = await dispatchMessage({ sdk: {} as never, automation, message: msg("m1") });
+    expect(out).toBe("failed");
+    expect(store.updateRun).toHaveBeenCalledWith(
+      "run_2",
+      expect.objectContaining({ status: "failed" }),
+    );
+  });
+
+  it("skips a possible-duplicate event without claiming when the flag is on (foreman-b8k2)", async () => {
+    process.env.FOREMAN_SKIP_POSSIBLE_DUPLICATES = "true";
+    try {
+      const dup = msg("m1");
+      dup.message_attributes.possible_duplicate_data = true;
+      const out = await dispatchMessage({ sdk: {} as never, automation, message: dup });
+      expect(out).toBe("skipped");
+      expect(store.claimInboxMessage).not.toHaveBeenCalled();
+      expect(triggerAutomation).not.toHaveBeenCalled();
+    } finally {
+      delete process.env.FOREMAN_SKIP_POSSIBLE_DUPLICATES;
+    }
+  });
+
+  it("still fires a possible-duplicate event when the flag is off (default)", async () => {
+    const dup = msg("m1");
+    dup.message_attributes.possible_duplicate_data = true;
+    vi.mocked(store.claimInboxMessage).mockResolvedValueOnce("run_dup");
+    const out = await dispatchMessage({ sdk: {} as never, automation, message: dup });
+    expect(out).toBe("processed");
+    expect(triggerAutomation).toHaveBeenCalled();
+  });
+});
+
+describe("runInboxCycleForAutomation", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("ensures the inbox, dispatches the batch, acks done + releases failed", async () => {
+    vi.mocked(leaseMessages).mockResolvedValueOnce(
+      leaseOf([msg("m1"), msg("m2"), msg("m3")]) as never,
+    );
+    // m1 fresh → processed, m2 redelivery → skipped, m3 fresh but trigger throws → failed
+    vi.mocked(store.claimInboxMessage)
+      .mockResolvedValueOnce("run_m1")
+      .mockResolvedValueOnce(null)
+      .mockResolvedValueOnce("run_m3");
+    vi.mocked(triggerAutomation)
+      .mockResolvedValueOnce({ triggerId: "t1" } as never)
+      .mockRejectedValueOnce(new Error("x"));
+
+    const res = await runInboxCycleForAutomation({ sdk: {} as never, automation });
+
+    expect(ensureInbox).toHaveBeenCalled();
+    expect(res).toMatchObject({ inboxId: "inbox_1", processed: 1, skipped: 1, failed: 1 });
+    expect(ackMessages).toHaveBeenCalledWith(expect.objectContaining({ messages: ["m1", "m2"] }));
+    expect(releaseMessages).toHaveBeenCalledWith(expect.objectContaining({ messages: ["m3"] }));
+    // persisted the inbox id (it was null before)
+    expect(store.updateAutomation).toHaveBeenCalledWith("ws-1", "auto_1", {
+      triggerInboxId: "inbox_1",
+    });
+  });
+
+  it("marks the automation trigger_failed when the inbox can't initialize (foreman-dwf8)", async () => {
+    vi.mocked(ensureInbox).mockResolvedValueOnce({
+      id: "inbox_1",
+      status: "initialization_failure",
+    } as never);
+    vi.mocked(leaseMessages).mockResolvedValueOnce(leaseOf([], null) as never);
+    // Inbox already armed + currently "active" — only the status should change.
+    const armed = { ...(automation as object), trigger_inbox_id: "inbox_1", status: "active" };
+    await runInboxCycleForAutomation({ sdk: {} as never, automation: armed as never });
+    expect(store.updateAutomation).toHaveBeenCalledWith("ws-1", "auto_1", {
+      status: "trigger_failed",
+    });
+  });
+
+  it("clears trigger_failed back to active once the inbox recovers (foreman-dwf8)", async () => {
+    vi.mocked(ensureInbox).mockResolvedValueOnce({ id: "inbox_1", status: "active" } as never);
+    vi.mocked(leaseMessages).mockResolvedValueOnce(leaseOf([], null) as never);
+    const failed = {
+      ...(automation as object),
+      trigger_inbox_id: "inbox_1",
+      status: "trigger_failed",
+    };
+    await runInboxCycleForAutomation({ sdk: {} as never, automation: failed as never });
+    expect(store.updateAutomation).toHaveBeenCalledWith("ws-1", "auto_1", { status: "active" });
+  });
+
+  it("returns zeros and skips ensureInbox when not inbox-triggered", async () => {
+    const noTrigger = { ...(automation as object), trigger: null } as never;
+    const res = await runInboxCycleForAutomation({ sdk: {} as never, automation: noTrigger });
+    expect(res).toMatchObject({ processed: 0, skipped: 0, failed: 0, inboxId: null });
+    expect(ensureInbox).not.toHaveBeenCalled();
+  });
+
+  it("no-ops on an empty lease (no ack/release)", async () => {
+    vi.mocked(leaseMessages).mockResolvedValueOnce(leaseOf([], null) as never);
+    const res = await runInboxCycleForAutomation({ sdk: {} as never, automation });
+    expect(res.processed).toBe(0);
+    expect(ackMessages).not.toHaveBeenCalled();
+    expect(releaseMessages).not.toHaveBeenCalled();
+  });
+});
+
+describe("reconcilePendingRuns", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  const NOW = new Date().toISOString();
+  const OLD = "2020-01-01T00:00:00.000Z"; // older than any STUCK_RUN_TIMEOUT_MS
+  const pendingRun = {
+    id: "run_1",
+    automation_id: "auto_1",
+    trigger_id: "trig_1",
+    durable_run_id: null,
+    status: "started",
+    created_at: NOW,
+  };
+  const auto = [{ id: "auto_1", user_id: "user-1" }];
+
+  it("resolves trigger→durable and writes the terminal status", async () => {
+    vi.mocked(store.listPendingRuns).mockResolvedValueOnce([pendingRun] as never);
+    vi.mocked(store.getAutomationsByIds).mockResolvedValueOnce([
+      { id: "auto_1", user_id: "user-1" },
+    ] as never);
+    // durable not linked yet → getTriggerRun resolves it; getDurableRun → finished
+    vi.mocked(getTriggerRunStatus).mockResolvedValueOnce({
+      status: "started",
+      durableRunId: "dr_9",
+      output: null,
+      error: null,
+    } as never);
+
+    const res = await reconcilePendingRuns();
+
+    expect(res).toEqual({ checked: 1, updated: 1 });
+    expect(getDurableRunStatus).toHaveBeenCalledWith(expect.anything(), "dr_9");
+    expect(store.updateRun).toHaveBeenCalledWith(
+      "run_1",
+      expect.objectContaining({ status: "finished", durableRunId: "dr_9" }),
+    );
+  });
+
+  it("flips a run to 'retrying' and surfaces the durable detail (foreman-jc12)", async () => {
+    vi.mocked(store.listPendingRuns).mockResolvedValueOnce([
+      { ...pendingRun, durable_run_id: "dr_9" },
+    ] as never);
+    vi.mocked(store.getAutomationsByIds).mockResolvedValueOnce([
+      { id: "auto_1", user_id: "user-1" },
+    ] as never);
+    const detail = {
+      totalAttempts: 2,
+      lastError: { code: "X", title: "boom" },
+      retrying: [{ name: "s", type: "run", status: "retrying", retryCount: 1 }],
+    };
+    vi.mocked(getDurableRunStatus).mockResolvedValueOnce({
+      status: "started",
+      output: null,
+      error: null,
+      detail,
+    } as never);
+
+    const res = await reconcilePendingRuns();
+    // Non-terminal → not counted as "updated", but the row is rewritten.
+    expect(res).toEqual({ checked: 1, updated: 0 });
+    expect(store.updateRun).toHaveBeenCalledWith(
+      "run_1",
+      expect.objectContaining({ status: "retrying", error: detail }),
+    );
+  });
+
+  it("flips a run to 'waiting' when the durable pauses on a callback (foreman-rm8z)", async () => {
+    vi.mocked(store.listPendingRuns).mockResolvedValueOnce([
+      { ...pendingRun, durable_run_id: "dr_9" },
+    ] as never);
+    vi.mocked(store.getAutomationsByIds).mockResolvedValueOnce([
+      { id: "auto_1", user_id: "user-1" },
+    ] as never);
+    const detail = {
+      retrying: [],
+      waiting: true,
+      callbacks: [{ name: "approve", status: "waiting", callbackToken: "cb_1" }],
+    };
+    vi.mocked(getDurableRunStatus).mockResolvedValueOnce({
+      status: "started",
+      output: null,
+      error: null,
+      detail,
+    } as never);
+
+    const res = await reconcilePendingRuns();
+    expect(res).toEqual({ checked: 1, updated: 0 });
+    expect(store.updateRun).toHaveBeenCalledWith(
+      "run_1",
+      expect.objectContaining({ status: "waiting", error: detail }),
+    );
+  });
+
+  it("returns a recovered run to 'started' and clears the retry detail (foreman-jc12)", async () => {
+    vi.mocked(store.listPendingRuns).mockResolvedValueOnce([
+      {
+        ...pendingRun,
+        durable_run_id: "dr_9",
+        status: "retrying",
+        error: { totalAttempts: 1, retrying: [{ name: "s" }] },
+      },
+    ] as never);
+    vi.mocked(store.getAutomationsByIds).mockResolvedValueOnce([
+      { id: "auto_1", user_id: "user-1" },
+    ] as never);
+    vi.mocked(getDurableRunStatus).mockResolvedValueOnce({
+      status: "started",
+      output: null,
+      error: null,
+      detail: null,
+    } as never);
+
+    await reconcilePendingRuns();
+    expect(store.updateRun).toHaveBeenCalledWith(
+      "run_1",
+      expect.objectContaining({ status: "started", error: null }),
+    );
+  });
+
+  it("leaves a still-running durable as 'started' (no terminal write)", async () => {
+    vi.mocked(store.listPendingRuns).mockResolvedValueOnce([
+      { ...pendingRun, durable_run_id: "dr_9" },
+    ] as never);
+    vi.mocked(store.getAutomationsByIds).mockResolvedValueOnce([
+      { id: "auto_1", user_id: "user-1" },
+    ] as never);
+    vi.mocked(getDurableRunStatus).mockResolvedValueOnce({
+      status: "started",
+      output: null,
+      error: null,
+    } as never);
+
+    const res = await reconcilePendingRuns();
+    expect(res).toEqual({ checked: 1, updated: 0 });
+    // already 'started' with the same durable id → nothing to write
+    expect(store.updateRun).not.toHaveBeenCalled();
+    // and it must NOT need getTriggerRun once the durable id is known
+    expect(getTriggerRunStatus).not.toHaveBeenCalled();
+  });
+
+  it("skips a run whose durable isn't linked yet", async () => {
+    vi.mocked(store.listPendingRuns).mockResolvedValueOnce([pendingRun] as never);
+    vi.mocked(store.getAutomationsByIds).mockResolvedValueOnce([
+      { id: "auto_1", user_id: "user-1" },
+    ] as never);
+    vi.mocked(getTriggerRunStatus).mockResolvedValueOnce({
+      status: "started",
+      durableRunId: null,
+      output: null,
+      error: null,
+    } as never);
+
+    const res = await reconcilePendingRuns();
+    expect(res).toEqual({ checked: 1, updated: 0 });
+    expect(getDurableRunStatus).not.toHaveBeenCalled();
+    expect(store.updateRun).not.toHaveBeenCalled();
+  });
+
+  it("fails a run whose durable never linked past the stuck timeout", async () => {
+    vi.mocked(store.listPendingRuns).mockResolvedValueOnce([
+      { ...pendingRun, created_at: OLD },
+    ] as never);
+    vi.mocked(store.getAutomationsByIds).mockResolvedValueOnce(auto as never);
+    vi.mocked(getTriggerRunStatus).mockResolvedValueOnce({
+      status: "started",
+      durableRunId: null,
+      output: null,
+      error: null,
+    } as never);
+
+    const res = await reconcilePendingRuns();
+    expect(res).toEqual({ checked: 1, updated: 1 });
+    expect(store.updateRun).toHaveBeenCalledWith(
+      "run_1",
+      expect.objectContaining({ status: "failed" }),
+    );
+  });
+
+  it("fails an old claimed-but-never-dispatched run (no trigger_id)", async () => {
+    vi.mocked(store.listPendingRuns).mockResolvedValueOnce([
+      {
+        id: "run_x",
+        automation_id: "auto_1",
+        trigger_id: null,
+        durable_run_id: null,
+        status: "initialized",
+        created_at: OLD,
+      },
+    ] as never);
+    vi.mocked(store.getAutomationsByIds).mockResolvedValueOnce(auto as never);
+
+    const res = await reconcilePendingRuns();
+    expect(res).toEqual({ checked: 1, updated: 1 });
+    expect(store.updateRun).toHaveBeenCalledWith(
+      "run_x",
+      expect.objectContaining({ status: "failed" }),
+    );
+    // never even resolved an SDK for an undispatched run
+    expect(getTriggerRunStatus).not.toHaveBeenCalled();
+  });
+
+  it("does NOT fail a fresh unlinked run (within the timeout)", async () => {
+    vi.mocked(store.listPendingRuns).mockResolvedValueOnce([
+      { ...pendingRun, created_at: NOW },
+    ] as never);
+    vi.mocked(store.getAutomationsByIds).mockResolvedValueOnce(auto as never);
+    vi.mocked(getTriggerRunStatus).mockResolvedValueOnce({
+      status: "started",
+      durableRunId: null,
+      output: null,
+      error: null,
+    } as never);
+
+    const res = await reconcilePendingRuns();
+    expect(res).toEqual({ checked: 1, updated: 0 });
+    expect(store.updateRun).not.toHaveBeenCalled();
+  });
+});
diff --git a/packages/agents/tests/unit/background-config.test.ts b/packages/agents/tests/unit/background-config.test.ts
index dc652448..97dfc371 100644
--- a/packages/agents/tests/unit/background-config.test.ts
+++ b/packages/agents/tests/unit/background-config.test.ts
@@ -1,29 +1,28 @@
 /**
- * Unit tests for backgroundIfEnabled (foreman-7am4) — the env gate that opts a
- * tool into Mastra background execution. Off unless FOREMAN_BACKGROUND_TOOLS=1.
+ * Unit test for the agent-level background opt-in (foreman-7am4). Read-only tools
+ * (Zapier reads + search_history) run as Mastra background tasks; writes are
+ * excluded. There is no env gate.
  */
-import { afterEach, describe, expect, it } from "vitest";
-import { backgroundIfEnabled } from "@/lib/background";
+import { describe, expect, it } from "vitest";
+import { backgroundToolsConfig } from "@/lib/background";
+import { READ_ONLY_TOOL_IDS } from "@/lib/zapier-sdk-tools";
 
-const orig = process.env.FOREMAN_BACKGROUND_TOOLS;
-afterEach(() => {
-  if (orig === undefined) delete process.env.FOREMAN_BACKGROUND_TOOLS;
-  else process.env.FOREMAN_BACKGROUND_TOOLS = orig;
-});
-
-describe("backgroundIfEnabled", () => {
-  it("returns a background config when the flag is set to '1'", () => {
-    process.env.FOREMAN_BACKGROUND_TOOLS = "1";
-    expect(backgroundIfEnabled()).toEqual({ background: { enabled: true } });
-  });
-
-  it("is off by default — returns an empty slice", () => {
-    delete process.env.FOREMAN_BACKGROUND_TOOLS;
-    expect(backgroundIfEnabled()).toEqual({});
+describe("backgroundToolsConfig", () => {
+  it("opts in every read-only Zapier tool + search_history, with a wait-timeout", () => {
+    const cfg = backgroundToolsConfig();
+    expect(cfg.waitTimeoutMs).toBe(30_000);
+    // search_history (custom read) is opted in.
+    expect(cfg.tools.search_history).toEqual({ enabled: true });
+    // Every read-only Zapier tool id is opted in.
+    for (const id of READ_ONLY_TOOL_IDS) {
+      expect(cfg.tools[id]).toEqual({ enabled: true });
+    }
+    expect(READ_ONLY_TOOL_IDS.length).toBeGreaterThan(0);
   });
 
-  it("treats any value other than '1' as off", () => {
-    process.env.FOREMAN_BACKGROUND_TOOLS = "true";
-    expect(backgroundIfEnabled()).toEqual({});
+  it("excludes write/destructive tools (run-action, create-table-records)", () => {
+    const cfg = backgroundToolsConfig();
+    expect(cfg.tools["run-action"]).toBeUndefined();
+    expect(cfg.tools["create-table-records"]).toBeUndefined();
   });
 });
diff --git a/packages/agents/tests/unit/channel-trigger.test.ts b/packages/agents/tests/unit/channel-trigger.test.ts
deleted file mode 100644
index ab2c7646..00000000
--- a/packages/agents/tests/unit/channel-trigger.test.ts
+++ /dev/null
@@ -1,228 +0,0 @@
-/**
- * Unit tests for matchAndFireChannelTriggers / ChannelTriggerSignalProvider —
- * matching, dedup (foreman-tv5p), and the notify() wiring.
- */
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-type Result<T> = { data: T; error: { message: string } | null };
-let triggerListResult: Result<unknown[]> = { data: [], error: null };
-let workflowSelectResult: Result<unknown> = { data: null, error: null };
-const updates: { table: string; payload: any }[] = [];
-
-function createChain(table: string) {
-  const builder: any = {};
-  for (const m of ["select", "eq", "limit", "update"]) {
-    builder[m] = vi.fn().mockReturnValue(builder);
-  }
-  builder.maybeSingle = vi.fn().mockImplementation(() => Promise.resolve(workflowSelectResult));
-  // biome-ignore lint/suspicious/noThenProperty: thenable mock
-  builder.then = (resolve: any) => {
-    if (builder._verb === "update") return resolve({ data: null, error: null });
-    if (table === "workflow_trigger") return resolve(triggerListResult);
-    return resolve({ data: null, error: null });
-  };
-  const origUpdate = builder.update;
-  builder.update = vi.fn((payload: any) => {
-    builder._verb = "update";
-    updates.push({ table, payload });
-    return origUpdate(payload);
-  });
-  return builder;
-}
-
-const mockSupabase = { from: vi.fn((t: string) => createChain(t)) };
-
-vi.mock("@/lib/db", () => ({ getSupabase: () => mockSupabase }));
-
-const mockExecuteWorkflow = vi.fn();
-vi.mock("@/lib/workflows/engine", () => ({
-  executeWorkflow: (...args: unknown[]) => mockExecuteWorkflow(...args),
-}));
-
-async function* gen(events: unknown[]): AsyncGenerator<any> {
-  for (const e of events) yield e;
-}
-
-const channelRow = (over: Record<string, unknown> = {}) => ({
-  id: "t-1",
-  workflow_id: "wf-1",
-  config: JSON.stringify({ channel: "slack", match: { command: "!standup" } }),
-  last_dedupe_key: null,
-  ...over,
-});
-
-const lastTriggerUpdate = () =>
-  [...updates].reverse().find((u) => u.table === "workflow_trigger")?.payload;
-
-describe("matchAndFireChannelTriggers", () => {
-  beforeEach(() => {
-    vi.resetAllMocks();
-    triggerListResult = { data: [], error: null };
-    workflowSelectResult = { data: { user_id: "user-1" }, error: null };
-    updates.length = 0;
-    mockExecuteWorkflow.mockReturnValue(gen([{ type: "complete" }]));
-  });
-
-  it("fires when channel + command match", async () => {
-    triggerListResult = { data: [channelRow()], error: null };
-
-    const { matchAndFireChannelTriggers } = await import("@/workflows/channel-trigger");
-    const fired = await matchAndFireChannelTriggers({
-      channel: "slack",
-      text: "!standup",
-      from: "U123",
-    });
-    expect(fired).toBe(1);
-  });
-
-  it("tolerates leading slashes and whitespace in command match", async () => {
-    triggerListResult = { data: [channelRow()], error: null };
-
-    const { matchAndFireChannelTriggers } = await import("@/workflows/channel-trigger");
-    const fired = await matchAndFireChannelTriggers({
-      channel: "slack",
-      text: "  /standup  ",
-      from: "U123",
-    });
-    expect(fired).toBe(1);
-  });
-
-  it("skips when channel differs", async () => {
-    triggerListResult = { data: [channelRow()], error: null };
-
-    const { matchAndFireChannelTriggers } = await import("@/workflows/channel-trigger");
-    const fired = await matchAndFireChannelTriggers({
-      channel: "discord",
-      text: "!standup",
-      from: "U123",
-    });
-    expect(fired).toBe(0);
-  });
-
-  it("skips when from regex doesn't match", async () => {
-    triggerListResult = {
-      data: [
-        channelRow({
-          config: JSON.stringify({
-            channel: "slack",
-            match: { command: "!standup", from: "^U999" },
-          }),
-        }),
-      ],
-      error: null,
-    };
-
-    const { matchAndFireChannelTriggers } = await import("@/workflows/channel-trigger");
-    const fired = await matchAndFireChannelTriggers({
-      channel: "slack",
-      text: "!standup",
-      from: "U123",
-    });
-    expect(fired).toBe(0);
-  });
-
-  it("skips when room differs", async () => {
-    triggerListResult = {
-      data: [
-        channelRow({
-          config: JSON.stringify({
-            channel: "slack",
-            match: { command: "!standup", room: "#ops" },
-          }),
-        }),
-      ],
-      error: null,
-    };
-
-    const { matchAndFireChannelTriggers } = await import("@/workflows/channel-trigger");
-    const fired = await matchAndFireChannelTriggers({
-      channel: "slack",
-      text: "!standup",
-      from: "U123",
-      room: "#random",
-    });
-    expect(fired).toBe(0);
-  });
-
-  it("skips when workflow has been deleted", async () => {
-    triggerListResult = { data: [channelRow({ workflow_id: "wf-deleted" })], error: null };
-    workflowSelectResult = { data: null, error: null };
-
-    const { matchAndFireChannelTriggers } = await import("@/workflows/channel-trigger");
-    const fired = await matchAndFireChannelTriggers({
-      channel: "slack",
-      text: "!standup",
-      from: "U123",
-    });
-    expect(fired).toBe(0);
-  });
-
-  // ─── Dedup (foreman-tv5p) ───────────────────────────────────────────────────
-
-  it("skips a retried delivery whose dedupeKey already fired the trigger", async () => {
-    triggerListResult = { data: [channelRow({ last_dedupe_key: "msg-42" })], error: null };
-
-    const { matchAndFireChannelTriggers } = await import("@/workflows/channel-trigger");
-    const fired = await matchAndFireChannelTriggers({
-      channel: "slack",
-      text: "!standup",
-      from: "U123",
-      dedupeKey: "msg-42",
-    });
-    expect(fired).toBe(0);
-    expect(mockExecuteWorkflow).not.toHaveBeenCalled();
-  });
-
-  it("fires a new delivery and records its dedupeKey", async () => {
-    triggerListResult = { data: [channelRow({ last_dedupe_key: "msg-old" })], error: null };
-
-    const { matchAndFireChannelTriggers } = await import("@/workflows/channel-trigger");
-    const fired = await matchAndFireChannelTriggers({
-      channel: "slack",
-      text: "!standup",
-      from: "U123",
-      dedupeKey: "msg-new",
-    });
-    expect(fired).toBe(1);
-    expect(lastTriggerUpdate()?.last_dedupe_key).toBe("msg-new");
-  });
-
-  it("derives a content-hash dedupeKey when none is supplied (records it)", async () => {
-    triggerListResult = { data: [channelRow()], error: null };
-
-    const { matchAndFireChannelTriggers } = await import("@/workflows/channel-trigger");
-    const fired = await matchAndFireChannelTriggers({
-      channel: "slack",
-      text: "!standup",
-      from: "U123",
-    });
-    expect(fired).toBe(1);
-    // a real (40-char sha1 hex) key was persisted, not undefined
-    expect(lastTriggerUpdate()?.last_dedupe_key).toMatch(/^[0-9a-f]{40}$/);
-  });
-
-  it("notify()s the owner's thread with the native dedupeKey on a fresh fire", async () => {
-    triggerListResult = { data: [channelRow()], error: null };
-
-    const { ChannelTriggerSignalProvider } = await import(
-      "@/mastra/signals/channel-trigger-provider"
-    );
-    const provider = new ChannelTriggerSignalProvider();
-    const sendNotificationSignal = vi.fn().mockResolvedValue(undefined);
-    provider.connect({ sendNotificationSignal } as any);
-
-    const fired = await provider.handleMessage({
-      channel: "slack",
-      text: "!standup",
-      from: "U123",
-      room: "#ops",
-      dedupeKey: "msg-7",
-    });
-
-    expect(fired).toBe(1);
-    expect(sendNotificationSignal).toHaveBeenCalledTimes(1);
-    const [notification, target] = sendNotificationSignal.mock.calls[0];
-    expect(notification).toMatchObject({ source: "channel-trigger", dedupeKey: "msg-7" });
-    expect(target).toMatchObject({ threadId: "channel:slack:#ops", resourceId: "user-1" });
-  });
-});
diff --git a/packages/agents/tests/unit/connect-zapier.test.ts b/packages/agents/tests/unit/connect-zapier.test.ts
new file mode 100644
index 00000000..dd64a27b
--- /dev/null
+++ b/packages/agents/tests/unit/connect-zapier.test.ts
@@ -0,0 +1,93 @@
+/**
+ * Unit tests for the connect_zapier tool.
+ *
+ * Verifies the foreman-mcwn enhancement: when a connected user is in context,
+ * the tool mints the SDK's signed, account-bound connection-start URL
+ * (getConnectionStartUrl). It falls back to the generic engine deep-link when
+ * there's no userId, the user isn't connected, or the SDK errors.
+ */
+import { RequestContext } from "@mastra/core/request-context";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+// ─── Mocks ───────────────────────────────────────────────────────────────────
+
+// App search runs on the default (account-agnostic) SDK.
+const mockListApps = vi.fn();
+vi.mock("@zapier/zapier-sdk", () => ({
+  createZapierSdk: () => ({ listApps: mockListApps }),
+}));
+
+// Per-user SDK for the signed connect URL.
+const mockGetConnectionStartUrl = vi.fn();
+const mockGetSdkForUser = vi.fn();
+vi.mock("@/lib/zapier/sdk", () => ({
+  getSdkForUser: (...args: unknown[]) => mockGetSdkForUser(...args),
+}));
+
+import { connectZapierTool } from "@/mastra/tools/connect-zapier";
+
+const GMAIL = {
+  key: "gmail",
+  slug: "gmail",
+  title: "Gmail",
+  implementation_id: "GoogleMailV2CLIAPI@2.8.3",
+};
+
+function ctx({ userId }: { userId?: string } = {}) {
+  const entries: [string, string][] = [];
+  if (userId) entries.push(["userId", userId]);
+  return { requestContext: new RequestContext(entries) } as any;
+}
+
+const run = (input: { appSlug?: string }, c = ctx()) => connectZapierTool.execute!(input as any, c);
+
+beforeEach(() => {
+  vi.resetAllMocks();
+  mockListApps.mockResolvedValue({ data: [GMAIL] });
+  mockGetSdkForUser.mockResolvedValue({ getConnectionStartUrl: mockGetConnectionStartUrl });
+});
+
+describe("connect_zapier tool", () => {
+  it("mints the signed, account-bound URL for a connected user", async () => {
+    mockGetConnectionStartUrl.mockResolvedValue({
+      data: { url: "https://zapier.com/sdk/connect?a=1&sig=abc", expiresAt: 123, app: "Gmail" },
+    });
+
+    const out: any = await run({ appSlug: "gmail" }, ctx({ userId: "u1" }));
+
+    expect(mockGetSdkForUser).toHaveBeenCalledWith("u1");
+    expect(mockGetConnectionStartUrl).toHaveBeenCalledWith({ app: "gmail" });
+    expect(out.connectUrl).toBe("https://zapier.com/sdk/connect?a=1&sig=abc");
+    expect(out.appName).toBe("Gmail");
+    expect(out.expiresAt).toBe(123);
+  });
+
+  it("falls back to the engine deep-link when the user isn't connected", async () => {
+    mockGetSdkForUser.mockRejectedValue(new Error("ZapierNotConnected"));
+
+    const out: any = await run({ appSlug: "gmail" }, ctx({ userId: "u1" }));
+
+    expect(out.connectUrl).toBe(`https://zapier.com/engine/auth/start/${GMAIL.implementation_id}/`);
+    expect(mockGetConnectionStartUrl).not.toHaveBeenCalled();
+  });
+
+  it("falls back to the engine deep-link when there is no userId in context", async () => {
+    const out: any = await run({ appSlug: "gmail" }, ctx());
+
+    expect(mockGetSdkForUser).not.toHaveBeenCalled();
+    expect(out.connectUrl).toBe(`https://zapier.com/engine/auth/start/${GMAIL.implementation_id}/`);
+  });
+
+  it("returns the generic connections page when no appSlug is given", async () => {
+    const out: any = await run({});
+    expect(out.connectUrl).toBe("https://zapier.com/app/connections");
+  });
+
+  it("returns the connections page when the app is not an exact match", async () => {
+    mockListApps.mockResolvedValue({ data: [{ key: "notion", slug: "notion", title: "Notion" }] });
+
+    const out: any = await run({ appSlug: "gmail" }, ctx({ userId: "u1" }));
+
+    expect(out.connectUrl).toBe("https://zapier.com/app/connections");
+  });
+});
diff --git a/packages/agents/tests/unit/context-injector.test.ts b/packages/agents/tests/unit/context-injector.test.ts
index 72f6f04c..5755ca5e 100644
--- a/packages/agents/tests/unit/context-injector.test.ts
+++ b/packages/agents/tests/unit/context-injector.test.ts
@@ -14,11 +14,31 @@ vi.mock("@/lib/catalog", () => ({
   searchAppCatalog: vi.fn().mockResolvedValue([]),
 }));
 
+import type { ProcessInputResultWithSystemMessages } from "@mastra/core/processors";
 import { contextInjector } from "@/lib/processors/input";
 import { listUserConnections } from "@/lib/zapier";
 
 const mockedListUserConnections = vi.mocked(listUserConnections);
 
+// The element type of what listUserConnections resolves to — a Zapier SDK
+// connection row. The catalog of required fields (date, is_invite_only,
+// is_private, shared_with_all, id, account_id) comes straight from the SDK
+// schema; app_name is NOT a field (the processor reads app_key, falling back
+// from the optional app_name it tolerates structurally).
+type Connection = Awaited<ReturnType<typeof listUserConnections>>[number];
+
+function connection(overrides: Partial<Connection> = {}): Connection {
+  return {
+    date: "2026-01-01T00:00:00Z",
+    is_invite_only: false,
+    is_private: false,
+    shared_with_all: false,
+    id: "conn-1",
+    account_id: "acct-1",
+    ...overrides,
+  };
+}
+
 describe("contextInjector", () => {
   beforeEach(() => {
     vi.clearAllMocks();
@@ -34,11 +54,11 @@ describe("contextInjector", () => {
     const systemMessages = [{ role: "system" as const, content: "base" }];
     const requestContext = new Map();
 
-    const result = await contextInjector.processInput!({
+    const result = (await contextInjector.processInput!({
       messages,
       systemMessages,
       requestContext,
-    } as any);
+    } as any)) as ProcessInputResultWithSystemMessages;
 
     expect(result.messages).toEqual(messages);
     expect(result.systemMessages).toEqual(systemMessages);
@@ -51,29 +71,29 @@ describe("contextInjector", () => {
     const systemMessages = [{ role: "system" as const, content: "base" }];
     const requestContext = new Map([["userId", "user-1"]]);
 
-    const result = await contextInjector.processInput!({
+    const result = (await contextInjector.processInput!({
       messages,
       systemMessages,
       requestContext,
-    } as any);
+    } as any)) as ProcessInputResultWithSystemMessages;
 
     expect(result.systemMessages).toEqual(systemMessages);
   });
 
   it("injects context system message when connections exist", async () => {
     mockedListUserConnections.mockResolvedValue([
-      { app_name: "Gmail", app_key: "gmail" },
-      { app_name: "Slack", app_key: "slack" },
+      connection({ app_key: "Gmail" }),
+      connection({ app_key: "Slack" }),
     ]);
     const messages = [{ role: "user" as const, content: "hello" }];
     const systemMessages = [{ role: "system" as const, content: "base" }];
     const requestContext = new Map([["userId", "user-1"]]);
 
-    const result = await contextInjector.processInput!({
+    const result = (await contextInjector.processInput!({
       messages,
       systemMessages,
       requestContext,
-    } as any);
+    } as any)) as ProcessInputResultWithSystemMessages;
 
     expect(result.systemMessages).toHaveLength(2);
     const injected = result.systemMessages[1];
@@ -83,14 +103,14 @@ describe("contextInjector", () => {
   });
 
   it("uses app_key as fallback when app_name is missing", async () => {
-    mockedListUserConnections.mockResolvedValue([{ app_key: "custom_app" }]);
+    mockedListUserConnections.mockResolvedValue([connection({ app_key: "custom_app" })]);
     const requestContext = new Map([["userId", "user-1"]]);
 
-    const result = await contextInjector.processInput!({
+    const result = (await contextInjector.processInput!({
       messages: [],
       systemMessages: [],
       requestContext,
-    } as any);
+    } as any)) as ProcessInputResultWithSystemMessages;
 
     expect(result.systemMessages).toHaveLength(1);
     expect(result.systemMessages[0].content).toContain("custom_app");
@@ -102,11 +122,11 @@ describe("contextInjector", () => {
     const systemMessages = [{ role: "system" as const, content: "base" }];
     const requestContext = new Map([["userId", "user-1"]]);
 
-    const result = await contextInjector.processInput!({
+    const result = (await contextInjector.processInput!({
       messages,
       systemMessages,
       requestContext,
-    } as any);
+    } as any)) as ProcessInputResultWithSystemMessages;
 
     // Should return original messages, not throw
     expect(result.messages).toEqual(messages);
diff --git a/packages/agents/tests/unit/cron-driver.test.ts b/packages/agents/tests/unit/cron-driver.test.ts
deleted file mode 100644
index e07f3d20..00000000
--- a/packages/agents/tests/unit/cron-driver.test.ts
+++ /dev/null
@@ -1,207 +0,0 @@
-/**
- * Unit tests for the cron driver — schedule matcher + tick dispatch.
- */
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-// ─── Supabase + engine mocks ─────────────────────────────────────────────────
-
-type Result<T> = { data: T; error: { message: string } | null };
-let triggerListResult: Result<unknown[]> = { data: [], error: null };
-let workflowSelectResult: Result<unknown> = { data: null, error: null };
-// Result of the atomic same-minute claim (`update ... .select("id")`). A
-// non-empty array means the claim succeeded; empty means another tick already
-// fired this minute.
-let claimResult: Result<unknown[]> = { data: [{ id: "trig-1" }], error: null };
-const updates: any[] = [];
-
-function createChain(table: string) {
-  const builder: any = {};
-  for (const m of ["select", "eq", "limit", "update", "or"]) {
-    builder[m] = vi.fn().mockReturnValue(builder);
-  }
-  builder.maybeSingle = vi.fn().mockImplementation(() => Promise.resolve(workflowSelectResult));
-  // biome-ignore lint/suspicious/noThenProperty: thenable mock
-  builder.then = (resolve: any) => {
-    if (builder._verb === "update") return resolve(claimResult);
-    if (table === "workflow_trigger") return resolve(triggerListResult);
-    return resolve({ data: null, error: null });
-  };
-  const origUpdate = builder.update;
-  builder.update = vi.fn((payload: any) => {
-    builder._verb = "update";
-    updates.push({ table, payload });
-    return origUpdate(payload);
-  });
-  return builder;
-}
-
-const mockSupabase = { from: vi.fn((t: string) => createChain(t)) };
-
-vi.mock("@/lib/db", () => ({
-  getSupabase: () => mockSupabase,
-}));
-
-const mockExecuteWorkflow = vi.fn();
-vi.mock("@/lib/workflows/engine", () => ({
-  executeWorkflow: (...args: unknown[]) => mockExecuteWorkflow(...args),
-}));
-
-async function* gen(events: unknown[]): AsyncGenerator<any> {
-  for (const e of events) yield e;
-}
-
-// ─── Tests ───────────────────────────────────────────────────────────────────
-
-describe("cronMatches", () => {
-  it("matches *  *  *  *  * (every minute)", async () => {
-    const { cronMatches } = await import("@/workflows/cron-driver");
-    expect(cronMatches("* * * * *", new Date("2026-05-10T12:34:00Z"))).toBe(true);
-  });
-
-  it("matches an exact minute and hour", async () => {
-    const { cronMatches } = await import("@/workflows/cron-driver");
-    expect(cronMatches("30 14 * * *", new Date("2026-05-10T14:30:00Z"))).toBe(true);
-    expect(cronMatches("30 14 * * *", new Date("2026-05-10T14:31:00Z"))).toBe(false);
-  });
-
-  it("matches weekday range (Mon-Fri at 09:00)", async () => {
-    const { cronMatches } = await import("@/workflows/cron-driver");
-    // 2026-05-11 is a Monday
-    expect(cronMatches("0 9 * * 1-5", new Date("2026-05-11T09:00:00Z"))).toBe(true);
-    // 2026-05-09 is a Saturday
-    expect(cronMatches("0 9 * * 1-5", new Date("2026-05-09T09:00:00Z"))).toBe(false);
-  });
-
-  it("matches step values (every 15 min)", async () => {
-    const { cronMatches } = await import("@/workflows/cron-driver");
-    expect(cronMatches("*/15 * * * *", new Date("2026-05-10T12:00:00Z"))).toBe(true);
-    expect(cronMatches("*/15 * * * *", new Date("2026-05-10T12:15:00Z"))).toBe(true);
-    expect(cronMatches("*/15 * * * *", new Date("2026-05-10T12:07:00Z"))).toBe(false);
-  });
-
-  it("matches comma list", async () => {
-    const { cronMatches } = await import("@/workflows/cron-driver");
-    expect(cronMatches("0,30 9 * * *", new Date("2026-05-10T09:00:00Z"))).toBe(true);
-    expect(cronMatches("0,30 9 * * *", new Date("2026-05-10T09:30:00Z"))).toBe(true);
-    expect(cronMatches("0,30 9 * * *", new Date("2026-05-10T09:15:00Z"))).toBe(false);
-  });
-
-  it("respects timezone (LA 9am ≠ UTC 9am)", async () => {
-    const { cronMatches } = await import("@/workflows/cron-driver");
-    // 2026-05-12 16:00 UTC == 09:00 PDT
-    expect(cronMatches("0 9 * * *", new Date("2026-05-12T16:00:00Z"), "America/Los_Angeles")).toBe(
-      true,
-    );
-    expect(cronMatches("0 9 * * *", new Date("2026-05-12T09:00:00Z"), "America/Los_Angeles")).toBe(
-      false,
-    );
-  });
-
-  it("normalizes dow=7 to Sunday", async () => {
-    const { cronMatches } = await import("@/workflows/cron-driver");
-    // 2026-05-10 is a Sunday
-    expect(cronMatches("0 12 * * 7", new Date("2026-05-10T12:00:00Z"))).toBe(true);
-    expect(cronMatches("0 12 * * 0", new Date("2026-05-10T12:00:00Z"))).toBe(true);
-  });
-
-  it("rejects malformed expressions", async () => {
-    const { cronMatches } = await import("@/workflows/cron-driver");
-    expect(() => cronMatches("0 9 * *", new Date())).toThrow(/5 fields/);
-  });
-});
-
-describe("tickCron", () => {
-  beforeEach(() => {
-    vi.resetAllMocks();
-    triggerListResult = { data: [], error: null };
-    workflowSelectResult = { data: null, error: null };
-    claimResult = { data: [{ id: "trig-1" }], error: null };
-    updates.length = 0;
-    mockExecuteWorkflow.mockReset();
-  });
-
-  it("fires a matching cron and updates last_fired_at", async () => {
-    triggerListResult = {
-      data: [
-        {
-          id: "trig-1",
-          workflow_id: "wf-1",
-          config: JSON.stringify({ schedule: "* * * * *" }),
-          last_fired_at: null,
-        },
-      ],
-      error: null,
-    };
-    workflowSelectResult = { data: { user_id: "user-1" }, error: null };
-    mockExecuteWorkflow.mockReturnValue(gen([{ type: "complete", runId: "run-1" }]));
-
-    const { tickCron } = await import("@/workflows/cron-driver");
-    const out = await tickCron(new Date("2026-05-10T12:00:30Z"));
-
-    expect(out.fired).toBe(1);
-    // wait a microtask for the void runOne to start
-    await new Promise((r) => setTimeout(r, 10));
-    expect(updates.find((u) => u.table === "workflow_trigger")).toBeTruthy();
-  });
-
-  it("does not double-fire when the atomic claim is lost (same-minute restart)", async () => {
-    triggerListResult = {
-      data: [
-        {
-          id: "trig-1",
-          workflow_id: "wf-1",
-          config: JSON.stringify({ schedule: "* * * * *" }),
-          last_fired_at: "2026-05-10T12:00:00.000Z",
-        },
-      ],
-      error: null,
-    };
-    workflowSelectResult = { data: { user_id: "user-1" }, error: null };
-    // The conditional UPDATE matches no row — another tick already claimed this
-    // minute. The driver must NOT fire.
-    claimResult = { data: [], error: null };
-    mockExecuteWorkflow.mockReturnValue(gen([{ type: "complete" }]));
-
-    const { tickCron } = await import("@/workflows/cron-driver");
-    const out = await tickCron(new Date("2026-05-10T12:00:30Z"));
-    expect(out.fired).toBe(0);
-    expect(mockExecuteWorkflow).not.toHaveBeenCalled();
-  });
-
-  it("skips a non-matching schedule", async () => {
-    triggerListResult = {
-      data: [
-        {
-          id: "trig-1",
-          workflow_id: "wf-1",
-          config: JSON.stringify({ schedule: "0 9 * * *" }),
-          last_fired_at: null,
-        },
-      ],
-      error: null,
-    };
-
-    const { tickCron } = await import("@/workflows/cron-driver");
-    const out = await tickCron(new Date("2026-05-10T12:00:00Z"));
-    expect(out.fired).toBe(0);
-  });
-
-  it("skips a trigger whose workflow is missing", async () => {
-    triggerListResult = {
-      data: [
-        {
-          id: "trig-1",
-          workflow_id: "wf-deleted",
-          config: JSON.stringify({ schedule: "* * * * *" }),
-          last_fired_at: null,
-        },
-      ],
-      error: null,
-    };
-    workflowSelectResult = { data: null, error: null };
-
-    const { tickCron } = await import("@/workflows/cron-driver");
-    const out = await tickCron(new Date("2026-05-10T12:00:00Z"));
-    expect(out.fired).toBe(0);
-  });
-});
diff --git a/packages/agents/tests/unit/dashboards-prune.test.ts b/packages/agents/tests/unit/dashboards-prune.test.ts
new file mode 100644
index 00000000..c0f19f2a
--- /dev/null
+++ b/packages/agents/tests/unit/dashboards-prune.test.ts
@@ -0,0 +1,95 @@
+/**
+ * Unit tests for snapshot retention (pruneSnapshots). No network: getSupabase is
+ * mocked. We assert the fast path, that rows beyond `keepLast` are deleted, and
+ * that artifact-referenced snapshots are never deleted (dashboards read records
+ * by snapshot_id).
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+let appSnapshotRows: any = null; // app_data_snapshot select result
+let artifactReferenced: any = null; // artifact .in(snapshot_id) select result
+let deleteError: { message: string } | null = null;
+const deletedIds: string[] = [];
+
+function createChain(table: string) {
+  const b: any = { _deleting: false };
+  for (const m of ["select", "eq", "order", "limit", "gte"]) {
+    b[m] = vi.fn(() => b);
+  }
+  b.delete = vi.fn(() => {
+    b._deleting = true;
+    return b;
+  });
+  b.in = vi.fn((_col: string, ids: string[]) => {
+    if (b._deleting) deletedIds.push(...ids);
+    return b;
+  });
+  // biome-ignore lint/suspicious/noThenProperty: thenable mock
+  b.then = (resolve: any) => {
+    if (b._deleting) return resolve({ data: null, error: deleteError });
+    if (table === "artifact") return resolve({ data: artifactReferenced, error: null });
+    return resolve({ data: appSnapshotRows, error: null }); // app_data_snapshot select
+  };
+  return b;
+}
+
+const mockSupabase = { from: vi.fn((t: string) => createChain(t)) };
+vi.mock("@/lib/db", () => ({ getSupabase: () => mockSupabase }));
+
+beforeEach(() => {
+  appSnapshotRows = null;
+  artifactReferenced = null;
+  deleteError = null;
+  deletedIds.length = 0;
+});
+
+afterEach(() => {
+  vi.clearAllMocks();
+});
+
+describe("pruneSnapshots", () => {
+  it("does nothing when row count is within keepLast (fast path)", async () => {
+    appSnapshotRows = [{ id: "1" }, { id: "2" }];
+    const { pruneSnapshots } = await import("@/lib/dashboards/snapshot");
+
+    const deleted = await pruneSnapshots("user-1", "hubspot", { keepLast: 5 });
+
+    expect(deleted).toBe(0);
+    expect(deletedIds).toEqual([]);
+  });
+
+  it("deletes rows beyond the newest keepLast", async () => {
+    // newest-first
+    appSnapshotRows = [{ id: "a" }, { id: "b" }, { id: "c" }, { id: "d" }, { id: "e" }];
+    artifactReferenced = []; // nothing pinned
+    const { pruneSnapshots } = await import("@/lib/dashboards/snapshot");
+
+    const deleted = await pruneSnapshots("user-1", "hubspot", { keepLast: 2 });
+
+    expect(deleted).toBe(3);
+    expect(deletedIds).toEqual(["c", "d", "e"]);
+  });
+
+  it("never deletes a snapshot a dashboard artifact is pinned to", async () => {
+    appSnapshotRows = [{ id: "a" }, { id: "b" }, { id: "c" }, { id: "d" }, { id: "e" }];
+    artifactReferenced = [{ snapshot_id: "d" }]; // artifact pins "d"
+    const { pruneSnapshots } = await import("@/lib/dashboards/snapshot");
+
+    const deleted = await pruneSnapshots("user-1", "hubspot", { keepLast: 2 });
+
+    expect(deleted).toBe(2);
+    expect(deletedIds).toEqual(["c", "e"]);
+    expect(deletedIds).not.toContain("d");
+  });
+
+  it("throws when the delete returns an error", async () => {
+    appSnapshotRows = [{ id: "a" }, { id: "b" }, { id: "c" }];
+    artifactReferenced = [];
+    deleteError = { message: "boom" };
+    const { pruneSnapshots } = await import("@/lib/dashboards/snapshot");
+
+    await expect(pruneSnapshots("user-1", "hubspot", { keepLast: 1 })).rejects.toThrow(
+      /pruneSnapshots failed: boom/,
+    );
+  });
+});
diff --git a/packages/agents/tests/unit/dashboards-share.test.ts b/packages/agents/tests/unit/dashboards-share.test.ts
new file mode 100644
index 00000000..9f978417
--- /dev/null
+++ b/packages/agents/tests/unit/dashboards-share.test.ts
@@ -0,0 +1,178 @@
+/**
+ * Unit tests for the dashboards share lib (Phase 3). No network: getSupabase is
+ * mocked per-table. We assert ownership-gating on create, the inserted token
+ * row, expiry handling on read, and owner-scoped revoke.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+// ─── Supabase mock (per-table results) ───────────────────────────────────────
+
+const inserts: { table: string; payload: any }[] = [];
+const calls: { table: string; method: string; args: any[] }[] = [];
+// maybeSingle() result per table; awaiting a chain (delete…select) reads `.list`.
+let resultsByTable: Record<string, { single?: any; list?: any }> = {};
+let insertResult: { error: { message: string } | null } = { error: null };
+
+function createChain(table: string) {
+  const builder: any = {};
+  for (const m of ["select", "eq", "order", "limit", "gte", "update", "delete"]) {
+    builder[m] = vi.fn((...args: any[]) => {
+      calls.push({ table, method: m, args });
+      return builder;
+    });
+  }
+  builder.maybeSingle = vi.fn(() =>
+    Promise.resolve({ data: resultsByTable[table]?.single ?? null, error: null }),
+  );
+  builder.insert = vi.fn((payload: any) => {
+    inserts.push({ table, payload });
+    return Promise.resolve(insertResult);
+  });
+  // Awaiting the builder (e.g. delete().eq().select("id"), or update().eq()) resolves here.
+  // biome-ignore lint/suspicious/noThenProperty: thenable mock
+  builder.then = (resolve: any) =>
+    resolve({ data: resultsByTable[table]?.list ?? null, error: null });
+  return builder;
+}
+
+const mockSupabase = { from: vi.fn((t: string) => createChain(t)) };
+vi.mock("@/lib/db", () => ({ getSupabase: () => mockSupabase }));
+
+const VALID_SPEC = { title: "Leads", blocks: [{ type: "kpi", label: "Total", agg: "count" }] };
+
+beforeEach(() => {
+  inserts.length = 0;
+  calls.length = 0;
+  resultsByTable = {};
+  insertResult = { error: null };
+});
+
+afterEach(() => {
+  vi.clearAllMocks();
+});
+
+// ─── createShare ──────────────────────────────────────────────────────────────
+
+describe("createShare", () => {
+  it("mints a token and inserts a dashboard_share row when the artifact is owned", async () => {
+    resultsByTable.artifact = { single: { id: "art-1" } };
+    const { createShare } = await import("@/lib/dashboards/share");
+
+    const result = await createShare("ws-1", "user-1", "art-1");
+
+    expect(result).not.toBeNull();
+    expect(typeof result?.token).toBe("string");
+    expect(result?.token.length).toBeGreaterThan(20);
+    expect(result?.expiresAt).toBeNull();
+
+    const shareInsert = inserts.find((i) => i.table === "dashboard_share");
+    expect(shareInsert).toBeTruthy();
+    expect(shareInsert?.payload.artifact_id).toBe("art-1");
+    expect(shareInsert?.payload.workspace_id).toBe("ws-1");
+    expect(shareInsert?.payload.user_id).toBe("user-1");
+    expect(shareInsert?.payload.share_token).toBe(result?.token);
+    expect(shareInsert?.payload.expires_at).toBeNull();
+  });
+
+  it("returns null and inserts nothing when the artifact is not owned", async () => {
+    resultsByTable.artifact = { single: null }; // ownership check fails
+    const { createShare } = await import("@/lib/dashboards/share");
+
+    const result = await createShare("ws-1", "user-1", "someone-elses");
+
+    expect(result).toBeNull();
+    expect(inserts.find((i) => i.table === "dashboard_share")).toBeUndefined();
+  });
+
+  it("sets a future expires_at when expiresInDays is given", async () => {
+    resultsByTable.artifact = { single: { id: "art-1" } };
+    const { createShare } = await import("@/lib/dashboards/share");
+
+    const result = await createShare("ws-1", "user-1", "art-1", { expiresInDays: 7 });
+
+    expect(result?.expiresAt).toBeTruthy();
+    expect(Date.parse(result?.expiresAt as string)).toBeGreaterThan(Date.now());
+    const shareInsert = inserts.find((i) => i.table === "dashboard_share");
+    expect(shareInsert?.payload.expires_at).toBe(result?.expiresAt);
+  });
+});
+
+// ─── getSharedArtifact ────────────────────────────────────────────────────────
+
+describe("getSharedArtifact", () => {
+  it("resolves a valid token to the owner's artifact data", async () => {
+    resultsByTable.dashboard_share = {
+      single: { artifact_id: "art-1", workspace_id: "ws-1", expires_at: null },
+    };
+    resultsByTable.artifact = {
+      single: {
+        id: "art-1",
+        kind: "dashboard",
+        title: "Leads",
+        spec: JSON.stringify(VALID_SPEC),
+        snapshot_id: null, // no snapshot → records default to []
+        updated_at: "2026-06-20T00:00:00.000Z",
+      },
+    };
+    const { getSharedArtifact } = await import("@/lib/dashboards/share");
+
+    const artifact = await getSharedArtifact("tok-1");
+
+    expect(artifact).not.toBeNull();
+    expect(artifact?.id).toBe("art-1");
+    expect(artifact?.title).toBe("Leads");
+    expect(artifact?.spec.title).toBe("Leads");
+    expect(artifact?.records).toEqual([]);
+    // The artifact read is scoped to the WORKSPACE carried by the share row.
+    const artifactEq = calls
+      .filter((c) => c.table === "artifact" && c.method === "eq")
+      .map((c) => c.args);
+    expect(artifactEq).toEqual(expect.arrayContaining([["workspace_id", "ws-1"]]));
+  });
+
+  it("returns null for an unknown token", async () => {
+    resultsByTable.dashboard_share = { single: null };
+    const { getSharedArtifact } = await import("@/lib/dashboards/share");
+    expect(await getSharedArtifact("nope")).toBeNull();
+  });
+
+  it("returns null for an expired token (and never reads the artifact)", async () => {
+    resultsByTable.dashboard_share = {
+      single: {
+        artifact_id: "art-1",
+        user_id: "owner-1",
+        expires_at: "2000-01-01T00:00:00.000Z",
+      },
+    };
+    const { getSharedArtifact } = await import("@/lib/dashboards/share");
+
+    expect(await getSharedArtifact("expired")).toBeNull();
+    expect(calls.some((c) => c.table === "artifact")).toBe(false);
+  });
+});
+
+// ─── revokeShare ──────────────────────────────────────────────────────────────
+
+describe("revokeShare", () => {
+  it("returns true when a row was deleted (workspace-scoped)", async () => {
+    resultsByTable.dashboard_share = { list: [{ id: "share-1" }] };
+    const { revokeShare } = await import("@/lib/dashboards/share");
+
+    expect(await revokeShare("ws-1", "tok-1")).toBe(true);
+    const eqArgs = calls
+      .filter((c) => c.table === "dashboard_share" && c.method === "eq")
+      .map((c) => c.args);
+    expect(eqArgs).toEqual(
+      expect.arrayContaining([
+        ["workspace_id", "ws-1"],
+        ["share_token", "tok-1"],
+      ]),
+    );
+  });
+
+  it("returns false when no row matched", async () => {
+    resultsByTable.dashboard_share = { list: [] };
+    const { revokeShare } = await import("@/lib/dashboards/share");
+    expect(await revokeShare("ws-1", "tok-x")).toBe(false);
+  });
+});
diff --git a/packages/agents/tests/unit/dashboards-snapshot.test.ts b/packages/agents/tests/unit/dashboards-snapshot.test.ts
new file mode 100644
index 00000000..f010dbc1
--- /dev/null
+++ b/packages/agents/tests/unit/dashboards-snapshot.test.ts
@@ -0,0 +1,226 @@
+/**
+ * Unit tests for the dashboards snapshot lib — the append-only save path and the
+ * latest/history reads. No network: getSupabase is mocked; we assert the row
+ * shape that gets inserted (JSON-as-text, row_count) and that reads parse the
+ * stored JSON back into Snapshot objects.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+// ─── Supabase mock ────────────────────────────────────────────────────────────
+
+const inserts: { table: string; payload: any }[] = [];
+// What select chains resolve to (both the thenable and maybeSingle).
+let selectResult: { data: any; error: any } = { data: null, error: null };
+let insertResult: { error: { message: string } | null } = { error: null };
+// Captured filter args so we can assert scoping (user_id, app_key) + gte(since).
+const filters: { method: string; args: any[] }[] = [];
+
+function createChain(table: string) {
+  const builder: any = {};
+  for (const m of ["select", "eq", "order", "limit", "gte"]) {
+    builder[m] = vi.fn((...args: any[]) => {
+      filters.push({ method: m, args });
+      return builder;
+    });
+  }
+  builder.maybeSingle = vi.fn(() => Promise.resolve(selectResult));
+  builder.insert = vi.fn((payload: any) => {
+    inserts.push({ table, payload });
+    return Promise.resolve(insertResult);
+  });
+  // Awaiting the builder directly (history query) resolves to the select result.
+  // biome-ignore lint/suspicious/noThenProperty: thenable mock
+  builder.then = (resolve: any) => resolve(selectResult);
+  return builder;
+}
+
+const mockSupabase = { from: vi.fn((t: string) => createChain(t)) };
+vi.mock("@/lib/db", () => ({ getSupabase: () => mockSupabase }));
+
+beforeEach(() => {
+  inserts.length = 0;
+  filters.length = 0;
+  selectResult = { data: null, error: null };
+  insertResult = { error: null };
+});
+
+afterEach(() => {
+  vi.clearAllMocks();
+});
+
+// ─── saveSnapshot ──────────────────────────────────────────────────────────────
+
+describe("saveSnapshot", () => {
+  it("inserts one append-only row with JSON-as-text payloads and a row_count", async () => {
+    const { saveSnapshot } = await import("@/lib/dashboards/snapshot");
+    const records = [
+      { id: "1", name: "Acme" },
+      { id: "2", name: "Globex" },
+    ];
+
+    const id = await saveSnapshot({
+      userId: "user-1",
+      appKey: "hubspot",
+      sourceConfig: { app: "hubspot", action: "new_contact" },
+      records,
+      triggerId: "trig-1",
+    });
+
+    expect(typeof id).toBe("string");
+    expect(id.length).toBeGreaterThan(0);
+    expect(inserts).toHaveLength(1);
+
+    const row = inserts[0].payload;
+    expect(inserts[0].table).toBe("app_data_snapshot");
+    expect(row.id).toBe(id);
+    expect(row.user_id).toBe("user-1");
+    expect(row.app_key).toBe("hubspot");
+    expect(row.trigger_id).toBe("trig-1");
+    expect(row.row_count).toBe(2);
+    // JSON stored as text — parses back to the originals.
+    expect(JSON.parse(row.records)).toEqual(records);
+    expect(JSON.parse(row.source_config)).toEqual({ app: "hubspot", action: "new_contact" });
+    // refreshed_at + created_at are set by the lib.
+    expect(typeof row.refreshed_at).toBe("string");
+    expect(row.created_at).toBe(row.refreshed_at);
+  });
+
+  it("defaults workspace_id and trigger_id to null and row_count to 0 for empty records", async () => {
+    const { saveSnapshot } = await import("@/lib/dashboards/snapshot");
+
+    await saveSnapshot({
+      userId: "user-1",
+      appKey: "airtable",
+      sourceConfig: {},
+      records: [],
+    });
+
+    const row = inserts[0].payload;
+    expect(row.workspace_id).toBeNull();
+    expect(row.trigger_id).toBeNull();
+    expect(row.row_count).toBe(0);
+    expect(JSON.parse(row.records)).toEqual([]);
+  });
+
+  it("throws when the insert returns an error", async () => {
+    insertResult = { error: { message: "boom" } };
+    const { saveSnapshot } = await import("@/lib/dashboards/snapshot");
+
+    await expect(
+      saveSnapshot({ userId: "u", appKey: "a", sourceConfig: {}, records: [] }),
+    ).rejects.toThrow(/saveSnapshot failed: boom/);
+  });
+});
+
+// ─── getLatestSnapshot ──────────────────────────────────────────────────────────
+
+describe("getLatestSnapshot", () => {
+  it("returns the parsed latest snapshot scoped to (workspace_id, app_key)", async () => {
+    selectResult = {
+      data: {
+        id: "snap-1",
+        app_key: "hubspot",
+        source_config: JSON.stringify({ app: "hubspot" }),
+        records: JSON.stringify([{ id: "1" }]),
+        row_count: 1,
+        refreshed_at: "2026-06-19T12:00:00.000Z",
+      },
+      error: null,
+    };
+    const { getLatestSnapshot } = await import("@/lib/dashboards/snapshot");
+
+    const snap = await getLatestSnapshot("ws-1", "hubspot");
+
+    expect(snap).toEqual({
+      id: "snap-1",
+      appKey: "hubspot",
+      sourceConfig: { app: "hubspot" },
+      records: [{ id: "1" }],
+      rowCount: 1,
+      refreshedAt: "2026-06-19T12:00:00.000Z",
+    });
+    // Scoped by both workspace_id and app_key.
+    const eqArgs = filters.filter((f) => f.method === "eq").map((f) => f.args);
+    expect(eqArgs).toEqual(
+      expect.arrayContaining([
+        ["workspace_id", "ws-1"],
+        ["app_key", "hubspot"],
+      ]),
+    );
+  });
+
+  it("returns null when no snapshot exists", async () => {
+    selectResult = { data: null, error: null };
+    const { getLatestSnapshot } = await import("@/lib/dashboards/snapshot");
+
+    expect(await getLatestSnapshot("user-1", "hubspot")).toBeNull();
+  });
+
+  it("tolerates corrupt stored JSON (records default to [])", async () => {
+    selectResult = {
+      data: {
+        id: "snap-x",
+        app_key: "hubspot",
+        source_config: "not json{",
+        records: "also not json[",
+        row_count: 0,
+        refreshed_at: "2026-06-19T12:00:00.000Z",
+      },
+      error: null,
+    };
+    const { getLatestSnapshot } = await import("@/lib/dashboards/snapshot");
+
+    const snap = await getLatestSnapshot("user-1", "hubspot");
+    expect(snap?.records).toEqual([]);
+    expect(snap?.sourceConfig).toBeNull();
+  });
+});
+
+// ─── getSnapshotHistory ─────────────────────────────────────────────────────────
+
+describe("getSnapshotHistory", () => {
+  it("maps a series of rows newest-first and applies the since filter", async () => {
+    selectResult = {
+      data: [
+        {
+          id: "snap-2",
+          app_key: "hubspot",
+          source_config: "{}",
+          records: JSON.stringify([{ id: "2" }]),
+          row_count: 1,
+          refreshed_at: "2026-06-19T13:00:00.000Z",
+        },
+        {
+          id: "snap-1",
+          app_key: "hubspot",
+          source_config: "{}",
+          records: JSON.stringify([{ id: "1" }]),
+          row_count: 1,
+          refreshed_at: "2026-06-19T12:00:00.000Z",
+        },
+      ],
+      error: null,
+    };
+    const { getSnapshotHistory } = await import("@/lib/dashboards/snapshot");
+
+    const series = await getSnapshotHistory("user-1", "hubspot", {
+      since: "2026-06-19T00:00:00.000Z",
+    });
+
+    expect(series).toHaveLength(2);
+    expect(series.map((s) => s.id)).toEqual(["snap-2", "snap-1"]);
+    expect(series[0].records).toEqual([{ id: "2" }]);
+    // since → gte("refreshed_at", ...)
+    const gte = filters.find((f) => f.method === "gte");
+    expect(gte?.args).toEqual(["refreshed_at", "2026-06-19T00:00:00.000Z"]);
+  });
+
+  it("returns [] when there are no rows and does not call gte without since", async () => {
+    selectResult = { data: null, error: null };
+    const { getSnapshotHistory } = await import("@/lib/dashboards/snapshot");
+
+    const series = await getSnapshotHistory("user-1", "hubspot");
+    expect(series).toEqual([]);
+    expect(filters.some((f) => f.method === "gte")).toBe(false);
+  });
+});
diff --git a/packages/agents/tests/unit/digest-narrator.test.ts b/packages/agents/tests/unit/digest-narrator.test.ts
new file mode 100644
index 00000000..4816edc6
--- /dev/null
+++ b/packages/agents/tests/unit/digest-narrator.test.ts
@@ -0,0 +1,39 @@
+/**
+ * Unit tests for the digest narrator (foreman-bhb5). The LLM call is injected, so
+ * these never hit a provider — they cover the fail-soft contract (a narrator
+ * failure must never break the digest) and trimming.
+ */
+import { describe, expect, it } from "vitest";
+import { buildDigest } from "../../src/lib/automations/digest";
+import { narrateDigest } from "../../src/lib/automations/digest-narrator";
+
+const digest = buildDigest([], "2026-07-04T12:00:00Z", "2026-07-05T12:00:00Z");
+
+describe("narrateDigest", () => {
+  it("returns the trimmed narrative", async () => {
+    const out = await narrateDigest(digest, async () => "  All 3 automations ran cleanly.  ");
+    expect(out).toBe("All 3 automations ran cleanly.");
+  });
+
+  it("passes the instructions + prompt through to the generator", async () => {
+    let seen: { instructions?: string; prompt?: string } = {};
+    await narrateDigest(digest, async (instructions, prompt) => {
+      seen = { instructions, prompt };
+      return "ok";
+    });
+    expect(seen.instructions).toContain("daily digest");
+    expect(seen.prompt).toContain("totals");
+  });
+
+  it("degrades to null when the generator throws", async () => {
+    const out = await narrateDigest(digest, async () => {
+      throw new Error("rate limited");
+    });
+    expect(out).toBeNull();
+  });
+
+  it("degrades to null on empty output", async () => {
+    const out = await narrateDigest(digest, async () => "   ");
+    expect(out).toBeNull();
+  });
+});
diff --git a/packages/agents/tests/unit/digest.test.ts b/packages/agents/tests/unit/digest.test.ts
new file mode 100644
index 00000000..f90d9d2a
--- /dev/null
+++ b/packages/agents/tests/unit/digest.test.ts
@@ -0,0 +1,114 @@
+/**
+ * Unit tests for daily digest synthesis (foreman-ufo3.2). Pure aggregation —
+ * no SDK, no DB.
+ */
+import { describe, expect, it } from "vitest";
+import {
+  buildDigest,
+  buildDigestNarrativePrompt,
+  DIGEST_KIND,
+  type DigestInputRun,
+} from "../../src/lib/automations/digest";
+
+const START = "2026-07-04T12:00:00Z";
+const END = "2026-07-05T12:00:00Z";
+
+function run(o: Partial<DigestInputRun> & { status: string }): DigestInputRun {
+  return {
+    automationId: o.automationId ?? "auto_1",
+    automationName: o.automationName ?? "Some automation",
+    status: o.status,
+    error: o.error,
+    createdAt: o.createdAt ?? "2026-07-05T09:00:00Z",
+  };
+}
+
+describe("buildDigest", () => {
+  it("summarizes an empty period", () => {
+    const d = buildDigest([], START, END);
+    expect(d.kind).toBe(DIGEST_KIND);
+    expect(d.totals.total).toBe(0);
+    expect(d.headline).toBe("No automation activity in the last day");
+    expect(d.failures).toEqual([]);
+  });
+
+  it("counts by status and leads the headline with failures", () => {
+    const d = buildDigest(
+      [
+        run({ status: "finished" }),
+        run({ status: "finished" }),
+        run({ status: "failed", automationName: "Sync", error: { message: "boom" } }),
+        run({ status: "waiting", automationName: "Approve me" }),
+        run({ status: "retrying" }),
+        run({ status: "started" }),
+        run({ status: "cancelled" }),
+      ],
+      START,
+      END,
+    );
+    expect(d.totals).toEqual({
+      total: 7,
+      finished: 2,
+      failed: 1,
+      waiting: 1,
+      retrying: 1,
+      other: 2, // started + cancelled
+    });
+    expect(d.headline).toBe("7 runs · 1 failed · 1 waiting for approval · 1 retrying · 2 ok");
+    expect(d.failures[0]).toMatchObject({ automationName: "Sync", error: "boom" });
+    expect(d.waiting[0]).toMatchObject({ automationName: "Approve me" });
+  });
+
+  it("extracts an error from a DurableRunDetail shape", () => {
+    const d = buildDigest(
+      [run({ status: "failed", error: { lastError: { title: "step timed out" } } })],
+      START,
+      END,
+    );
+    expect(d.failures[0].error).toBe("step timed out");
+  });
+
+  it("tolerates a missing/odd error payload", () => {
+    const d = buildDigest([run({ status: "failed", error: null })], START, END);
+    expect(d.failures[0].error).toBeNull();
+  });
+
+  it("orders each bucket most-recent-first", () => {
+    const d = buildDigest(
+      [
+        run({ status: "failed", automationName: "old", createdAt: "2026-07-05T01:00:00Z" }),
+        run({ status: "failed", automationName: "new", createdAt: "2026-07-05T11:00:00Z" }),
+      ],
+      START,
+      END,
+    );
+    expect(d.failures.map((f) => f.automationName)).toEqual(["new", "old"]);
+  });
+
+  it("singularizes the run count", () => {
+    const d = buildDigest([run({ status: "finished" })], START, END);
+    expect(d.headline).toBe("1 run · 1 ok");
+  });
+
+  it("leaves narrative null (the LLM layer is opt-in)", () => {
+    expect(buildDigest([], START, END).narrative).toBeNull();
+  });
+});
+
+describe("buildDigestNarrativePrompt", () => {
+  it("compacts the structured digest into a prompt naming automations + errors", () => {
+    const d = buildDigest(
+      [
+        run({ status: "failed", automationName: "Sync", error: { message: "boom" } }),
+        run({ status: "waiting", automationName: "Approve me" }),
+      ],
+      START,
+      END,
+    );
+    const prompt = buildDigestNarrativePrompt(d);
+    expect(prompt).toContain("totals");
+    expect(prompt).toContain("Sync");
+    expect(prompt).toContain("boom");
+    expect(prompt).toContain("Approve me");
+  });
+});
diff --git a/packages/agents/tests/unit/durable-deploy.test.ts b/packages/agents/tests/unit/durable-deploy.test.ts
new file mode 100644
index 00000000..c8d2763d
--- /dev/null
+++ b/packages/agents/tests/unit/durable-deploy.test.ts
@@ -0,0 +1,377 @@
+/**
+ * Unit tests for the durable deploy/run layer (foreman-l7xq M1).
+ * Drives the functions against a fake experimental SDK — no network.
+ */
+import { describe, expect, it, vi } from "vitest";
+import {
+  AGED_DURABLE_DEPS,
+  cancelDurableRun,
+  deployAutomation,
+  getDurableRunStatus,
+  inspectAutomation,
+  listAutomations,
+  runAutomationOnce,
+  triggerAutomation,
+} from "../../src/lib/durable";
+import type { ExperimentalZapierSdk } from "../../src/lib/zapier/sdk";
+
+function fakeSdk(overrides: Record<string, unknown>): ExperimentalZapierSdk {
+  return overrides as unknown as ExperimentalZapierSdk;
+}
+
+describe("deployAutomation", () => {
+  it("creates + publishes, shapes connections/deps, returns the editor link (no trigger → no re-read)", async () => {
+    const sdk = fakeSdk({
+      createWorkflow: vi.fn(async () => ({
+        data: { id: "wf_1", trigger_url: "https://trig/x", enabled: false, is_private: true },
+      })),
+      publishWorkflowVersion: vi.fn(async () => ({ data: { id: "ver_1", workflow_id: "wf_1" } })),
+      getWorkflow: vi.fn(),
+    });
+
+    const res = await deployAutomation({
+      sdk,
+      name: "Test",
+      description: "d",
+      source: "SRC",
+      connections: { slack_work: "123" },
+      enabled: true,
+    });
+
+    expect(res.workflowId).toBe("wf_1");
+    expect(res.versionId).toBe("ver_1");
+    expect(res.editorUrl).toBe("https://zapier.com/durables-editor/wf_1");
+    expect(res.triggerUrl).toBe("https://trig/x");
+    expect(res.triggerClaimFailed).toBe(false);
+    // No trigger requested → no verification re-read.
+    expect((sdk.getWorkflow as ReturnType<typeof vi.fn>) ?? vi.fn()).not.toHaveBeenCalled();
+
+    const pubArg = (sdk.publishWorkflowVersion as ReturnType<typeof vi.fn>).mock.calls[0][0];
+    expect(pubArg.sourceFiles["workflow.ts"]).toBe("SRC");
+    expect(pubArg.dependencies["@zapier/zapier-sdk"]).toBe(AGED_DURABLE_DEPS.sdk);
+    expect(pubArg.dependencies.zod).toBe(AGED_DURABLE_DEPS.zod);
+    expect(pubArg.zapierDurableVersion).toBe(AGED_DURABLE_DEPS.durable);
+    expect(pubArg.connections).toEqual({ slack_work: { connectionId: "123" } });
+    expect(pubArg.trigger).toBeUndefined();
+  });
+
+  it("verifies the trigger claim and flags a silent failure", async () => {
+    const sdk = fakeSdk({
+      createWorkflow: vi.fn(async () => ({
+        data: { id: "wf_2", trigger_url: "https://trig/y", enabled: false, is_private: true },
+      })),
+      publishWorkflowVersion: vi.fn(async () => ({ data: { id: "ver_2", workflow_id: "wf_2" } })),
+      getWorkflow: vi.fn(async () => ({
+        data: {
+          id: "wf_2",
+          enabled: false,
+          disabled_reason: "trigger_claim_failed",
+          triggers: [{ status: "failed" }],
+        },
+      })),
+    });
+
+    const res = await deployAutomation({
+      sdk,
+      name: "Triggered",
+      source: "SRC",
+      trigger: { selectedApi: "GoogleSheetsAPI@2.3.0", action: "new_row" },
+      enabled: true,
+    });
+
+    expect(sdk.getWorkflow).toHaveBeenCalledWith({ workflow: "wf_2" });
+    expect(res.triggerClaimFailed).toBe(true);
+    expect(res.enabled).toBe(false);
+    expect(res.disabledReason).toBe("trigger_claim_failed");
+
+    const pubArg = (sdk.publishWorkflowVersion as ReturnType<typeof vi.fn>).mock.calls[0][0];
+    expect(pubArg.trigger).toEqual({
+      action: "new_row",
+      selectedApi: "GoogleSheetsAPI@2.3.0",
+      authenticationId: null,
+      params: undefined,
+    });
+  });
+});
+
+describe("runAutomationOnce", () => {
+  it("runs ephemeral durable source with aged deps + private", async () => {
+    const sdk = fakeSdk({
+      runDurable: vi.fn(async () => ({ data: { id: "run_1", status: "initialized" } })),
+    });
+    const res = await runAutomationOnce({ sdk, source: "SRC", input: { a: 1 } });
+    expect(res).toEqual({ runId: "run_1", status: "initialized" });
+    const arg = (sdk.runDurable as ReturnType<typeof vi.fn>).mock.calls[0][0];
+    expect(arg.sourceFiles["workflow.ts"]).toBe("SRC");
+    expect(arg.private).toBe(true);
+    expect(arg.zapierDurableVersion).toBe(AGED_DURABLE_DEPS.durable);
+  });
+});
+
+describe("triggerAutomation", () => {
+  it("fires a workflow and returns the trigger id", async () => {
+    const sdk = fakeSdk({
+      triggerWorkflow: vi.fn(async () => ({ data: { id: "trig_1", workflow_id: "wf_1" } })),
+    });
+    const res = await triggerAutomation({ sdk, workflowId: "wf_1", input: { x: 1 } });
+    expect(res).toEqual({ triggerId: "trig_1" });
+    expect(sdk.triggerWorkflow).toHaveBeenCalledWith({ workflow: "wf_1", input: { x: 1 } });
+  });
+});
+
+describe("cancelDurableRun (foreman-y4kc)", () => {
+  it("cancels a run and returns the resulting status", async () => {
+    const sdk = fakeSdk({
+      cancelDurableRun: vi.fn(async () => ({ data: { id: "dr_1", status: "cancelled" } })),
+    });
+    const status = await cancelDurableRun(sdk, "dr_1");
+    expect(status).toBe("cancelled");
+    expect(sdk.cancelDurableRun).toHaveBeenCalledWith({ run: "dr_1" });
+  });
+});
+
+describe("resolveCallbackUrl + postCallback (foreman-zfnj)", () => {
+  const runWith = (operations: unknown[]) => ({
+    data: { id: "r", status: "started", output: null, error: null, execution: { operations } },
+  });
+
+  it("returns the URL a step reported for a still-pending callback", async () => {
+    const sdk = fakeSdk({
+      getDurableRun: vi.fn(async () =>
+        runWith([
+          {
+            name: "approve",
+            type: "callback",
+            status: "pending",
+            callback_token: "tok_1",
+            payload_schema: { type: "object" },
+          },
+          {
+            name: "__report_callback_url_approve",
+            type: "step",
+            status: "completed",
+            result: { callbackUrl: "https://cb.example/abc", callbackName: "approve" },
+          },
+        ]),
+      ),
+    });
+    const { resolveCallbackUrl } = await import("../../src/lib/durable");
+    const cb = await resolveCallbackUrl(sdk, "dr_1");
+    expect(cb).toEqual({
+      url: "https://cb.example/abc",
+      name: "approve",
+      payloadSchema: { type: "object" },
+    });
+  });
+
+  it("returns null when the callback op is no longer pending", async () => {
+    const sdk = fakeSdk({
+      getDurableRun: vi.fn(async () =>
+        runWith([
+          { name: "approve", type: "callback", status: "completed", callback_token: "tok_1" },
+          { name: "x", type: "step", status: "completed", result: { callbackUrl: "https://x" } },
+        ]),
+      ),
+    });
+    const { resolveCallbackUrl } = await import("../../src/lib/durable");
+    expect(await resolveCallbackUrl(sdk, "dr_1")).toBeNull();
+  });
+
+  it("returns null when no step reported a URL", async () => {
+    const sdk = fakeSdk({
+      getDurableRun: vi.fn(async () =>
+        runWith([{ name: "approve", type: "callback", status: "pending", callback_token: "t" }]),
+      ),
+    });
+    const { resolveCallbackUrl } = await import("../../src/lib/durable");
+    expect(await resolveCallbackUrl(sdk, "dr_1")).toBeNull();
+  });
+
+  it("postCallback POSTs JSON and returns ok/status", async () => {
+    const fetchMock = vi.fn(async () => ({ ok: true, status: 200 }) as unknown as Response);
+    vi.stubGlobal("fetch", fetchMock);
+    const { postCallback } = await import("../../src/lib/durable");
+    const res = await postCallback("https://cb.example/abc", { approved: true });
+    expect(res).toEqual({ ok: true, status: 200 });
+    expect(fetchMock).toHaveBeenCalledWith(
+      "https://cb.example/abc",
+      expect.objectContaining({ method: "POST", body: JSON.stringify({ approved: true }) }),
+    );
+    vi.unstubAllGlobals();
+  });
+});
+
+describe("getDurableRunStatus — execution detail (foreman-jc12)", () => {
+  const runData = (execution: unknown, status = "started") => ({
+    data: { id: "r", status, output: null, error: null, execution },
+  });
+
+  it("returns null detail for a clean, still-running execution", async () => {
+    const sdk = fakeSdk({
+      getDurableRun: vi.fn(async () =>
+        runData({
+          id: "e",
+          name: "n",
+          status: "running",
+          input: null,
+          created_at: "t",
+          summary: { total_attempts: 1 },
+          operations: [
+            {
+              id: "o",
+              execution_id: "e",
+              name: "step",
+              type: "run",
+              status: "success",
+              retry_count: 0,
+              created_at: "t",
+            },
+          ],
+        }),
+      ),
+    });
+    const res = await getDurableRunStatus(sdk, "r");
+    expect(res).toMatchObject({ status: "started", detail: null });
+  });
+
+  it("extracts last_error + only the retrying/failed ops", async () => {
+    const sdk = fakeSdk({
+      getDurableRun: vi.fn(async () =>
+        runData({
+          id: "e",
+          name: "n",
+          status: "running",
+          input: null,
+          created_at: "t",
+          summary: {
+            total_attempts: 3,
+            last_error: { code: "RATE_LIMIT", title: "Too many requests", detail: "retry later" },
+          },
+          operations: [
+            {
+              id: "o1",
+              execution_id: "e",
+              name: "post-slack",
+              type: "run",
+              status: "retrying",
+              retry_count: 2,
+              max_attempts: 5,
+              next_retry_at: "2026-07-05T00:00:00Z",
+              created_at: "t",
+              error: { message: "429" },
+            },
+            {
+              id: "o2",
+              execution_id: "e",
+              name: "read-row",
+              type: "read",
+              status: "success",
+              retry_count: 0,
+              created_at: "t",
+            },
+          ],
+        }),
+      ),
+    });
+    const res = await getDurableRunStatus(sdk, "r");
+    expect(res.detail).toEqual({
+      totalAttempts: 3,
+      lastError: { code: "RATE_LIMIT", title: "Too many requests", detail: "retry later" },
+      retrying: [
+        {
+          name: "post-slack",
+          type: "run",
+          status: "retrying",
+          retryCount: 2,
+          maxAttempts: 5,
+          nextRetryAt: "2026-07-05T00:00:00Z",
+          error: { message: "429" },
+        },
+      ],
+    });
+  });
+
+  it("surfaces the waiting-on-callback gate (foreman-rm8z)", async () => {
+    const sdk = fakeSdk({
+      getDurableRun: vi.fn(async () =>
+        runData({
+          id: "e",
+          name: "n",
+          status: "waiting",
+          input: null,
+          created_at: "t",
+          summary: { total_attempts: 1 },
+          operations: [
+            {
+              id: "o1",
+              execution_id: "e",
+              name: "approve-refund",
+              type: "callback",
+              status: "waiting",
+              retry_count: 0,
+              created_at: "t",
+              callback_token: "cb_abc",
+              payload_schema: { type: "object" },
+              expires_at: "2026-07-06T00:00:00Z",
+            },
+          ],
+        }),
+      ),
+    });
+    const res = await getDurableRunStatus(sdk, "r");
+    expect(res.detail?.waiting).toBe(true);
+    expect(res.detail?.callbacks).toEqual([
+      {
+        name: "approve-refund",
+        status: "waiting",
+        callbackToken: "cb_abc",
+        payloadSchema: { type: "object" },
+        resumeAt: undefined,
+        expiresAt: "2026-07-06T00:00:00Z",
+      },
+    ]);
+  });
+
+  it("returns null detail when there is no execution", async () => {
+    const sdk = fakeSdk({
+      getDurableRun: vi.fn(async () => ({
+        data: { id: "r", status: "finished", output: { ok: true }, error: null, execution: null },
+      })),
+    });
+    const res = await getDurableRunStatus(sdk, "r");
+    expect(res.detail).toBeNull();
+    expect(res.output).toEqual({ ok: true });
+  });
+});
+
+describe("listAutomations / inspectAutomation", () => {
+  it("maps listWorkflows into summaries with editor links", async () => {
+    const sdk = fakeSdk({
+      listWorkflows: vi.fn(async () => ({
+        data: [{ id: "wf_1", name: "A", enabled: true, is_private: false, triggers: [] }],
+      })),
+    });
+    const list = await listAutomations(sdk);
+    expect(list).toEqual([
+      {
+        id: "wf_1",
+        name: "A",
+        enabled: true,
+        isPrivate: false,
+        editorUrl: "https://zapier.com/durables-editor/wf_1",
+        triggers: [],
+      },
+    ]);
+  });
+
+  it("returns workflow + recent runs", async () => {
+    const sdk = fakeSdk({
+      getWorkflow: vi.fn(async () => ({ data: { id: "wf_1", enabled: true } })),
+      listWorkflowRuns: vi.fn(async () => ({ data: [{ id: "run_1", status: "finished" }] })),
+    });
+    const res = await inspectAutomation(sdk, "wf_1", 5);
+    expect((res.workflow as { id: string }).id).toBe("wf_1");
+    expect(res.runs).toHaveLength(1);
+    expect(sdk.listWorkflowRuns).toHaveBeenCalledWith({ workflow: "wf_1", maxItems: 5 });
+  });
+});
diff --git a/packages/agents/tests/unit/durable-source.test.ts b/packages/agents/tests/unit/durable-source.test.ts
new file mode 100644
index 00000000..6e21a452
--- /dev/null
+++ b/packages/agents/tests/unit/durable-source.test.ts
@@ -0,0 +1,86 @@
+/**
+ * Unit tests for the durable source generator (foreman-l7xq M1).
+ * Pure string generation — no SDK, no network.
+ */
+import { describe, expect, it } from "vitest";
+import { AGED_DURABLE_DEPS, buildDurableSource, humanApprovalGate } from "../../src/lib/durable";
+
+describe("buildDurableSource", () => {
+  const source = buildDurableSource({
+    name: "notify-on-row",
+    steps: [
+      {
+        id: "send-slack",
+        appKey: "SlackCLIAPI",
+        actionType: "write",
+        actionKey: "send_message",
+        connection: "slack_work",
+        inputs: { channel: "#general", text: "hi" },
+      },
+    ],
+  });
+
+  it("emits the parser-friendly durable shape", () => {
+    expect(source).toContain('import { defineDurable } from "@zapier/zapier-durable";');
+    expect(source).toContain('import { createZapierSdk } from "@zapier/zapier-sdk";');
+    expect(source).toContain("const sdk = createZapierSdk();");
+    expect(source).toContain('defineDurable("notify-on-row", async (ctx) => {');
+    expect(source).toContain("export default workflow;");
+  });
+
+  it("emits one runAction step per app action with hoisted literals", () => {
+    expect(source).toContain('ctx.step("send-slack"');
+    expect(source).toContain('appKey: "SlackCLIAPI"');
+    expect(source).toContain('actionType: "write"');
+    expect(source).toContain('actionKey: "send_message"');
+    expect(source).toContain('connection: "slack_work"');
+    expect(source).toContain('"channel":"#general"');
+  });
+
+  it("returns each step's result", () => {
+    expect(source).toContain("return { step_0 };");
+  });
+
+  it("generates a multi-step return", () => {
+    const multi = buildDurableSource({
+      name: "two-step",
+      steps: [
+        { id: "a", appKey: "X", actionType: "read", actionKey: "r", connection: "c" },
+        { id: "b", appKey: "Y", actionType: "write", actionKey: "w", connection: "c" },
+      ],
+    });
+    expect(multi).toContain("return { step_0, step_1 };");
+    expect(multi).toContain('ctx.step("a"');
+    expect(multi).toContain('ctx.step("b"');
+  });
+
+  it("pins aged dependency versions", () => {
+    expect(AGED_DURABLE_DEPS.sdk).toMatch(/^\d+\.\d+\.\d+$/);
+    expect(AGED_DURABLE_DEPS.durable).toMatch(/^\d+\.\d+\.\d+$/);
+    expect(AGED_DURABLE_DEPS.zod).toMatch(/^\d+\.\d+\.\d+$/);
+  });
+});
+
+describe("humanApprovalGate (foreman-zfnj)", () => {
+  it("creates the gate, reports its URL+name via a step, and awaits the decision", () => {
+    const gate = humanApprovalGate("approve");
+    expect(gate).toContain(
+      'const [approveApproval, approveUrl] = await ctx.createCallback("approve");',
+    );
+    // The report step is what resolveCallbackUrl reads to find the URL.
+    expect(gate).toContain('ctx.step("__report_callback_url_approve"');
+    expect(gate).toContain("callbackUrl: approveUrl");
+    expect(gate).toContain('callbackName: "approve"');
+    expect(gate).toContain("const approveDecision = await approveApproval;");
+  });
+
+  it("sanitizes a non-identifier name into safe variable names", () => {
+    const gate = humanApprovalGate("needs-sign-off");
+    // createCallback + callbackName keep the original name…
+    expect(gate).toContain('ctx.createCallback("needs-sign-off")');
+    expect(gate).toContain('callbackName: "needs-sign-off"');
+    // …but the JS variables are sanitized.
+    expect(gate).toContain("needs_sign_offApproval");
+    expect(gate).toContain("needs_sign_offUrl");
+  });
+});
diff --git a/packages/agents/tests/unit/env.test.ts b/packages/agents/tests/unit/env.test.ts
index b325134a..40bbdeed 100644
--- a/packages/agents/tests/unit/env.test.ts
+++ b/packages/agents/tests/unit/env.test.ts
@@ -1,4 +1,4 @@
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 describe("env validation", () => {
   const originalEnv = { ...process.env };
diff --git a/packages/agents/tests/unit/inbox-priority.test.ts b/packages/agents/tests/unit/inbox-priority.test.ts
new file mode 100644
index 00000000..8bd257f3
--- /dev/null
+++ b/packages/agents/tests/unit/inbox-priority.test.ts
@@ -0,0 +1,120 @@
+/**
+ * Unit tests for inbox prioritization scoring (foreman-6r9y). Pure function —
+ * no SDK, no network, clock injected via `now`.
+ */
+import { describe, expect, it } from "vitest";
+import { type ScorableMessage, scoreInboxEntry } from "../../src/lib/automations/inbox-priority";
+
+const NOW = Date.parse("2026-07-05T12:00:00Z");
+
+function msg(
+  o: {
+    created_at?: string;
+    status?: string;
+    lease_count?: number;
+    error_message?: string | null;
+    possible_duplicate_data?: boolean;
+  } = {},
+): ScorableMessage {
+  return {
+    created_at: o.created_at ?? "2026-07-05T11:59:00Z",
+    status: o.status ?? "pending",
+    message_attributes: {
+      lease_count: o.lease_count ?? 1,
+      error_message: o.error_message ?? null,
+      possible_duplicate_data: o.possible_duplicate_data ?? false,
+    },
+  };
+}
+
+const base = {
+  automationStatus: "active",
+  enabled: true,
+  inboxStatus: "active" as string | null,
+  inboxPausedReason: null as string | null,
+  now: NOW,
+};
+
+describe("scoreInboxEntry", () => {
+  it("is low priority when the inbox is quiet", () => {
+    const p = scoreInboxEntry({ ...base, messages: [] });
+    expect(p.score).toBe(0);
+    expect(p.level).toBe("low");
+    expect(p.reasons).toEqual([]);
+  });
+
+  it("flags a failing trigger as high priority", () => {
+    const p = scoreInboxEntry({ ...base, automationStatus: "trigger_failed", messages: [] });
+    expect(p.level).toBe("high");
+    expect(p.reasons).toContain("trigger is failing");
+  });
+
+  it("scores a paused inbox and names the reason", () => {
+    const p = scoreInboxEntry({
+      ...base,
+      inboxStatus: "paused",
+      inboxPausedReason: "connection revoked",
+      messages: [],
+    });
+    expect(p.score).toBe(20);
+    expect(p.level).toBe("medium");
+    expect(p.reasons).toContain("inbox paused: connection revoked");
+  });
+
+  it("weights errored messages heavily", () => {
+    const p = scoreInboxEntry({ ...base, messages: [msg({ error_message: "boom" })] });
+    // 15 (errored) + 3 (1 pending) = 18 → medium
+    expect(p.score).toBe(18);
+    expect(p.level).toBe("medium");
+    expect(p.reasons).toContain("1 message errored");
+  });
+
+  it("flags redelivered (stuck) messages", () => {
+    const p = scoreInboxEntry({ ...base, messages: [msg({ lease_count: 3 })] });
+    expect(p.reasons).toContain("1 message stuck (redelivered)");
+    // 10 (stuck) + 3 (pending) = 13
+    expect(p.score).toBe(13);
+  });
+
+  it("adds urgency for stale pending backlog", () => {
+    const p = scoreInboxEntry({
+      ...base,
+      messages: [msg({ created_at: "2026-07-05T06:00:00Z" })], // 6h old
+    });
+    // 3 (pending) + min(6,24)*2 = 3 + 12 = 15
+    expect(p.score).toBe(15);
+    expect(p.reasons).toContain("oldest pending ~6h old");
+    expect(p.reasons).toContain("1 pending message");
+  });
+
+  it("does not count terminal messages as pending or stale", () => {
+    const p = scoreInboxEntry({
+      ...base,
+      messages: [msg({ status: "processed", created_at: "2026-07-01T00:00:00Z" })],
+    });
+    expect(p.score).toBe(0);
+    expect(p.reasons).toEqual([]);
+  });
+
+  it("surfaces duplicates as a note without inflating the score", () => {
+    const p = scoreInboxEntry({
+      ...base,
+      messages: [msg({ status: "processed", possible_duplicate_data: true })],
+    });
+    expect(p.score).toBe(0);
+    expect(p.reasons).toContain("1 possible duplicate");
+  });
+
+  it("notes a disabled automation", () => {
+    const p = scoreInboxEntry({ ...base, enabled: false, messages: [] });
+    expect(p.reasons).toContain("automation disabled");
+  });
+
+  it("caps per-signal contributions so one noisy inbox can't dominate", () => {
+    const many = Array.from({ length: 50 }, () => msg({ error_message: "e", lease_count: 5 }));
+    const p = scoreInboxEntry({ ...base, messages: many });
+    // errored cap 5*15=75, stuck cap 5*10=50, pending cap 10*3=30 → 155 (finite, not 50×)
+    expect(p.score).toBe(155);
+    expect(p.level).toBe("high");
+  });
+});
diff --git a/packages/agents/tests/unit/knowledge.test.ts b/packages/agents/tests/unit/knowledge.test.ts
new file mode 100644
index 00000000..baaada7b
--- /dev/null
+++ b/packages/agents/tests/unit/knowledge.test.ts
@@ -0,0 +1,53 @@
+/**
+ * Unit tests for the knowledge-layer vector primitives (foreman-aqjx).
+ *
+ * The per-workspace index name IS the tenant isolation boundary, so its
+ * derivation must be deterministic and produce a valid SQL identifier. The
+ * embedder must carry the `batch: true` brand Mastra's SearchEngine checks.
+ * (End-to-end indexing + search + cross-tenant isolation — indexSharedDoc, which
+ * lives in mastra/agents/workspace.ts — is proven by scripts/knowledge-e2e-probe.ts
+ * against real Postgres.)
+ */
+import { describe, expect, it, vi } from "vitest";
+
+const mockEmbeddings = [[0.1, 0.2, 0.3]];
+
+vi.mock("@mastra/pg", () => ({ PgVector: class {} }));
+vi.mock("@/lib/env", () => ({ getEnv: () => ({ DATABASE_URL: "postgres://test" }) }));
+vi.mock("ai", () => ({ embedMany: vi.fn(async () => ({ embeddings: mockEmbeddings })) }));
+
+import { knowledgeEmbedder, knowledgeIndexName } from "@/lib/knowledge/vector";
+
+describe("knowledgeIndexName", () => {
+  it("prefixes and replaces non-identifier chars (UUID hyphens) with underscores", () => {
+    expect(knowledgeIndexName("11112222-3333-4444-5555-666677778888")).toBe(
+      "knowledge_11112222_3333_4444_5555_666677778888",
+    );
+  });
+
+  it("handles the shared fallback key", () => {
+    expect(knowledgeIndexName("_shared")).toBe("knowledge__shared");
+  });
+
+  it("produces a valid vector-index identifier (letter/underscore start, [A-Za-z0-9_])", () => {
+    const name = knowledgeIndexName("abc-DEF-123");
+    expect(name).toMatch(/^[A-Za-z_][A-Za-z0-9_]*$/);
+  });
+
+  it("caps length at 63 chars for over-long ids", () => {
+    const name = knowledgeIndexName("x".repeat(120));
+    expect(name.length).toBe(63);
+    expect(name.startsWith("knowledge_")).toBe(true);
+  });
+});
+
+describe("knowledgeEmbedder", () => {
+  it("is branded batch-capable (Mastra SearchEngine checks this)", () => {
+    expect(knowledgeEmbedder.batch).toBe(true);
+  });
+
+  it("returns embeddings for a batch of texts", async () => {
+    const out = await knowledgeEmbedder(["hello"]);
+    expect(out).toEqual(mockEmbeddings);
+  });
+});
diff --git a/packages/agents/tests/unit/mastra-agent.test.ts b/packages/agents/tests/unit/mastra-agent.test.ts
index dfcb4b08..cab3e026 100644
--- a/packages/agents/tests/unit/mastra-agent.test.ts
+++ b/packages/agents/tests/unit/mastra-agent.test.ts
@@ -29,12 +29,7 @@ describe("Mastra foreman agent", () => {
     expect(toolNames).toContain("search_history");
     expect(toolNames).toContain("fork_conversation");
     expect(toolNames).toContain("connect_zapier");
-    expect(toolNames).toContain("save_workflow");
-    expect(toolNames).toContain("list_workflows");
-    expect(toolNames).toContain("get_workflow");
-    expect(toolNames).toContain("run_workflow");
-    expect(toolNames).toContain("update_workflow");
-    expect(toolNames).toContain("delete_workflow");
+    expect(toolNames).toContain("create_dashboard");
   }, 30000);
 
   it("foreman agent uses AGENT_MODELS.foreman as its model", async () => {
@@ -43,19 +38,4 @@ describe("Mastra foreman agent", () => {
     const agent = await createForemanAgent("file:./test-agent.db");
     expect(agent.model).toEqual(AGENT_MODELS.foreman);
   }, 30000);
-
-  it("hosts the trigger SignalProviders and connects them on construction", async () => {
-    const { createForemanAgent } = await import("@/mastra/agents/foreman");
-    const { zapierPollProvider } = await import("@/mastra/signals/zapier-poll-provider");
-    const { channelTriggerProvider } = await import("@/mastra/signals/channel-trigger-provider");
-    await createForemanAgent("file:./test-agent.db");
-    // The Agent constructor calls provider.connect(this) for each signals entry,
-    // proving the primitives are live in the agent (not merely defined).
-    expect(zapierPollProvider.isConnected).toBe(true);
-    expect(channelTriggerProvider.isConnected).toBe(true);
-    // Neither sets a pollInterval — the poll provider is driven by
-    // cron-driver-server, the channel provider is event-driven via webhooks.
-    expect(zapierPollProvider.pollInterval).toBeUndefined();
-    expect(channelTriggerProvider.pollInterval).toBeUndefined();
-  }, 30000);
 });
diff --git a/packages/agents/tests/unit/pii-redactor.test.ts b/packages/agents/tests/unit/pii-redactor.test.ts
index 3c9c2909..45fc4635 100644
--- a/packages/agents/tests/unit/pii-redactor.test.ts
+++ b/packages/agents/tests/unit/pii-redactor.test.ts
@@ -9,7 +9,7 @@ describe("PII Redactor", () => {
         part,
         index: 0,
       } as any);
-      return result?.payload?.text ?? text;
+      return result?.type === "text-delta" ? result.payload.text : text;
     }
 
     it("does NOT redact email addresses (user-provided data)", async () => {
@@ -72,6 +72,7 @@ describe("PII Redactor", () => {
         index: 0,
       } as any);
       // When no redaction needed, returns the original part unchanged
+      if (result?.type !== "text-delta") throw new Error("expected a text-delta chunk");
       expect(result.payload.text).toBe(clean);
     });
 
@@ -109,7 +110,10 @@ describe("PII Redactor", () => {
         messages,
       } as any);
 
-      expect(result[0].content.parts[0].text).toBe("Your email is user@example.com");
+      if (!Array.isArray(result)) throw new Error("expected a messages array");
+      const part = result[0].content.parts[0];
+      if (part.type !== "text") throw new Error("expected a text part");
+      expect(part.text).toBe("Your email is user@example.com");
     });
 
     it("does not modify user messages", async () => {
@@ -126,7 +130,10 @@ describe("PII Redactor", () => {
         messages,
       } as any);
 
-      expect(result[0].content.parts[0].text).toBe("My email is user@example.com");
+      if (!Array.isArray(result)) throw new Error("expected a messages array");
+      const part = result[0].content.parts[0];
+      if (part.type !== "text") throw new Error("expected a text part");
+      expect(part.text).toBe("My email is user@example.com");
     });
 
     it("handles messages without parts gracefully", async () => {
@@ -136,6 +143,7 @@ describe("PII Redactor", () => {
         messages,
       } as any);
 
+      if (!Array.isArray(result)) throw new Error("expected a messages array");
       expect(result[0].content).toBe("plain string content");
     });
   });
diff --git a/packages/agents/tests/unit/prompt-template.test.ts b/packages/agents/tests/unit/prompt-template.test.ts
index 2f5f2bf3..d457c21b 100644
--- a/packages/agents/tests/unit/prompt-template.test.ts
+++ b/packages/agents/tests/unit/prompt-template.test.ts
@@ -16,8 +16,8 @@ describe("buildSystemPrompt", () => {
     // New MCP tool names
     expect(result).toContain("list-connections");
     expect(result).toContain("list-actions");
-    expect(result).toContain("get-input-fields-schema");
-    expect(result).toContain("list-input-field-choices");
+    expect(result).toContain("get-action-input-fields-schema");
+    expect(result).toContain("list-action-input-field-choices");
     expect(result).toContain("run-action");
     expect(result).toContain("list-apps");
     // ToolSearchProcessor meta-tools
@@ -37,16 +37,6 @@ describe("buildSystemPrompt", () => {
     expect(result).toContain("fork_conversation");
   });
 
-  it("references the workflow + trigger tools by name", () => {
-    const result = buildSystemPrompt();
-    expect(result).toContain("save_workflow");
-    expect(result).toContain("list_workflows");
-    expect(result).toContain("run_workflow");
-    expect(result).toContain("attach_trigger");
-    expect(result).toContain("list_workflow_triggers");
-    expect(result).toContain("detach_trigger");
-  });
-
   it("forbids redirecting users to zapier.com for tasks", () => {
     const result = buildSystemPrompt();
     expect(result).toContain("<do_not_redirect>");
@@ -61,12 +51,6 @@ describe("buildSystemPrompt", () => {
     expect(result).toContain("do not call it again");
   });
 
-  it("includes scheduled-workflow + channel-triggered-workflow examples", () => {
-    const result = buildSystemPrompt();
-    expect(result).toContain('name="scheduled-workflow"');
-    expect(result).toContain('name="channel-triggered-workflow"');
-  });
-
   it("returns base prompt with empty context", () => {
     const result = buildSystemPrompt({});
     expect(result).toContain("You are Foreman");
diff --git a/packages/agents/tests/unit/stream-types.test.ts b/packages/agents/tests/unit/stream-types.test.ts
index adcf2a18..b35d1a48 100644
--- a/packages/agents/tests/unit/stream-types.test.ts
+++ b/packages/agents/tests/unit/stream-types.test.ts
@@ -11,6 +11,7 @@ describe("AppChunk type", () => {
     const chunk: AppChunk = {
       type: "tool-call",
       toolName: "test",
+      toolCallId: "call-1",
       args: { key: "value" },
     };
     expectTypeOf(chunk).toMatchTypeOf<AppChunk>();
diff --git a/packages/agents/tests/unit/tool-schema-sanitizer.test.ts b/packages/agents/tests/unit/tool-schema-sanitizer.test.ts
new file mode 100644
index 00000000..e3c909f5
--- /dev/null
+++ b/packages/agents/tests/unit/tool-schema-sanitizer.test.ts
@@ -0,0 +1,234 @@
+/**
+ * Unit tests for the tool-schema sanitizer (foreman-2aj0).
+ *
+ * Verifies — WITHOUT a live Anthropic or Zapier dependency — that:
+ *  1. Every object node in the model-facing schema ends up with
+ *     additionalProperties:false (the Anthropic tool-use requirement).
+ *  2. Open maps (z.record) are rewritten to JSON strings the model can fill.
+ *  3. execute transparently revives those strings back into the exact objects
+ *     the original handler / Zapier SDK expects (top-level + nested-in-array).
+ *  4. The revive is a no-op on non-string values (idempotent + safe for any
+ *     other consumer of a shared tool object).
+ */
+import { describe, expect, it, vi } from "vitest";
+import { z } from "zod";
+import { reviveDynamicInputs, sanitizeToolSchemas } from "@/lib/tool-schema-sanitizer";
+import { generateZapierTools } from "@/lib/zapier-sdk-tools";
+
+/** Pull the raw JSON Schema back out of an AI SDK Schema (jsonSchema()). */
+function rawSchema(tool: { inputSchema?: unknown }): Record<string, any> {
+  return (tool.inputSchema as any).jsonSchema as Record<string, any>;
+}
+
+/** Recursively assert every `type:"object"` node has additionalProperties:false. */
+function assertNoOpenObjects(node: any, pathLabel = "$"): void {
+  if (!node || typeof node !== "object") return;
+  if (Array.isArray(node)) {
+    for (let i = 0; i < node.length; i++) assertNoOpenObjects(node[i], `${pathLabel}[${i}]`);
+    return;
+  }
+  if (node.type === "object") {
+    expect(node.additionalProperties, `${pathLabel}.additionalProperties`).toBe(false);
+  }
+  for (const key of Object.keys(node)) assertNoOpenObjects(node[key], `${pathLabel}.${key}`);
+}
+
+/**
+ * Build a tool plus a separate reference to the original execute spy. After
+ * sanitize, `tool.execute` is the revive wrapper — assert on `spy` to see what
+ * the original handler actually received.
+ */
+function makeTool(inputSchema: z.ZodTypeAny) {
+  const spy = vi.fn((input: unknown) => input);
+  const tool: { id: string; inputSchema: z.ZodTypeAny; execute: (...a: any[]) => any } = {
+    id: "t",
+    inputSchema,
+    execute: spy,
+  };
+  return { tool, spy };
+}
+
+describe("sanitizeToolSchemas — schema rewrite", () => {
+  it("rewrites a top-level open-map (z.record) input to a JSON string", () => {
+    const { tool } = makeTool(
+      z.object({
+        app: z.string(),
+        action: z.string(),
+        inputs: z.record(z.string(), z.unknown()),
+      }),
+    );
+    sanitizeToolSchemas({ tool });
+    const js = rawSchema(tool);
+
+    expect(js.properties.inputs.type).toBe("string");
+    expect(js.properties.app.type).toBe("string");
+    expect(js.additionalProperties).toBe(false);
+    assertNoOpenObjects(js);
+  });
+
+  it("rewrites an open map nested inside an array (records[].data)", () => {
+    const { tool } = makeTool(
+      z.object({
+        table: z.string(),
+        records: z.array(z.object({ data: z.record(z.string(), z.unknown()) })),
+      }),
+    );
+    sanitizeToolSchemas({ tool });
+    const js = rawSchema(tool);
+
+    expect(js.properties.records.type).toBe("array");
+    expect(js.properties.records.items.properties.data.type).toBe("string");
+    expect(js.properties.records.items.additionalProperties).toBe(false);
+    assertNoOpenObjects(js);
+  });
+
+  it("closes a fixed-shape object with additionalProperties:false (no rewrite)", () => {
+    const { tool } = makeTool(z.object({ a: z.string(), b: z.number() }));
+    sanitizeToolSchemas({ tool });
+    const js = rawSchema(tool);
+
+    expect(js.additionalProperties).toBe(false);
+    expect(js.properties.a.type).toBe("string");
+    assertNoOpenObjects(js);
+  });
+
+  it("leaves a tool with an unresolvable schema untouched and never throws", () => {
+    const tool = { id: "x", inputSchema: undefined, execute: vi.fn() };
+    expect(() => sanitizeToolSchemas({ tool })).not.toThrow();
+  });
+
+  it("sets strict:false on the sanitized tool", () => {
+    const { tool } = makeTool(z.object({ a: z.string() }));
+    (tool as any).strict = true;
+    sanitizeToolSchemas({ tool });
+    expect((tool as any).strict).toBe(false);
+  });
+});
+
+describe("sanitizeToolSchemas — execute revive round-trip", () => {
+  it("parses a top-level JSON-string field back into the object the handler expects", async () => {
+    const { tool, spy } = makeTool(
+      z.object({ app: z.string(), inputs: z.record(z.string(), z.unknown()) }),
+    );
+    sanitizeToolSchemas({ tool });
+
+    await tool.execute({ app: "gmail", inputs: '{"to":"a@b.com","subject":"hi"}' });
+
+    expect(spy).toHaveBeenCalledTimes(1);
+    const received = spy.mock.calls[0][0] as any;
+    expect(received.inputs).toEqual({ to: "a@b.com", subject: "hi" });
+  });
+
+  it("revives open maps nested inside an array, element by element", async () => {
+    const { tool, spy } = makeTool(
+      z.object({
+        records: z.array(z.object({ data: z.record(z.string(), z.unknown()) })),
+      }),
+    );
+    sanitizeToolSchemas({ tool });
+
+    await tool.execute({
+      records: [{ data: '{"x":1}' }, { data: '{"y":2}' }],
+    });
+
+    const received = spy.mock.calls[0][0] as any;
+    expect(received.records[0].data).toEqual({ x: 1 });
+    expect(received.records[1].data).toEqual({ y: 2 });
+  });
+
+  it("passes non-string values straight through (idempotent / safe for other callers)", async () => {
+    const { tool, spy } = makeTool(z.object({ inputs: z.record(z.string(), z.unknown()) }));
+    sanitizeToolSchemas({ tool });
+
+    // Another agent that didn't get the string-schema still passes an object.
+    await tool.execute({ inputs: { already: "object" } });
+
+    const received = spy.mock.calls[0][0] as any;
+    expect(received.inputs).toEqual({ already: "object" });
+  });
+
+  it("drops an empty-string dynamic field rather than parsing it", async () => {
+    const { tool, spy } = makeTool(
+      z.object({ app: z.string(), inputs: z.record(z.string(), z.unknown()) }),
+    );
+    sanitizeToolSchemas({ tool });
+
+    await tool.execute({ app: "x", inputs: "   " });
+
+    const received = spy.mock.calls[0][0] as any;
+    expect("inputs" in received).toBe(false);
+  });
+
+  it("throws a clear error when the model supplies malformed JSON", async () => {
+    const { tool } = makeTool(z.object({ inputs: z.record(z.string(), z.unknown()) }));
+    sanitizeToolSchemas({ tool });
+
+    await expect(tool.execute({ inputs: "{not valid json" })).rejects.toThrow(
+      /must be a valid JSON object string/,
+    );
+  });
+
+  it("does not double-wrap execute when sanitized twice", async () => {
+    const { tool, spy } = makeTool(z.object({ inputs: z.record(z.string(), z.unknown()) }));
+    sanitizeToolSchemas({ tool });
+    sanitizeToolSchemas({ tool }); // second pass must be a no-op
+
+    await tool.execute({ inputs: '{"a":1}' });
+    const received = spy.mock.calls[0][0] as any;
+    // If double-wrapped, the second revive would try to JSON.parse an object and throw.
+    expect(received.inputs).toEqual({ a: 1 });
+  });
+});
+
+describe("real Foreman SDK tools are Anthropic-valid after sanitize (foreman-2aj0 regression guard)", () => {
+  // generateZapierTools() builds from the SDK's static registry — no creds,
+  // no network — so this runs in CI exactly like the existing zapier-sdk-tools
+  // suite. This is the keyless proof the Anthropic 400 is gone for the REAL
+  // always-loaded tools, and it would have caught the original regression.
+  const tools = generateZapierTools();
+
+  // The always-loaded tools the original bug report named (run-action poisons
+  // every turn because it's core). Some table tools may vary by SDK version.
+  const ALWAYS_LOADED_OFFENDERS = [
+    "run-action",
+    "get-action-input-fields-schema",
+    "list-action-input-field-choices",
+    "create-table-fields",
+    "create-table-records",
+    "update-table-records",
+  ];
+
+  it("generates the offender tools we expect to sanitize", () => {
+    expect(tools["run-action"], "run-action must exist (it is always loaded)").toBeDefined();
+    for (const name of ALWAYS_LOADED_OFFENDERS) {
+      if (tools[name]) expect(tools[name].inputSchema, `${name} inputSchema`).toBeDefined();
+    }
+  });
+
+  it("leaves no open object in ANY sanitized SDK tool schema", () => {
+    // Sanitize the entire generated set — Anthropic reports only the first
+    // offending tool per request, so a partial check could hide others.
+    sanitizeToolSchemas(tools);
+    for (const [name, tool] of Object.entries(tools)) {
+      assertNoOpenObjects(rawSchema(tool), name);
+    }
+  });
+
+  it("rewrites run-action's dynamic `inputs` field to a JSON string", () => {
+    sanitizeToolSchemas(tools); // idempotent — already sanitized above
+    const js = rawSchema(tools["run-action"]);
+    expect(js.properties.inputs.type).toBe("string");
+  });
+});
+
+describe("reviveDynamicInputs (direct)", () => {
+  it("handles top-level and nested-array paths together", () => {
+    const input: any = {
+      inputs: '{"k":"v"}',
+      records: [{ data: '{"n":1}' }],
+    };
+    reviveDynamicInputs(input, [["inputs"], ["records", "[]", "data"]]);
+    expect(input.inputs).toEqual({ k: "v" });
+    expect(input.records[0].data).toEqual({ n: 1 });
+  });
+});
diff --git a/packages/agents/tests/unit/trigger-inbox.test.ts b/packages/agents/tests/unit/trigger-inbox.test.ts
new file mode 100644
index 00000000..7a1dffe1
--- /dev/null
+++ b/packages/agents/tests/unit/trigger-inbox.test.ts
@@ -0,0 +1,138 @@
+/**
+ * Unit tests for the trigger-inbox layer (foreman-l7xq M1).
+ * Drives the functions against a fake experimental SDK — no network. The dedup
+ * test is the important one: at-least-once delivery means redeliveries, and
+ * dispatchLeased must not re-run a message the caller already processed.
+ */
+import { describe, expect, it, vi } from "vitest";
+import {
+  ackMessages,
+  dispatchLeased,
+  ensureInbox,
+  type Lease,
+  type LeasedMessage,
+  releaseMessages,
+} from "../../src/lib/trigger-inbox";
+import type { ExperimentalZapierSdk } from "../../src/lib/zapier/sdk";
+
+function fakeSdk(overrides: Record<string, unknown>): ExperimentalZapierSdk {
+  return overrides as unknown as ExperimentalZapierSdk;
+}
+
+function msg(id: string, attrs: Partial<LeasedMessage["message_attributes"]> = {}): LeasedMessage {
+  return {
+    id,
+    created_at: "2026-06-25T00:00:00Z",
+    status: "leased",
+    message_attributes: {
+      lease_count: 1,
+      error_message: null,
+      possible_duplicate_data: false,
+      ...attrs,
+    },
+    payload: { id },
+  };
+}
+
+describe("ensureInbox", () => {
+  it("passes the subscription through and returns the inbox record", async () => {
+    const sdk = fakeSdk({
+      ensureTriggerInbox: vi.fn(async () => ({
+        data: { id: "inbox_1", name: "n", status: "initializing", subscription: {} },
+      })),
+    });
+    const inbox = await ensureInbox({
+      sdk,
+      key: "github-issues",
+      app: "github",
+      action: "issue_v2",
+      connection: "123",
+      inputs: { repo: "hamchowderr/foreman" },
+    });
+    expect(inbox.id).toBe("inbox_1");
+    expect(sdk.ensureTriggerInbox).toHaveBeenCalledWith({
+      key: "github-issues",
+      app: "github",
+      action: "issue_v2",
+      connection: "123",
+      inputs: { repo: "hamchowderr/foreman" },
+      notificationUrl: undefined,
+    });
+  });
+
+  it("defaults a missing connection to null", async () => {
+    const sdk = fakeSdk({
+      ensureTriggerInbox: vi.fn(async () => ({ data: { id: "inbox_2" } })),
+    });
+    await ensureInbox({ sdk, key: "n", app: "a", action: "b" });
+    expect(
+      (sdk.ensureTriggerInbox as ReturnType<typeof vi.fn>).mock.calls[0][0].connection,
+    ).toBeNull();
+  });
+});
+
+describe("dispatchLeased — dedup", () => {
+  function lease(results: LeasedMessage[]): Lease {
+    return {
+      lease_id: "lease_1",
+      leased_until: "2026-06-25T00:05:00Z",
+      results,
+      inbox_attributes: { status: "active", paused_reason: null },
+    };
+  }
+
+  it("processes fresh messages, skips already-seen redeliveries, releases failures", async () => {
+    const seen = new Set(["m2"]);
+    const handled: string[] = [];
+
+    const result = await dispatchLeased({
+      lease: lease([msg("m1"), msg("m2", { lease_count: 2 }), msg("m3")]),
+      isAlreadyProcessed: (m) => seen.has(m.id),
+      handle: (m) => {
+        if (m.id === "m3") throw new Error("boom");
+        handled.push(m.id);
+      },
+    });
+
+    expect(result.processed).toEqual(["m1"]);
+    expect(result.skipped).toEqual(["m2"]); // redelivery already in the idempotency store
+    expect(result.failed).toEqual(["m3"]);
+    expect(handled).toEqual(["m1"]); // m2 never re-ran
+  });
+
+  it("processes everything when no idempotency store is supplied", async () => {
+    const result = await dispatchLeased({
+      lease: lease([msg("a"), msg("b")]),
+      handle: () => {},
+    });
+    expect(result.processed).toEqual(["a", "b"]);
+    expect(result.skipped).toEqual([]);
+    expect(result.failed).toEqual([]);
+  });
+});
+
+describe("ack / release", () => {
+  it("acks processed messages by lease", async () => {
+    const sdk = fakeSdk({
+      ackTriggerInboxMessages: vi.fn(async () => ({ data: { acked_id: "x", results: [] } })),
+    });
+    await ackMessages({ sdk, inbox: "inbox_1", lease: "lease_1", messages: ["m1"] });
+    expect(sdk.ackTriggerInboxMessages).toHaveBeenCalledWith({
+      inbox: "inbox_1",
+      lease: "lease_1",
+      messages: ["m1"],
+    });
+  });
+
+  it("releases failed messages for retry", async () => {
+    const sdk = fakeSdk({
+      releaseTriggerInboxMessages: vi.fn(async () => ({ data: { released_id: "x", results: [] } })),
+    });
+    await releaseMessages({ sdk, inbox: "inbox_1", lease: "lease_1", messages: ["m3"] });
+    expect(sdk.releaseTriggerInboxMessages).toHaveBeenCalledWith({
+      inbox: "inbox_1",
+      lease: "lease_1",
+      messages: ["m3"],
+    });
+  });
+});
diff --git a/packages/agents/tests/unit/vector-dimension-guard.test.ts b/packages/agents/tests/unit/vector-dimension-guard.test.ts
new file mode 100644
index 00000000..277ad521
--- /dev/null
+++ b/packages/agents/tests/unit/vector-dimension-guard.test.ts
@@ -0,0 +1,74 @@
+/**
+ * Unit tests for the vector-index dimension guard (foreman-hcim).
+ *
+ * ensureIndex must drop+recreate an index that exists at the wrong dimension
+ * (the 1536->384 embedder switch), and otherwise leave it untouched. Without
+ * this, 384-d upserts against a stale 1536-d index fail on any env where the
+ * index already existed.
+ */
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mockVector = {
+  listIndexes: vi.fn(),
+  describeIndex: vi.fn(),
+  deleteIndex: vi.fn(),
+  createIndex: vi.fn(),
+};
+
+vi.mock("@mastra/pg", () => ({
+  // A class (not an arrow fn — biome would rewrite that and break `new`) whose
+  // constructor returns our mock, so `new PgVector(...)` yields mockVector.
+  PgVector: class {
+    constructor() {
+      Object.assign(this, mockVector);
+    }
+  },
+}));
+vi.mock("@/lib/env", () => ({ getEnv: () => ({ DATABASE_URL: "postgres://test" }) }));
+
+import { ensureIndex } from "@/lib/rag";
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  mockVector.describeIndex.mockResolvedValue({ dimension: 384, count: 0, metric: "cosine" });
+  mockVector.deleteIndex.mockResolvedValue(undefined);
+  mockVector.createIndex.mockResolvedValue(undefined);
+});
+
+describe("ensureIndex — dimension guard", () => {
+  it("creates the index when it does not exist", async () => {
+    mockVector.listIndexes.mockResolvedValue([]);
+    await ensureIndex();
+    expect(mockVector.createIndex).toHaveBeenCalledWith(
+      expect.objectContaining({ indexName: "action_history", dimension: 384 }),
+    );
+    expect(mockVector.deleteIndex).not.toHaveBeenCalled();
+    expect(mockVector.describeIndex).not.toHaveBeenCalled();
+  });
+
+  it("leaves a correctly-dimensioned index untouched", async () => {
+    mockVector.listIndexes.mockResolvedValue(["action_history"]);
+    mockVector.describeIndex.mockResolvedValue({ dimension: 384, count: 5, metric: "cosine" });
+    await ensureIndex();
+    expect(mockVector.deleteIndex).not.toHaveBeenCalled();
+    expect(mockVector.createIndex).not.toHaveBeenCalled();
+  });
+
+  it("drops and recreates a stale 1536-d index at 384-d", async () => {
+    mockVector.listIndexes.mockResolvedValue(["action_history"]);
+    mockVector.describeIndex.mockResolvedValue({ dimension: 1536, count: 9, metric: "cosine" });
+    await ensureIndex();
+    expect(mockVector.deleteIndex).toHaveBeenCalledWith({ indexName: "action_history" });
+    expect(mockVector.createIndex).toHaveBeenCalledWith(
+      expect.objectContaining({ indexName: "action_history", dimension: 384 }),
+    );
+  });
+
+  it("leaves the index untouched when its dimension can't be read", async () => {
+    mockVector.listIndexes.mockResolvedValue(["action_history"]);
+    mockVector.describeIndex.mockRejectedValue(new Error("describe failed"));
+    await ensureIndex();
+    expect(mockVector.deleteIndex).not.toHaveBeenCalled();
+    expect(mockVector.createIndex).not.toHaveBeenCalled();
+  });
+});
diff --git a/packages/agents/tests/unit/workflow-engine.test.ts b/packages/agents/tests/unit/workflow-engine.test.ts
deleted file mode 100644
index edc84e7d..00000000
--- a/packages/agents/tests/unit/workflow-engine.test.ts
+++ /dev/null
@@ -1,130 +0,0 @@
-/**
- * Unit tests for executeWorkflow's run-state lifecycle (foreman-2afc): a run row
- * must never get stuck in 'running' — not on step failure, and not when the
- * caller abandons the generator mid-stream. runAction is mocked.
- */
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-let stepsResult: { data: unknown[] | null; error: unknown } = { data: [], error: null };
-const updates: { table: string; payload: any }[] = [];
-const inserts: { table: string; payload: any }[] = [];
-
-function createChain(table: string) {
-  const b: any = {};
-  for (const m of ["select", "eq", "order", "insert", "update"]) {
-    b[m] = vi.fn().mockReturnValue(b);
-  }
-  // biome-ignore lint/suspicious/noThenProperty: thenable mock
-  b.then = (resolve: any) => {
-    if (b._verb === "insert") return resolve({ error: null });
-    if (b._verb === "update") return resolve({ error: null });
-    if (table === "workflow_step") return resolve(stepsResult);
-    return resolve({ data: null, error: null });
-  };
-  const oi = b.insert;
-  b.insert = vi.fn((p: any) => {
-    b._verb = "insert";
-    inserts.push({ table, payload: p });
-    return oi(p);
-  });
-  const ou = b.update;
-  b.update = vi.fn((p: any) => {
-    b._verb = "update";
-    updates.push({ table, payload: p });
-    return ou(p);
-  });
-  return b;
-}
-
-const mockSupabase = { from: vi.fn((t: string) => createChain(t)) };
-vi.mock("@/lib/db", () => ({ getSupabase: () => mockSupabase }));
-
-const mockRunAction = vi.fn();
-vi.mock("@/lib/zapier/execution", () => ({
-  runAction: (...args: unknown[]) => mockRunAction(...args),
-}));
-
-const oneStep = [
-  {
-    id: "s-1",
-    proposal_template: JSON.stringify({
-      humanLabel: "Send",
-      inputs: {},
-      appKey: "gmail",
-      actionType: "write",
-      actionKey: "send_email",
-    }),
-  },
-];
-
-const statuses = () =>
-  updates.filter((u) => u.table === "workflow_run").map((u) => u.payload.status);
-const lastRunUpdate = () => [...updates].reverse().find((u) => u.table === "workflow_run")?.payload;
-const runInsert = () => inserts.find((i) => i.table === "workflow_run")?.payload;
-
-describe("executeWorkflow run-state", () => {
-  beforeEach(() => {
-    vi.resetAllMocks();
-    stepsResult = { data: oneStep, error: null };
-    updates.length = 0;
-    inserts.length = 0;
-  });
-
-  it("marks the run failed with the error_message when a step throws", async () => {
-    mockRunAction.mockRejectedValue(new Error("boom"));
-    const { executeWorkflow } = await import("@/lib/workflows/engine");
-
-    const events: string[] = [];
-    for await (const ev of executeWorkflow("wf-1", "user-1", {})) events.push(ev.type);
-
-    expect(statuses()).toEqual(["failed"]); // exactly one terminal write, not stuck
-    expect(lastRunUpdate()?.error_message).toBe("boom");
-    expect(events).toContain("error");
-  });
-
-  it("marks the run success when all steps complete", async () => {
-    mockRunAction.mockResolvedValue({ ok: true });
-    const { executeWorkflow } = await import("@/lib/workflows/engine");
-
-    for await (const ev of executeWorkflow("wf-1", "user-1", {})) void ev;
-
-    // success terminal write, and the finally must NOT add a spurious 'failed'
-    expect(statuses()).toEqual(["success"]);
-  });
-
-  it("marks the run failed (with a reason) when the caller abandons the generator", async () => {
-    // runAction would hang, but the caller breaks before it's reached.
-    mockRunAction.mockReturnValue(new Promise(() => {}));
-    const { executeWorkflow } = await import("@/lib/workflows/engine");
-
-    for await (const ev of executeWorkflow("wf-1", "user-1", {})) {
-      if (ev.type === "status") break; // abandon — triggers the generator's finally
-    }
-
-    expect(statuses()).toEqual(["failed"]); // finally rescued the orphaned run
-    expect(lastRunUpdate()?.error_message).toMatch(/did not complete/);
-  });
-
-  it("defaults fired_by='manual' with no trigger id", async () => {
-    mockRunAction.mockResolvedValue({ ok: true });
-    const { executeWorkflow } = await import("@/lib/workflows/engine");
-
-    for await (const ev of executeWorkflow("wf-1", "user-1", {})) void ev;
-
-    expect(runInsert()).toMatchObject({ fired_by: "manual", trigger_id: null });
-  });
-
-  it("records the trigger context on the run row when fired by a trigger", async () => {
-    mockRunAction.mockResolvedValue({ ok: true });
-    const { executeWorkflow } = await import("@/lib/workflows/engine");
-
-    for await (const ev of executeWorkflow("wf-1", "user-1", {}, undefined, {
-      firedBy: "cron",
-      triggerId: "trig-9",
-    })) {
-      void ev;
-    }
-
-    expect(runInsert()).toMatchObject({ fired_by: "cron", trigger_id: "trig-9" });
-  });
-});
diff --git a/packages/agents/tests/unit/workflow-tools-rud.test.ts b/packages/agents/tests/unit/workflow-tools-rud.test.ts
deleted file mode 100644
index 259a0258..00000000
--- a/packages/agents/tests/unit/workflow-tools-rud.test.ts
+++ /dev/null
@@ -1,226 +0,0 @@
-/**
- * Unit tests for run_workflow / update_workflow / delete_workflow.
- *
- * Same shape as workflow-tools.test.ts: mock Supabase + the workflow engine,
- * then call tool.execute(input, { requestContext }) and assert on shape.
- */
-import { RequestContext } from "@mastra/core/request-context";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-// ─── Supabase mock ───────────────────────────────────────────────────────────
-
-type Result<T> = { data: T; error: { message: string } | null };
-let nextSelectResult: Result<unknown> = { data: null, error: null };
-let nextUpdateResult: Result<unknown> = { data: null, error: null };
-let nextDeleteResult: Result<unknown> = { data: null, error: null };
-
-function createChain(_table: string) {
-  const builder: any = {};
-  for (const m of ["select", "eq", "limit", "update", "delete"]) {
-    builder[m] = vi.fn().mockReturnValue(builder);
-  }
-  builder.maybeSingle = vi.fn().mockImplementation(() => Promise.resolve(nextSelectResult));
-  // biome-ignore lint/suspicious/noThenProperty: deliberate — mock makes the Supabase query builder thenable so tests can `await builder`
-  builder.then = (resolve: any) => {
-    // The builder may have entered "delete" or "update" state — choose result accordingly.
-    // We pick by inspecting which mock was last invoked. Simple: track last verb.
-    if (builder._lastVerb === "delete") return resolve(nextDeleteResult);
-    if (builder._lastVerb === "update") return resolve(nextUpdateResult);
-    return resolve(nextSelectResult);
-  };
-  // Wrap update / delete to remember the last verb so .then resolves with the right result.
-  for (const verb of ["update", "delete"] as const) {
-    const orig = builder[verb];
-    builder[verb] = vi.fn((...args: unknown[]) => {
-      builder._lastVerb = verb;
-      return orig(...args);
-    });
-  }
-  return builder;
-}
-
-const mockSupabase = {
-  from: vi.fn((table: string) => createChain(table)),
-};
-
-vi.mock("@/lib/db", () => ({
-  getSupabase: () => mockSupabase,
-}));
-
-// ─── executeWorkflow mock — run_workflow drains its yields ───────────────────
-
-const mockExecuteWorkflow = vi.fn();
-vi.mock("@/lib/workflows/engine", () => ({
-  executeWorkflow: (...args: unknown[]) => mockExecuteWorkflow(...args),
-}));
-
-// ─── Helpers ─────────────────────────────────────────────────────────────────
-
-function ctx({ userId }: { userId?: string }) {
-  const entries: [string, string][] = [];
-  if (userId) entries.push(["userId", userId]);
-  return { requestContext: new RequestContext(entries) } as any;
-}
-
-async function* gen(events: unknown[]): AsyncGenerator<any> {
-  for (const e of events) yield e;
-}
-
-// ─── run_workflow ────────────────────────────────────────────────────────────
-
-describe("run_workflow tool", () => {
-  beforeEach(() => {
-    vi.resetAllMocks();
-    mockExecuteWorkflow.mockReset();
-  });
-
-  it("aggregates a successful run into a summary", async () => {
-    mockExecuteWorkflow.mockReturnValue(
-      gen([
-        { type: "status", runId: "run-1", status: "running" },
-        { type: "step", runId: "run-1", stepIndex: 0, status: "succeeded" },
-        { type: "step", runId: "run-1", stepIndex: 1, status: "succeeded" },
-        { type: "complete", runId: "run-1", status: "success" },
-      ]),
-    );
-
-    const { runWorkflowTool } = await import("@/mastra/tools/run-workflow");
-    const out = await runWorkflowTool.execute!(
-      { workflowId: "wf-1", inputs: {} } as any,
-      ctx({ userId: "user-1" }),
-    );
-
-    expect(out).toMatchObject({ runId: "run-1", status: "success", stepsRun: 2, stepsFailed: 0 });
-    expect(mockExecuteWorkflow).toHaveBeenCalledWith("wf-1", "user-1", {});
-  });
-
-  it("returns param_request when the engine emits one", async () => {
-    mockExecuteWorkflow.mockReturnValue(
-      gen([{ type: "param_request", missing: ["recipient_email"] }]),
-    );
-
-    const { runWorkflowTool } = await import("@/mastra/tools/run-workflow");
-    const out = await runWorkflowTool.execute!(
-      { workflowId: "wf-1", inputs: {} } as any,
-      ctx({ userId: "user-1" }),
-    );
-
-    expect(out.status).toBe("param_request");
-    expect(out.missingParams).toEqual(["recipient_email"]);
-  });
-
-  it("forwards inputs to the engine", async () => {
-    mockExecuteWorkflow.mockReturnValue(gen([{ type: "complete", runId: "run-1" }]));
-
-    const { runWorkflowTool } = await import("@/mastra/tools/run-workflow");
-    await runWorkflowTool.execute!(
-      { workflowId: "wf-1", inputs: { recipient_email: "a@b.com" } } as any,
-      ctx({ userId: "user-1" }),
-    );
-
-    expect(mockExecuteWorkflow).toHaveBeenCalledWith("wf-1", "user-1", {
-      recipient_email: "a@b.com",
-    });
-  });
-
-  it("throws when userId is missing", async () => {
-    const { runWorkflowTool } = await import("@/mastra/tools/run-workflow");
-    await expect(
-      runWorkflowTool.execute!({ workflowId: "wf-1", inputs: {} } as any, ctx({})),
-    ).rejects.toThrow(/userId/);
-  });
-});
-
-// ─── update_workflow ─────────────────────────────────────────────────────────
-
-describe("update_workflow tool", () => {
-  beforeEach(() => {
-    vi.resetAllMocks();
-    nextSelectResult = { data: null, error: null };
-    nextUpdateResult = { data: null, error: null };
-  });
-
-  it("renames a workflow", async () => {
-    nextSelectResult = {
-      data: { id: "wf-1", name: "Old name", is_template: false },
-      error: null,
-    };
-    nextUpdateResult = { data: null, error: null };
-
-    const { updateWorkflowTool } = await import("@/mastra/tools/update-workflow");
-    const out = await updateWorkflowTool.execute!(
-      { workflowId: "wf-1", name: "New name" } as any,
-      ctx({ userId: "user-1" }),
-    );
-
-    expect(out.id).toBe("wf-1");
-    expect(out.name).toBe("New name");
-    expect(out.isTemplate).toBe(false);
-  });
-
-  it("publishes as a template", async () => {
-    nextSelectResult = {
-      data: { id: "wf-1", name: "Daily standup", is_template: false },
-      error: null,
-    };
-    nextUpdateResult = { data: null, error: null };
-
-    const { updateWorkflowTool } = await import("@/mastra/tools/update-workflow");
-    const out = await updateWorkflowTool.execute!(
-      { workflowId: "wf-1", isTemplate: true } as any,
-      ctx({ userId: "user-1" }),
-    );
-
-    expect(out.isTemplate).toBe(true);
-    expect(out.name).toBe("Daily standup"); // unchanged
-  });
-
-  it("requires at least one field", async () => {
-    const { updateWorkflowTool } = await import("@/mastra/tools/update-workflow");
-    await expect(
-      updateWorkflowTool.execute!({ workflowId: "wf-1" } as any, ctx({ userId: "u" })),
-    ).rejects.toThrow(/at least one of/);
-  });
-
-  it("throws when workflow not found", async () => {
-    nextSelectResult = { data: null, error: null };
-    const { updateWorkflowTool } = await import("@/mastra/tools/update-workflow");
-    await expect(
-      updateWorkflowTool.execute!(
-        { workflowId: "missing", name: "x" } as any,
-        ctx({ userId: "u" }),
-      ),
-    ).rejects.toThrow(/not found/);
-  });
-});
-
-// ─── delete_workflow ─────────────────────────────────────────────────────────
-
-describe("delete_workflow tool", () => {
-  beforeEach(() => {
-    vi.resetAllMocks();
-    nextSelectResult = { data: null, error: null };
-    nextDeleteResult = { data: null, error: null };
-  });
-
-  it("deletes when the workflow exists", async () => {
-    nextSelectResult = { data: { id: "wf-1" }, error: null };
-    nextDeleteResult = { data: null, error: null };
-
-    const { deleteWorkflowTool } = await import("@/mastra/tools/delete-workflow");
-    const out = await deleteWorkflowTool.execute!(
-      { workflowId: "wf-1" } as any,
-      ctx({ userId: "user-1" }),
-    );
-
-    expect(out).toEqual({ id: "wf-1", deleted: true });
-  });
-
-  it("throws when workflow not found", async () => {
-    nextSelectResult = { data: null, error: null };
-    const { deleteWorkflowTool } = await import("@/mastra/tools/delete-workflow");
-    await expect(
-      deleteWorkflowTool.execute!({ workflowId: "missing" } as any, ctx({ userId: "u" })),
-    ).rejects.toThrow(/not found/);
-  });
-});
diff --git a/packages/agents/tests/unit/workflow-tools.test.ts b/packages/agents/tests/unit/workflow-tools.test.ts
deleted file mode 100644
index da45988b..00000000
--- a/packages/agents/tests/unit/workflow-tools.test.ts
+++ /dev/null
@@ -1,217 +0,0 @@
-/**
- * Unit tests for the save_workflow / list_workflows / get_workflow agent tools.
- *
- * Each tool is verified at the boundary it actually has — they read userId +
- * threadId from the RequestContext, then either delegate to
- * saveWorkflowFromConversation (save) or query Supabase directly (list, get).
- */
-import { RequestContext } from "@mastra/core/request-context";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-// ─── Supabase mock ───────────────────────────────────────────────────────────
-
-type Result<T> = { data: T; error: { message: string } | null };
-let nextSelectResult: Result<unknown> = { data: null, error: null };
-let nextStepsResult: Result<unknown> = { data: [], error: null };
-
-function createChain(table: string) {
-  const builder: any = {};
-  for (const m of ["select", "eq", "order", "limit"]) {
-    builder[m] = vi.fn().mockReturnValue(builder);
-  }
-  builder.maybeSingle = vi.fn().mockImplementation(() => Promise.resolve(nextSelectResult));
-  // biome-ignore lint/suspicious/noThenProperty: deliberate — mock makes the Supabase query builder thenable so tests can `await builder`
-  builder.then = (resolve: any) => {
-    // workflow_step queries return the steps fixture; everything else returns the main fixture
-    resolve(table === "workflow_step" ? nextStepsResult : nextSelectResult);
-  };
-  return builder;
-}
-
-const mockSupabase = {
-  from: vi.fn((table: string) => createChain(table)),
-};
-
-vi.mock("@/lib/db", () => ({
-  getSupabase: () => mockSupabase,
-}));
-
-// ─── saveWorkflowFromConversation mock — save_workflow delegates to it ───────
-
-const mockSaveFromConv = vi.fn();
-vi.mock("@/lib/workflows/save", () => ({
-  saveWorkflowFromConversation: (...args: unknown[]) => mockSaveFromConv(...args),
-}));
-
-// ─── Helpers ─────────────────────────────────────────────────────────────────
-
-function ctx({ userId, threadId }: { userId?: string; threadId?: string }) {
-  const entries: [string, string][] = [];
-  if (userId) entries.push(["userId", userId]);
-  if (threadId) entries.push(["threadId", threadId]);
-  return { requestContext: new RequestContext(entries) } as any;
-}
-
-// ─── Tests ───────────────────────────────────────────────────────────────────
-
-describe("save_workflow tool", () => {
-  beforeEach(() => {
-    vi.resetAllMocks();
-    mockSaveFromConv.mockReset();
-  });
-
-  it("delegates to saveWorkflowFromConversation with userId + threadId from request context", async () => {
-    mockSaveFromConv.mockResolvedValue({
-      workflowId: "wf-123",
-      steps: 2,
-      parameters: ["recipient_email"],
-    });
-
-    const { saveWorkflowTool } = await import("@/mastra/tools/save-workflow");
-    const out = await saveWorkflowTool.execute!(
-      { name: "Test workflow" } as any,
-      ctx({ userId: "user-1", threadId: "conv-9" }),
-    );
-
-    expect(mockSaveFromConv).toHaveBeenCalledWith("conv-9", "user-1", "Test workflow");
-    expect(out).toEqual({
-      workflowId: "wf-123",
-      steps: 2,
-      parameters: ["recipient_email"],
-    });
-  });
-
-  it("throws when userId is missing", async () => {
-    const { saveWorkflowTool } = await import("@/mastra/tools/save-workflow");
-    await expect(
-      saveWorkflowTool.execute!({ name: "x" } as any, ctx({ threadId: "conv-9" })),
-    ).rejects.toThrow(/userId/);
-  });
-
-  it("throws when conversation thread id is missing", async () => {
-    const { saveWorkflowTool } = await import("@/mastra/tools/save-workflow");
-    await expect(
-      saveWorkflowTool.execute!({ name: "x" } as any, ctx({ userId: "u" })),
-    ).rejects.toThrow(/conversation thread id/);
-  });
-});
-
-describe("list_workflows tool", () => {
-  beforeEach(() => {
-    vi.resetAllMocks();
-    nextSelectResult = { data: [], error: null };
-  });
-
-  it("returns the user's workflows shaped for the model", async () => {
-    nextSelectResult = {
-      data: [
-        {
-          id: "wf-a",
-          name: "Daily standup",
-          parameters: '["recipient"]',
-          updated_at: "2026-05-10T10:00:00Z",
-        },
-        {
-          id: "wf-b",
-          name: "Invoice notify",
-          parameters: "[]",
-          updated_at: "2026-05-09T10:00:00Z",
-        },
-      ],
-      error: null,
-    };
-
-    const { listWorkflowsTool } = await import("@/mastra/tools/list-workflows");
-    const out = await listWorkflowsTool.execute!({ limit: 20 } as any, ctx({ userId: "user-1" }));
-
-    expect(out.workflows).toEqual([
-      {
-        id: "wf-a",
-        name: "Daily standup",
-        parameters: ["recipient"],
-        updatedAt: "2026-05-10T10:00:00Z",
-      },
-      {
-        id: "wf-b",
-        name: "Invoice notify",
-        parameters: [],
-        updatedAt: "2026-05-09T10:00:00Z",
-      },
-    ]);
-  });
-
-  it("returns empty list when the user has none", async () => {
-    nextSelectResult = { data: [], error: null };
-    const { listWorkflowsTool } = await import("@/mastra/tools/list-workflows");
-    const out = await listWorkflowsTool.execute!({ limit: 20 } as any, ctx({ userId: "user-1" }));
-    expect(out.workflows).toEqual([]);
-  });
-
-  it("throws on Supabase error", async () => {
-    nextSelectResult = { data: null, error: { message: "boom" } };
-    const { listWorkflowsTool } = await import("@/mastra/tools/list-workflows");
-    await expect(
-      listWorkflowsTool.execute!({ limit: 20 } as any, ctx({ userId: "u" })),
-    ).rejects.toThrow(/boom/);
-  });
-});
-
-describe("get_workflow tool", () => {
-  beforeEach(() => {
-    vi.resetAllMocks();
-    nextSelectResult = { data: null, error: null };
-    nextStepsResult = { data: [], error: null };
-  });
-
-  it("returns workflow with parsed steps", async () => {
-    nextSelectResult = {
-      data: {
-        id: "wf-1",
-        name: "Daily standup",
-        parameters: '["recipient_email"]',
-        created_at: "2026-05-10T09:00:00Z",
-        updated_at: "2026-05-10T10:00:00Z",
-      },
-      error: null,
-    };
-    nextStepsResult = {
-      data: [
-        {
-          order: 0,
-          proposal_template: JSON.stringify({
-            appKey: "slack",
-            actionType: "write",
-            actionKey: "send_message",
-            humanLabel: "Post to #ops",
-            inputs: { channel: "#ops", text: "standup in 5" },
-          }),
-        },
-      ],
-      error: null,
-    };
-
-    const { getWorkflowTool } = await import("@/mastra/tools/get-workflow");
-    const out = await getWorkflowTool.execute!(
-      { workflowId: "wf-1" } as any,
-      ctx({ userId: "user-1" }),
-    );
-
-    expect(out.id).toBe("wf-1");
-    expect(out.parameters).toEqual(["recipient_email"]);
-    expect(out.steps).toHaveLength(1);
-    expect(out.steps[0]).toMatchObject({
-      order: 0,
-      appKey: "slack",
-      actionKey: "send_message",
-      inputs: { channel: "#ops", text: "standup in 5" },
-    });
-  });
-
-  it("throws when workflow not found", async () => {
-    nextSelectResult = { data: null, error: null };
-    const { getWorkflowTool } = await import("@/mastra/tools/get-workflow");
-    await expect(
-      getWorkflowTool.execute!({ workflowId: "missing" } as any, ctx({ userId: "u" })),
-    ).rejects.toThrow(/not found/);
-  });
-});
diff --git a/packages/agents/tests/unit/workflow-triggers.test.ts b/packages/agents/tests/unit/workflow-triggers.test.ts
deleted file mode 100644
index 857bdab8..00000000
--- a/packages/agents/tests/unit/workflow-triggers.test.ts
+++ /dev/null
@@ -1,228 +0,0 @@
-/**
- * Unit tests for attach_trigger / list_workflow_triggers / detach_trigger.
- *
- * Same shape as workflow-tools-rud.test.ts: mock Supabase via a thenable
- * builder, then call tool.execute(input, { requestContext }) and assert.
- */
-import { RequestContext } from "@mastra/core/request-context";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-type Result<T> = { data: T; error: { message: string } | null };
-let nextSelectResult: Result<unknown> = { data: null, error: null };
-let nextListResult: Result<unknown[]> = { data: [], error: null };
-let nextInsertResult: Result<unknown> = { data: null, error: null };
-let nextDeleteResult: Result<unknown> = { data: null, error: null };
-
-let lastInsertPayload: any = null;
-
-function createChain(_table: string) {
-  const builder: any = {};
-  for (const m of ["select", "eq", "limit", "insert", "delete", "order"]) {
-    builder[m] = vi.fn().mockReturnValue(builder);
-  }
-  builder.maybeSingle = vi.fn().mockImplementation(() => Promise.resolve(nextSelectResult));
-  // biome-ignore lint/suspicious/noThenProperty: thenable mock for await chains
-  builder.then = (resolve: any) => {
-    if (builder._lastVerb === "delete") return resolve(nextDeleteResult);
-    if (builder._lastVerb === "insert") return resolve(nextInsertResult);
-    if (builder._lastVerb === "list") return resolve(nextListResult);
-    return resolve(nextSelectResult);
-  };
-  const origInsert = builder.insert;
-  builder.insert = vi.fn((payload: unknown) => {
-    builder._lastVerb = "insert";
-    lastInsertPayload = payload;
-    return origInsert(payload);
-  });
-  const origDelete = builder.delete;
-  builder.delete = vi.fn((...args: unknown[]) => {
-    builder._lastVerb = "delete";
-    return origDelete(...args);
-  });
-  const origOrder = builder.order;
-  builder.order = vi.fn((...args: unknown[]) => {
-    builder._lastVerb = "list";
-    return origOrder(...args);
-  });
-  return builder;
-}
-
-const mockSupabase = {
-  from: vi.fn((table: string) => createChain(table)),
-};
-
-vi.mock("@/lib/db", () => ({
-  getSupabase: () => mockSupabase,
-}));
-
-function ctx({ userId }: { userId?: string }) {
-  const entries: [string, string][] = [];
-  if (userId) entries.push(["userId", userId]);
-  return { requestContext: new RequestContext(entries) } as any;
-}
-
-describe("attach_trigger tool", () => {
-  beforeEach(() => {
-    vi.resetAllMocks();
-    nextSelectResult = { data: null, error: null };
-    nextInsertResult = { data: null, error: null };
-    lastInsertPayload = null;
-  });
-
-  it("attaches a cron trigger", async () => {
-    nextSelectResult = { data: { id: "wf-1" }, error: null };
-    const { attachTriggerTool } = await import("@/mastra/tools/attach-trigger");
-    const out = await attachTriggerTool.execute!(
-      {
-        workflowId: "wf-1",
-        type: "cron",
-        cron: { schedule: "0 9 * * 1-5" },
-      } as any,
-      ctx({ userId: "user-1" }),
-    );
-
-    expect(out.type).toBe("cron");
-    expect(out.enabled).toBe(true);
-    expect(lastInsertPayload).toMatchObject({
-      workflow_id: "wf-1",
-      type: "cron",
-    });
-    expect(JSON.parse(lastInsertPayload.config)).toEqual({ schedule: "0 9 * * 1-5" });
-  });
-
-  it("attaches a channel trigger", async () => {
-    nextSelectResult = { data: { id: "wf-1" }, error: null };
-    const { attachTriggerTool } = await import("@/mastra/tools/attach-trigger");
-    const out = await attachTriggerTool.execute!(
-      {
-        workflowId: "wf-1",
-        type: "channel",
-        channel: { channel: "slack", match: { command: "!standup" } },
-      } as any,
-      ctx({ userId: "user-1" }),
-    );
-
-    expect(out.type).toBe("channel");
-    expect(JSON.parse(lastInsertPayload.config)).toMatchObject({
-      channel: "slack",
-      match: { command: "!standup" },
-    });
-  });
-
-  it("throws when matching config field is missing", async () => {
-    nextSelectResult = { data: { id: "wf-1" }, error: null };
-    const { attachTriggerTool } = await import("@/mastra/tools/attach-trigger");
-    await expect(
-      attachTriggerTool.execute!(
-        { workflowId: "wf-1", type: "cron" } as any,
-        ctx({ userId: "user-1" }),
-      ),
-    ).rejects.toThrow(/requires the matching/);
-  });
-
-  it("throws when workflow not found", async () => {
-    nextSelectResult = { data: null, error: null };
-    const { attachTriggerTool } = await import("@/mastra/tools/attach-trigger");
-    await expect(
-      attachTriggerTool.execute!(
-        {
-          workflowId: "missing",
-          type: "cron",
-          cron: { schedule: "0 * * * *" },
-        } as any,
-        ctx({ userId: "user-1" }),
-      ),
-    ).rejects.toThrow(/not found/);
-  });
-
-  it("throws when userId is missing", async () => {
-    const { attachTriggerTool } = await import("@/mastra/tools/attach-trigger");
-    await expect(
-      attachTriggerTool.execute!(
-        { workflowId: "wf-1", type: "cron", cron: { schedule: "0 * * * *" } } as any,
-        ctx({}),
-      ),
-    ).rejects.toThrow(/userId/);
-  });
-});
-
-describe("list_workflow_triggers tool", () => {
-  beforeEach(() => {
-    vi.resetAllMocks();
-    nextSelectResult = { data: null, error: null };
-    nextListResult = { data: [], error: null };
-  });
-
-  it("lists triggers for a workflow", async () => {
-    nextSelectResult = { data: { id: "wf-1" }, error: null };
-    nextListResult = {
-      data: [
-        {
-          id: "trig-1",
-          type: "cron",
-          enabled: true,
-          config: JSON.stringify({ schedule: "0 9 * * 1-5" }),
-          last_fired_at: null,
-        },
-      ],
-      error: null,
-    };
-
-    const { listWorkflowTriggersTool } = await import("@/mastra/tools/list-workflow-triggers");
-    const out = (await listWorkflowTriggersTool.execute!(
-      { workflowId: "wf-1" } as any,
-      ctx({ userId: "user-1" }),
-    )) as { triggers: any[] };
-
-    expect(out.triggers).toHaveLength(1);
-    expect(out.triggers[0]).toMatchObject({
-      id: "trig-1",
-      type: "cron",
-      enabled: true,
-      lastFiredAt: null,
-    });
-    expect(out.triggers[0].config).toEqual({ schedule: "0 9 * * 1-5" });
-  });
-
-  it("throws when workflow not found", async () => {
-    nextSelectResult = { data: null, error: null };
-    const { listWorkflowTriggersTool } = await import("@/mastra/tools/list-workflow-triggers");
-    await expect(
-      listWorkflowTriggersTool.execute!(
-        { workflowId: "missing" } as any,
-        ctx({ userId: "user-1" }),
-      ),
-    ).rejects.toThrow(/not found/);
-  });
-});
-
-describe("detach_trigger tool", () => {
-  beforeEach(() => {
-    vi.resetAllMocks();
-    nextSelectResult = { data: null, error: null };
-    nextDeleteResult = { data: null, error: null };
-  });
-
-  it("deletes when workflow + trigger exist", async () => {
-    nextSelectResult = { data: { id: "wf-1" }, error: null };
-    nextDeleteResult = { data: null, error: null };
-
-    const { detachTriggerTool } = await import("@/mastra/tools/detach-trigger");
-    const out = await detachTriggerTool.execute!(
-      { workflowId: "wf-1", triggerId: "trig-1" } as any,
-      ctx({ userId: "user-1" }),
-    );
-    expect(out).toEqual({ deleted: true });
-  });
-
-  it("throws when workflow not found", async () => {
-    nextSelectResult = { data: null, error: null };
-    const { detachTriggerTool } = await import("@/mastra/tools/detach-trigger");
-    await expect(
-      detachTriggerTool.execute!(
-        { workflowId: "missing", triggerId: "trig-1" } as any,
-        ctx({ userId: "user-1" }),
-      ),
-    ).rejects.toThrow(/not found/);
-  });
-});
diff --git a/packages/agents/tests/unit/zapier-deprecation.test.ts b/packages/agents/tests/unit/zapier-deprecation.test.ts
new file mode 100644
index 00000000..592157b5
--- /dev/null
+++ b/packages/agents/tests/unit/zapier-deprecation.test.ts
@@ -0,0 +1,59 @@
+/**
+ * Unit tests for the Zapier SDK deprecation-notice relay (SDK >= 0.79).
+ * Verifies the onEvent handler logs deprecation notices once per id, ignores
+ * non-deprecation events, and records them for later surfacing.
+ */
+import { DEPRECATION_NOTICE_EVENT } from "@zapier/zapier-sdk";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  __resetZapierDeprecations,
+  getZapierDeprecations,
+  onZapierSdkEvent,
+} from "@/lib/zapier/deprecation";
+
+let warnSpy: ReturnType<typeof vi.spyOn>;
+
+beforeEach(() => {
+  __resetZapierDeprecations();
+  warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+});
+afterEach(() => warnSpy.mockRestore());
+
+describe("onZapierSdkEvent — deprecation relay", () => {
+  it("logs and records a deprecation notice", () => {
+    onZapierSdkEvent({
+      type: DEPRECATION_NOTICE_EVENT,
+      payload: { id: "n1", message: "runDurable is deprecated" },
+    });
+
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+    expect(warnSpy.mock.calls[0][0]).toContain("[zapier:deprecation]");
+    expect(warnSpy.mock.calls[0][0]).toContain("runDurable is deprecated");
+    expect(getZapierDeprecations()).toHaveLength(1);
+  });
+
+  it("logs each notice id at most once per process", () => {
+    const ev = { type: DEPRECATION_NOTICE_EVENT, payload: { id: "n1", message: "x" } };
+    onZapierSdkEvent(ev);
+    onZapierSdkEvent(ev);
+
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+    expect(getZapierDeprecations()).toHaveLength(1);
+  });
+
+  it("includes the RFC-9745 deprecation date when present", () => {
+    onZapierSdkEvent({
+      type: DEPRECATION_NOTICE_EVENT,
+      payload: { id: "n2", message: "going away", deprecation: 1782400000000 },
+    });
+    expect(warnSpy.mock.calls[0][0]).toContain("deprecated 2026-");
+  });
+
+  it("ignores non-deprecation events and payloads without an id", () => {
+    onZapierSdkEvent({ type: "api_request", payload: { url: "/x" } });
+    onZapierSdkEvent({ type: DEPRECATION_NOTICE_EVENT, payload: { message: "no id" } as any });
+
+    expect(warnSpy).not.toHaveBeenCalled();
+    expect(getZapierDeprecations()).toHaveLength(0);
+  });
+});
diff --git a/packages/agents/tests/unit/zapier-poll-provider.test.ts b/packages/agents/tests/unit/zapier-poll-provider.test.ts
deleted file mode 100644
index e6cfcd45..00000000
--- a/packages/agents/tests/unit/zapier-poll-provider.test.ts
+++ /dev/null
@@ -1,214 +0,0 @@
-/**
- * Unit tests for the ZapierPollSignalProvider — baseline, diff-by-dedupeKey,
- * cursor advance, the interval gate, and the notify() wiring (native dedupeKey
- * into the owner's thread). No network: runAction + executeWorkflow are mocked,
- * and notify() goes to a stub agent.
- */
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-// ─── Supabase + engine + zapier mocks ────────────────────────────────────────
-
-type Result<T> = { data: T; error: { message: string } | null };
-let triggerListResult: Result<unknown[]> = { data: [], error: null };
-let workflowSelectResult: Result<unknown> = { data: null, error: null };
-const updates: { table: string; payload: any }[] = [];
-
-function createChain(table: string) {
-  const builder: any = {};
-  for (const m of ["select", "eq", "limit", "update"]) {
-    builder[m] = vi.fn().mockReturnValue(builder);
-  }
-  builder.maybeSingle = vi.fn().mockImplementation(() => Promise.resolve(workflowSelectResult));
-  // biome-ignore lint/suspicious/noThenProperty: thenable mock
-  builder.then = (resolve: any) => {
-    if (builder._verb === "update") return resolve({ data: null, error: null });
-    if (table === "workflow_trigger") return resolve(triggerListResult);
-    return resolve({ data: null, error: null });
-  };
-  const origUpdate = builder.update;
-  builder.update = vi.fn((payload: any) => {
-    builder._verb = "update";
-    updates.push({ table, payload });
-    return origUpdate(payload);
-  });
-  return builder;
-}
-
-const mockSupabase = { from: vi.fn((t: string) => createChain(t)) };
-vi.mock("@/lib/db", () => ({ getSupabase: () => mockSupabase }));
-
-const mockRunAction = vi.fn();
-vi.mock("@/lib/zapier/execution", () => ({
-  runAction: (...args: unknown[]) => mockRunAction(...args),
-}));
-
-const mockExecuteWorkflow = vi.fn();
-vi.mock("@/lib/workflows/engine", () => ({
-  executeWorkflow: (...args: unknown[]) => mockExecuteWorkflow(...args),
-}));
-
-async function* gen(events: unknown[] = [{ type: "complete" }]): AsyncGenerator<any> {
-  for (const e of events) yield e;
-}
-
-function pollRow(over: Partial<Record<string, unknown>> = {}) {
-  return {
-    id: "trig-1",
-    workflow_id: "wf-1",
-    config: JSON.stringify({
-      app: "gmail",
-      action: "new_email",
-      dedupeKey: "id",
-      intervalMinutes: 5,
-    }),
-    last_fired_at: null,
-    last_dedupe_key: null,
-    ...over,
-  };
-}
-
-const lastTriggerUpdate = () =>
-  [...updates].reverse().find((u) => u.table === "workflow_trigger")?.payload;
-
-// ─── Tests ───────────────────────────────────────────────────────────────────
-
-describe("ZapierPollSignalProvider.runDuePolls", () => {
-  beforeEach(() => {
-    vi.resetAllMocks();
-    triggerListResult = { data: [], error: null };
-    workflowSelectResult = { data: { user_id: "user-1" }, error: null };
-    updates.length = 0;
-    mockExecuteWorkflow.mockReturnValue(gen());
-  });
-
-  it("first poll establishes the baseline — fires nothing, sets the cursor to newest", async () => {
-    triggerListResult = { data: [pollRow({ last_dedupe_key: null })], error: null };
-    mockRunAction.mockResolvedValue({ data: [{ id: "3" }, { id: "2" }, { id: "1" }] });
-
-    const { zapierPollProvider } = await import("@/mastra/signals/zapier-poll-provider");
-    const out = await zapierPollProvider.runDuePolls(new Date("2026-05-10T12:00:00Z"));
-
-    expect(out.polled).toBe(1);
-    expect(out.fired).toBe(0);
-    expect(mockExecuteWorkflow).not.toHaveBeenCalled();
-    expect(lastTriggerUpdate()?.last_dedupe_key).toBe("3");
-  });
-
-  it("fires once per new record above the cursor, oldest-first, then advances", async () => {
-    triggerListResult = { data: [pollRow({ last_dedupe_key: "1" })], error: null };
-    mockRunAction.mockResolvedValue({ data: [{ id: "3" }, { id: "2" }, { id: "1" }] });
-
-    const { zapierPollProvider } = await import("@/mastra/signals/zapier-poll-provider");
-    const out = await zapierPollProvider.runDuePolls(new Date("2026-05-10T12:00:00Z"));
-
-    expect(out.fired).toBe(2);
-    expect(mockExecuteWorkflow).toHaveBeenCalledTimes(2);
-    expect(mockExecuteWorkflow.mock.calls[0][2]).toMatchObject({ id: "2" });
-    expect(mockExecuteWorkflow.mock.calls[1][2]).toMatchObject({ id: "3" });
-    expect(lastTriggerUpdate()?.last_dedupe_key).toBe("3");
-  });
-
-  it("fires nothing when the newest record equals the cursor (no new data)", async () => {
-    triggerListResult = { data: [pollRow({ last_dedupe_key: "3" })], error: null };
-    mockRunAction.mockResolvedValue({ data: [{ id: "3" }, { id: "2" }] });
-
-    const { zapierPollProvider } = await import("@/mastra/signals/zapier-poll-provider");
-    const out = await zapierPollProvider.runDuePolls(new Date("2026-05-10T12:00:00Z"));
-
-    expect(out.fired).toBe(0);
-    expect(mockExecuteWorkflow).not.toHaveBeenCalled();
-  });
-
-  it("respects the interval gate — skips a trigger polled too recently", async () => {
-    triggerListResult = {
-      data: [pollRow({ last_dedupe_key: "1", last_fired_at: "2026-05-10T12:00:00.000Z" })],
-      error: null,
-    };
-    mockRunAction.mockResolvedValue({ data: [{ id: "9" }, { id: "1" }] });
-
-    const { zapierPollProvider } = await import("@/mastra/signals/zapier-poll-provider");
-    const out = await zapierPollProvider.runDuePolls(new Date("2026-05-10T12:02:00Z"));
-
-    expect(out.polled).toBe(0);
-    expect(mockRunAction).not.toHaveBeenCalled();
-  });
-
-  it("polls again once the interval has elapsed", async () => {
-    triggerListResult = {
-      data: [pollRow({ last_dedupe_key: "1", last_fired_at: "2026-05-10T12:00:00.000Z" })],
-      error: null,
-    };
-    mockRunAction.mockResolvedValue({ data: [{ id: "9" }, { id: "1" }] });
-
-    const { zapierPollProvider } = await import("@/mastra/signals/zapier-poll-provider");
-    const out = await zapierPollProvider.runDuePolls(new Date("2026-05-10T12:06:00Z"));
-
-    expect(out.polled).toBe(1);
-    expect(out.fired).toBe(1);
-  });
-
-  it("skips a trigger missing app/action/dedupeKey", async () => {
-    triggerListResult = {
-      data: [pollRow({ config: JSON.stringify({ app: "gmail", action: "new_email" }) })],
-      error: null,
-    };
-
-    const { zapierPollProvider } = await import("@/mastra/signals/zapier-poll-provider");
-    const out = await zapierPollProvider.runDuePolls(new Date("2026-05-10T12:00:00Z"));
-
-    expect(out.polled).toBe(0);
-    expect(mockRunAction).not.toHaveBeenCalled();
-  });
-
-  it("does not fire when a guardrail demands confirmation", async () => {
-    triggerListResult = { data: [pollRow({ last_dedupe_key: "1" })], error: null };
-    mockRunAction.mockResolvedValue({ __guardrail_confirmation_required: true });
-
-    const { zapierPollProvider } = await import("@/mastra/signals/zapier-poll-provider");
-    const out = await zapierPollProvider.runDuePolls(new Date("2026-05-10T12:00:00Z"));
-
-    expect(out.fired).toBe(0);
-    expect(mockExecuteWorkflow).not.toHaveBeenCalled();
-  });
-
-  it("handles a bare-array read result (no data wrapper)", async () => {
-    triggerListResult = { data: [pollRow({ last_dedupe_key: "1" })], error: null };
-    mockRunAction.mockResolvedValue([{ id: "2" }, { id: "1" }]);
-
-    const { zapierPollProvider } = await import("@/mastra/signals/zapier-poll-provider");
-    const out = await zapierPollProvider.runDuePolls(new Date("2026-05-10T12:00:00Z"));
-
-    expect(out.fired).toBe(1);
-    expect(mockExecuteWorkflow.mock.calls[0][2]).toMatchObject({ id: "2" });
-  });
-
-  it("notify()s the owner's thread with a native dedupeKey for each new record", async () => {
-    triggerListResult = { data: [pollRow({ last_dedupe_key: "1" })], error: null };
-    mockRunAction.mockResolvedValue({ data: [{ id: "2" }, { id: "1" }] });
-
-    const { ZapierPollSignalProvider } = await import("@/mastra/signals/zapier-poll-provider");
-    const provider = new ZapierPollSignalProvider();
-    const sendNotificationSignal = vi.fn().mockResolvedValue(undefined);
-    // Hosting on an agent is what gives the provider notify() — stub that link.
-    provider.connect({ sendNotificationSignal } as any);
-
-    const out = await provider.runDuePolls(new Date("2026-05-10T12:00:00Z"));
-
-    expect(out.fired).toBe(1);
-    expect(sendNotificationSignal).toHaveBeenCalledTimes(1);
-    const [notification, target] = sendNotificationSignal.mock.calls[0];
-    expect(notification).toMatchObject({ source: "zapier-poll", dedupeKey: "2" });
-    expect(target).toMatchObject({ threadId: "poll:trig-1", resourceId: "user-1" });
-  });
-
-  it("does not throw when no agent is connected (notify is best-effort)", async () => {
-    triggerListResult = { data: [pollRow({ last_dedupe_key: "1" })], error: null };
-    mockRunAction.mockResolvedValue({ data: [{ id: "2" }, { id: "1" }] });
-
-    const { ZapierPollSignalProvider } = await import("@/mastra/signals/zapier-poll-provider");
-    const provider = new ZapierPollSignalProvider(); // not connected
-    const out = await provider.runDuePolls(new Date("2026-05-10T12:00:00Z"));
-
-    expect(out.fired).toBe(1); // firing still succeeds without notify
-  });
-});
diff --git a/packages/agents/tests/unit/zapier-sdk-tools.test.ts b/packages/agents/tests/unit/zapier-sdk-tools.test.ts
index adfa00da..5f43707d 100644
--- a/packages/agents/tests/unit/zapier-sdk-tools.test.ts
+++ b/packages/agents/tests/unit/zapier-sdk-tools.test.ts
@@ -2,7 +2,13 @@
  * Unit tests for zapier-sdk-tools.ts — tool generation logic.
  * No API calls. Verifies tools are generated with correct metadata.
  */
-import { ZapierApprovalError } from "@zapier/zapier-sdk";
+import {
+  ZapierApiError,
+  ZapierApprovalError,
+  ZapierBundleError,
+  ZapierConflictError,
+  ZapierUnknownError,
+} from "@zapier/zapier-sdk";
 import { beforeAll, describe, expect, it } from "vitest";
 import { generateZapierTools, handleSdkError } from "../../src/lib/zapier-sdk-tools";
 
@@ -31,6 +37,46 @@ describe("handleSdkError — Zapier approval flow (foreman-elyi)", () => {
   });
 });
 
+describe("handleSdkError — newly-covered error classes (foreman-3due)", () => {
+  it("maps ZapierConflictError (409) to CONFLICT and surfaces resourceType", () => {
+    const result = handleSdkError(
+      new ZapierConflictError("name already taken", { resourceType: "table" }),
+      "create-table",
+    );
+    expect(result.code).toBe("CONFLICT");
+    expect(result.retryable).toBe(false);
+    expect(result.error).toContain("table");
+    expect(result.error).toContain("name already taken");
+  });
+
+  it("maps ZapierApiError to API_ERROR and surfaces the HTTP status when present", () => {
+    const err = new ZapierApiError("upstream 500");
+    (err as { statusCode?: number }).statusCode = 500;
+    const result = handleSdkError(err, "run-action");
+    expect(result.code).toBe("API_ERROR");
+    expect(result.retryable).toBe(false);
+    expect(result.error).toContain("500");
+  });
+
+  it("maps ZapierBundleError to BUNDLE_ERROR and joins buildErrors", () => {
+    const result = handleSdkError(
+      new ZapierBundleError("build failed", { buildErrors: ["missing import", "syntax error"] }),
+      "deploy-automation",
+    );
+    expect(result.code).toBe("BUNDLE_ERROR");
+    expect(result.error).toContain("missing import");
+    expect(result.error).toContain("syntax error");
+  });
+
+  it("maps ZapierUnknownError to UNKNOWN_ERROR without leaking 'undefined'", () => {
+    const result = handleSdkError(new ZapierUnknownError("something odd"), "run-action");
+    expect(result.code).toBe("UNKNOWN_ERROR");
+    expect(result.retryable).toBe(false);
+    expect(result.error).toContain("something odd");
+    expect(result.error).not.toContain("undefined");
+  });
+});
+
 describe("Tool generation", () => {
   it("generates tools with kebab-case IDs", () => {
     for (const [name, tool] of Object.entries(tools)) {
@@ -47,8 +93,10 @@ describe("Tool generation", () => {
       "find-first-authentication",
       "find-unique-authentication",
       "get-authentication",
-      // Legacy duplicate of get-input-fields-schema
+      // Deprecated input-field aliases — canonical trio surfaced instead
       "list-input-fields",
+      "get-input-fields-schema",
+      "list-input-field-choices",
       // Connect Builder OAuth client credentials — not exposed
       "create-client-credentials",
       "delete-client-credentials",
@@ -86,8 +134,9 @@ describe("Tool generation", () => {
       "get-action",
       "list-connections",
       "find-first-connection",
-      "get-input-fields-schema",
-      "list-input-field-choices",
+      "get-action-input-fields-schema",
+      "list-action-input-fields",
+      "list-action-input-field-choices",
       "list-tables",
       "get-table",
       "list-table-fields",
diff --git a/packages/web/content/docs/core-concepts/tool-discovery.mdx b/packages/web/content/docs/core-concepts/tool-discovery.mdx
index 6570508e..28ec47c5 100644
--- a/packages/web/content/docs/core-concepts/tool-discovery.mdx
+++ b/packages/web/content/docs/core-concepts/tool-discovery.mdx
@@ -30,7 +30,7 @@ Instead, the toolbox is **searched**, not loaded.
     ### Only matched tools load
 
     Foreman loads the handful it needs — typically `list-actions`,
-    `get-input-fields-schema`, `list-input-field-choices`, `run-action`.
+    `get-action-input-fields-schema`, `list-action-input-field-choices`, `run-action`.
     The rest stay dormant.
   </Step>
 
diff --git a/packages/web/package.json b/packages/web/package.json
index e936c01b..9cd50f5c 100644
--- a/packages/web/package.json
+++ b/packages/web/package.json
@@ -28,6 +28,7 @@
     "@supabase/ssr": "^0.10.2",
     "@supabase/supabase-js": "^2.104.1",
     "ai": "^6.0.168",
+    "ansi-to-react": "^6.2.6",
     "class-variance-authority": "^0.7.1",
     "classnames": "^2.5.1",
     "clsx": "^2.1.1",
@@ -45,7 +46,7 @@
     "lucide-react": "^1.11.0",
     "motion": "^12.38.0",
     "nanoid": "^5.1.3",
-    "next": "16.2.4",
+    "next": "16.2.10",
     "next-themes": "^0.4.6",
     "orderedmap": "^2.1.1",
     "papaparse": "^5.5.2",
@@ -62,6 +63,7 @@
     "react-data-grid": "7.0.0-beta.47",
     "react-day-picker": "^10.0.0",
     "react-dom": "^19.2.0",
+    "react-is": "^19.2.7",
     "react-resizable-panels": "^4.11.0",
     "recharts": "^3.8.0",
     "shiki": "^3.23.0",
diff --git a/packages/web/public/zapier.svg b/packages/web/public/zapier.svg
new file mode 100644
index 00000000..acaec38f
--- /dev/null
+++ b/packages/web/public/zapier.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="64" height="64"><path d="M63.207 26.418H44.432l13.193-13.193c-1.015-1.522-2.03-2.537-3.045-4.06a29.025 29.025 0 0 1-4.059-3.552L37.33 18.807V.54a17.252 17.252 0 0 0-5.074-.507A15.629 15.629 0 0 0 27.18.54v18.775l-13.7-13.7A13.7 13.7 0 0 0 9.42 9.166c-1.015 1.522-2.537 2.537-3.552 4.06L19.06 26.418H.794l-.507 5.074a15.629 15.629 0 0 0 .507 5.074H19.57l-13.7 13.7a27.198 27.198 0 0 0 7.611 7.611l13.193-13.193V63.46a17.252 17.252 0 0 0 5.074.507 15.629 15.629 0 0 0 5.074-.507V44.686L50.014 57.88a13.7 13.7 0 0 0 4.059-3.552 29.025 29.025 0 0 0 3.552-4.059L44.432 37.074h18.775A17.252 17.252 0 0 0 63.715 32a19.028 19.028 0 0 0-.507-5.582zm-23.342 5.074a25.726 25.726 0 0 1-1.015 6.597 15.223 15.223 0 0 1-6.597 1.015 25.726 25.726 0 0 1-6.597-1.015 15.223 15.223 0 0 1-1.015-6.597 25.726 25.726 0 0 1 1.015-6.597 15.223 15.223 0 0 1 6.597-1.015 25.726 25.726 0 0 1 6.597 1.015 29.684 29.684 0 0 1 1.015 6.597z" fill="#ff4a00"/></svg>
\ No newline at end of file
diff --git a/packages/web/src/app/api/workflows/[...path]/route.ts b/packages/web/src/app/api/apps/[...path]/route.ts
similarity index 85%
rename from packages/web/src/app/api/workflows/[...path]/route.ts
rename to packages/web/src/app/api/apps/[...path]/route.ts
index e24dbefd..275f54fa 100644
--- a/packages/web/src/app/api/workflows/[...path]/route.ts
+++ b/packages/web/src/app/api/apps/[...path]/route.ts
@@ -1,8 +1,8 @@
 /**
- * Pass-through proxy: /api/workflows/* → ${AGENT_URL}/workflows/*.
+ * Pass-through proxy: /api/apps/* → ${AGENT_URL}/apps/*.
  *
  * Forwards the user's Supabase access token from the SSR session so client
- * components can call workflow routes without ever seeing the token.
+ * components can call app data routes without ever seeing the token.
  */
 import { type NextRequest, NextResponse } from "next/server";
 import { createClient } from "@/lib/server";
@@ -17,7 +17,7 @@ async function forward(req: NextRequest, ctx: { params: Promise<{ path: string[]
   } = await supabase.auth.getSession();
   if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
 
-  const target = `${AGENT_URL}/workflows/${path.join("/")}${req.nextUrl.search}`;
+  const target = `${AGENT_URL}/apps/${path.join("/")}${req.nextUrl.search}`;
   const init: RequestInit = {
     method: req.method,
     headers: {
diff --git a/packages/web/src/app/api/history/route.ts b/packages/web/src/app/api/history/route.ts
index 4bec0915..d427bc30 100644
--- a/packages/web/src/app/api/history/route.ts
+++ b/packages/web/src/app/api/history/route.ts
@@ -13,9 +13,12 @@ export async function GET(request: Request) {
 
   const { searchParams } = new URL(request.url);
   const limit = searchParams.get("limit") || "20";
+  const archived = searchParams.get("archived") === "true";
 
   try {
-    const res = await fetch(`${AGENT_SERVER_URL}/conversations?limit=${limit}`, {
+    const qs = new URLSearchParams({ limit });
+    if (archived) qs.set("archived", "true");
+    const res = await fetch(`${AGENT_SERVER_URL}/conversations?${qs.toString()}`, {
       headers: { Authorization: `Bearer ${token}` },
     });
 
@@ -24,12 +27,23 @@ export async function GET(request: Request) {
 
     const conversations = Array.isArray(data) ? data : data.conversations || [];
     const chats = conversations.map(
-      (conv: { id: string; title?: string; created_at?: string }) => ({
+      (conv: {
+        id: string;
+        title?: string;
+        created_at?: string;
+        archived_at?: string | null;
+        visibility?: "private" | "workspace" | "public";
+        is_owner?: boolean;
+      }) => ({
         id: conv.id,
         title: conv.title || "New conversation",
         createdAt: conv.created_at ? new Date(conv.created_at) : new Date(),
         userId: "",
-        visibility: "private" as const,
+        // Real visibility from the agent so the selector reflects a shared chat
+        // (foreman-28cz); is_owner lets the sidebar mark teammates' shared chats.
+        visibility: conv.visibility ?? ("private" as const),
+        isOwner: conv.is_owner ?? true,
+        archivedAt: conv.archived_at ?? null,
       }),
     );
 
diff --git a/packages/web/src/app/api/history/search/route.ts b/packages/web/src/app/api/history/search/route.ts
new file mode 100644
index 00000000..7fc03b09
--- /dev/null
+++ b/packages/web/src/app/api/history/search/route.ts
@@ -0,0 +1,47 @@
+import { NextResponse } from "next/server";
+import { createClient } from "@/lib/server";
+
+const AGENT_SERVER_URL = process.env.NEXT_PUBLIC_AGENT_SERVER_URL || "http://localhost:4111";
+
+export async function GET(request: Request) {
+  const supabase = await createClient();
+  const {
+    data: { session },
+  } = await supabase.auth.getSession();
+  if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  const token = session.access_token;
+
+  const q = (new URL(request.url).searchParams.get("q") ?? "").trim();
+  if (q.length < 2) return NextResponse.json({ chats: [] });
+
+  try {
+    const res = await fetch(`${AGENT_SERVER_URL}/conversations/search?q=${encodeURIComponent(q)}`, {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    if (!res.ok) return NextResponse.json({ chats: [] });
+    const data = await res.json();
+
+    const results = Array.isArray(data?.results) ? data.results : [];
+    const chats = results.map(
+      (r: {
+        id: string;
+        title?: string;
+        created_at?: string;
+        archived_at?: string | null;
+        snippet?: string | null;
+      }) => ({
+        id: r.id,
+        title: r.title || "New conversation",
+        createdAt: r.created_at ? new Date(r.created_at) : new Date(),
+        userId: "",
+        visibility: "private" as const,
+        archivedAt: r.archived_at ?? null,
+        snippet: r.snippet ?? null,
+      }),
+    );
+
+    return NextResponse.json({ chats });
+  } catch {
+    return NextResponse.json({ chats: [] });
+  }
+}
diff --git a/packages/web/src/app/api/messages/route.ts b/packages/web/src/app/api/messages/route.ts
index 8e18f28a..8355592e 100644
--- a/packages/web/src/app/api/messages/route.ts
+++ b/packages/web/src/app/api/messages/route.ts
@@ -30,9 +30,19 @@ export async function GET(request: Request) {
     return NextResponse.json({
       messages: data.messages || [],
       visibility: data.conversation?.visibility || "private",
+      title: data.conversation?.title ?? null,
+      // Collaborative writing (foreman-whkr): a teammate who can open a
+      // workspace-shared chat may also continue it, so it's not read-only.
+      // is_owner still gates owner-only controls (visibility, public share).
       isReadonly: false,
+      isOwner: data.conversation?.is_owner !== false,
     });
   } catch {
-    return NextResponse.json({ messages: [], visibility: "private", isReadonly: false });
+    return NextResponse.json({
+      messages: [],
+      visibility: "private",
+      isReadonly: false,
+      isOwner: true,
+    });
   }
 }
diff --git a/packages/web/src/app/apps/[id]/page.tsx b/packages/web/src/app/apps/[id]/page.tsx
new file mode 100644
index 00000000..d8ce2ae5
--- /dev/null
+++ b/packages/web/src/app/apps/[id]/page.tsx
@@ -0,0 +1,46 @@
+import Link from "next/link";
+import { notFound, redirect } from "next/navigation";
+import { DashboardRenderer } from "@/components/dashboard/dashboard-renderer";
+import { ShareButton } from "@/components/dashboard/share-button";
+import { ArrowLeft } from "@/components/icons/hi";
+import { getArtifact } from "@/lib/apps-client";
+import { createClient } from "@/lib/server";
+
+export default async function DashboardArtifactPage({
+  params,
+}: {
+  params: Promise<{ id: string }>;
+}) {
+  const supabase = await createClient();
+  const {
+    data: { session },
+  } = await supabase.auth.getSession();
+  if (!session) redirect("/auth/login");
+
+  const { id } = await params;
+  const artifact = await getArtifact(id, session.access_token);
+  if (!artifact) notFound();
+
+  return (
+    <main className="mx-auto max-w-5xl px-4 py-8 sm:px-8">
+      <Link
+        href="/apps"
+        className="mb-4 inline-flex items-center gap-1.5 text-sm text-muted-foreground transition-colors hover:text-foreground"
+      >
+        <ArrowLeft className="h-4 w-4" /> Apps
+      </Link>
+      <div className="mb-6 flex flex-wrap items-start justify-between gap-3">
+        <div>
+          <h1 className="font-semibold text-2xl tracking-tight text-foreground">
+            {artifact.title}
+          </h1>
+          <p className="mt-1 text-sm text-muted-foreground">
+            {artifact.rowCount} records · updated {new Date(artifact.updatedAt).toLocaleString()}
+          </p>
+        </div>
+        <ShareButton artifactId={artifact.id} />
+      </div>
+      <DashboardRenderer data={artifact.records} spec={artifact.spec} />
+    </main>
+  );
+}
diff --git a/packages/web/src/app/apps/layout.tsx b/packages/web/src/app/apps/layout.tsx
new file mode 100644
index 00000000..1f9b686e
--- /dev/null
+++ b/packages/web/src/app/apps/layout.tsx
@@ -0,0 +1,15 @@
+import { Suspense } from "react";
+import { AppShell } from "@/components/app-shell";
+
+/**
+ * Wraps /apps and /apps/[id] in the shared app shell (sidebar). Next 16
+ * `cacheComponents` requires dynamic APIs (cookies(), searchParams) under a Suspense
+ * boundary; the page reads SSR session + search params, so the boundary stays.
+ */
+export default function AppsLayout({ children }: { children: React.ReactNode }) {
+  return (
+    <AppShell>
+      <Suspense fallback={null}>{children}</Suspense>
+    </AppShell>
+  );
+}
diff --git a/packages/web/src/app/apps/page.tsx b/packages/web/src/app/apps/page.tsx
new file mode 100644
index 00000000..e36bc76f
--- /dev/null
+++ b/packages/web/src/app/apps/page.tsx
@@ -0,0 +1,96 @@
+import Link from "next/link";
+import { redirect } from "next/navigation";
+import { AppPicker } from "@/components/apps/app-picker";
+import { DashboardRenderer } from "@/components/dashboard/dashboard-renderer";
+import { Alert, AlertDescription } from "@/components/ui/alert";
+import {
+  Empty,
+  EmptyContent,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+} from "@/components/ui/empty";
+import { defaultSpecFromRecords, getLatestSnapshot, listSnapshotApps } from "@/lib/apps-client";
+import { createClient } from "@/lib/server";
+
+export default async function AppsPage({
+  searchParams,
+}: {
+  searchParams: Promise<{ app?: string }>;
+}) {
+  const supabase = await createClient();
+  const {
+    data: { session },
+  } = await supabase.auth.getSession();
+  if (!session) redirect("/auth/login");
+
+  const { app } = await searchParams;
+  // Always load the workspace's apps so the picker can switch between them. No
+  // ?app= → default to the most-recently-refreshed app instead of a hardcoded
+  // one, so the page shows real data when any exists (foreman-djo7).
+  const apps = await listSnapshotApps(session.access_token);
+  const appKey = app?.trim() || apps[0]?.appKey || "";
+
+  let snapshotErr: string | null = null;
+  let snapshot = null;
+  if (appKey) {
+    try {
+      snapshot = await getLatestSnapshot(appKey, session.access_token);
+    } catch (e) {
+      snapshotErr = (e as Error).message;
+    }
+  }
+
+  const spec = snapshot ? defaultSpecFromRecords(appKey, snapshot.records) : null;
+
+  return (
+    <main className="mx-auto max-w-5xl px-4 py-8 sm:px-8">
+      <div className="mb-6 flex flex-wrap items-start justify-between gap-4">
+        <div>
+          <h1 className="text-2xl font-semibold tracking-tight text-foreground">
+            {spec ? spec.title : appKey ? `${appKey} app` : "Apps"}
+          </h1>
+          <p className="mt-1 text-sm text-muted-foreground">
+            {snapshot
+              ? `${snapshot.rowCount} records · refreshed ${new Date(snapshot.refreshedAt).toLocaleString()}`
+              : "Live view of data pulled from your connected apps."}
+          </p>
+        </div>
+        {apps.length > 0 && <AppPicker apps={apps} current={appKey} />}
+      </div>
+
+      {snapshotErr ? (
+        <Alert variant="destructive">
+          <AlertDescription>Couldn't load app: {snapshotErr}</AlertDescription>
+        </Alert>
+      ) : spec && snapshot ? (
+        <DashboardRenderer spec={spec} data={snapshot.records} />
+      ) : (
+        <EmptyState appKey={appKey} />
+      )}
+    </main>
+  );
+}
+
+function EmptyState({ appKey }: { appKey: string }) {
+  return (
+    <Empty className="border bg-card">
+      <EmptyHeader>
+        <EmptyTitle>{appKey ? `No data for "${appKey}" yet` : "No app data yet"}</EmptyTitle>
+        <EmptyDescription>
+          Ask Foreman in chat to pull data from one of your connected apps (or set up a poll
+          trigger). A snapshot is stored and an app — a live dashboard or internal tool — fills in
+          here automatically.
+        </EmptyDescription>
+      </EmptyHeader>
+      <EmptyContent>
+        <Link
+          href="/chat"
+          className="inline-flex items-center rounded-md bg-accent px-4 py-2 text-sm font-medium text-accent-foreground"
+        >
+          Go to chat
+        </Link>
+      </EmptyContent>
+    </Empty>
+  );
+}
diff --git a/packages/web/src/app/automations/layout.tsx b/packages/web/src/app/automations/layout.tsx
new file mode 100644
index 00000000..6e5575cf
--- /dev/null
+++ b/packages/web/src/app/automations/layout.tsx
@@ -0,0 +1,5 @@
+import { AppShell } from "@/components/app-shell";
+
+export default function AutomationsLayout({ children }: { children: React.ReactNode }) {
+  return <AppShell>{children}</AppShell>;
+}
diff --git a/packages/web/src/app/automations/page.tsx b/packages/web/src/app/automations/page.tsx
new file mode 100644
index 00000000..4ff5dd67
--- /dev/null
+++ b/packages/web/src/app/automations/page.tsx
@@ -0,0 +1,22 @@
+import { redirect } from "next/navigation";
+import { AutomationsManager } from "@/components/automations/automations-manager";
+import { createClient } from "@/lib/server";
+
+export default async function AutomationsPage() {
+  const supabase = await createClient();
+  const {
+    data: { session },
+  } = await supabase.auth.getSession();
+  if (!session) redirect("/auth/login");
+
+  return (
+    <main className="mx-auto w-full max-w-4xl px-4 py-8 sm:px-6">
+      <h1 className="mb-1 font-semibold text-2xl tracking-tight">Automations</h1>
+      <p className="mb-6 max-w-2xl text-muted-foreground text-sm">
+        Durable automations shared across your workspace. Ask Foreman in chat to create one; manage,
+        run, and inspect them here.
+      </p>
+      <AutomationsManager />
+    </main>
+  );
+}
diff --git a/packages/web/src/app/c/[shareToken]/page.tsx b/packages/web/src/app/c/[shareToken]/page.tsx
new file mode 100644
index 00000000..e4aacad0
--- /dev/null
+++ b/packages/web/src/app/c/[shareToken]/page.tsx
@@ -0,0 +1,65 @@
+import Link from "next/link";
+import { notFound } from "next/navigation";
+import { Message, MessageContent, MessageResponse } from "@/components/ai-elements/message";
+import { BrandHeader } from "@/components/brand-header";
+import { getPublicConversation } from "@/lib/conversations-client";
+
+// Public, logged-out share page for a chat (foreman-mk25). No auth: the token in
+// the URL is the capability (validated + expiry-checked by the agent's
+// /conversations/public/:token endpoint). Fetched no-store so a share reflects the
+// latest state of the thread. Read-only — there is no composer.
+export default async function PublicConversationPage({
+  params,
+}: {
+  params: Promise<{ shareToken: string }>;
+}) {
+  const { shareToken } = await params;
+  const result = await getPublicConversation(shareToken);
+  if (!result) notFound();
+
+  const { conversation, messages } = result;
+
+  return (
+    <div className="flex min-h-svh flex-col bg-background">
+      <BrandHeader label={<span className="text-muted-foreground text-sm">Shared chat</span>} />
+
+      <main className="mx-auto w-full max-w-3xl flex-1 px-4 py-8 sm:px-8">
+        <h1 className="mb-6 font-semibold text-2xl tracking-tight">
+          {conversation.title || "Shared conversation"}
+        </h1>
+
+        <div className="flex flex-col gap-6">
+          {messages.map((m, i) => {
+            const text = (m.parts ?? [])
+              .filter((p) => p.type === "text" && typeof p.text === "string")
+              .map((p) => p.text)
+              .join("");
+            if (!text) return null;
+            return (
+              <Message from={m.role} key={m.id ?? `${m.role}-${i}`}>
+                <MessageContent
+                  className={m.role === "user" ? "rounded-2xl bg-muted px-4 py-2.5" : undefined}
+                >
+                  {m.role === "assistant" ? (
+                    <div className="prose-sm max-w-none">
+                      <MessageResponse>{text}</MessageResponse>
+                    </div>
+                  ) : (
+                    <p className="whitespace-pre-wrap">{text}</p>
+                  )}
+                </MessageContent>
+              </Message>
+            );
+          })}
+        </div>
+      </main>
+
+      <footer className="border-border border-t px-6 py-4 text-center text-muted-foreground text-xs sm:px-8">
+        Built with{" "}
+        <Link className="font-medium hover:underline" href="/">
+          Foreman
+        </Link>
+      </footer>
+    </div>
+  );
+}
diff --git a/packages/web/src/app/chat/actions.ts b/packages/web/src/app/chat/actions.ts
index 32526ed7..1d81c022 100644
--- a/packages/web/src/app/chat/actions.ts
+++ b/packages/web/src/app/chat/actions.ts
@@ -53,3 +53,58 @@ export async function updateChatVisibility({
 
   if (!res.ok) throw new Error(`Failed to update visibility: ${res.status}`);
 }
+
+/** Bearer token for the current Supabase session, or throw if logged out. */
+async function requireAgentToken(): Promise<string> {
+  const supabase = await createClient();
+  const {
+    data: { session },
+  } = await supabase.auth.getSession();
+  if (!session) throw new Error("Unauthorized");
+  return session.access_token;
+}
+
+export interface ChatShareLink {
+  token: string;
+  url: string;
+  expiresAt: string | null;
+}
+
+/** The chat's existing public link, or null if it isn't shared (foreman-mk25). */
+export async function getChatShareLink(chatId: string): Promise<ChatShareLink | null> {
+  const token = await requireAgentToken();
+  const res = await fetch(`${AGENT_SERVER_URL}/conversations/${chatId}/share`, {
+    headers: { Authorization: `Bearer ${token}` },
+    cache: "no-store",
+  });
+  if (!res.ok) throw new Error(`Failed to read share link: ${res.status}`);
+  const data = (await res.json()) as {
+    token: string | null;
+    url?: string;
+    expiresAt?: string | null;
+  };
+  if (!data.token || !data.url) return null;
+  return { token: data.token, url: data.url, expiresAt: data.expiresAt ?? null };
+}
+
+/** Mint a public share link for a chat the caller owns (foreman-mk25). */
+export async function shareChat(chatId: string): Promise<ChatShareLink> {
+  const token = await requireAgentToken();
+  const res = await fetch(`${AGENT_SERVER_URL}/conversations/${chatId}/share`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+    body: "{}",
+  });
+  if (!res.ok) throw new Error(`Failed to create share link: ${res.status}`);
+  return (await res.json()) as ChatShareLink;
+}
+
+/** Revoke a chat's public share link (foreman-mk25). */
+export async function unshareChat(shareToken: string): Promise<void> {
+  const token = await requireAgentToken();
+  const res = await fetch(`${AGENT_SERVER_URL}/conversations/shares/${shareToken}`, {
+    method: "DELETE",
+    headers: { Authorization: `Bearer ${token}` },
+  });
+  if (!res.ok) throw new Error(`Failed to revoke share link: ${res.status}`);
+}
diff --git a/packages/web/src/app/compare/zapier-shared-brain/page.tsx b/packages/web/src/app/compare/zapier-shared-brain/page.tsx
new file mode 100644
index 00000000..874de61c
--- /dev/null
+++ b/packages/web/src/app/compare/zapier-shared-brain/page.tsx
@@ -0,0 +1,290 @@
+import type { Metadata } from "next";
+import Link from "next/link";
+import { ArrowRight, Ban, Check, ExternalLink } from "@/components/icons/hi";
+import { Reveal } from "@/components/landing/reveal";
+import { SiteFooter } from "@/components/landing/sections/site-footer";
+import { SiteNav } from "@/components/landing/site-nav";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+
+export const metadata: Metadata = {
+  title: "Foreman vs Zapier Shared Brain — how they compare",
+  description:
+    "An honest comparison of Foreman and Zapier Shared Brain. Both put AI on top of the same Zapier connections — see where they differ, including agent editing, prompt versioning, and full observability.",
+};
+
+const SHARED_BRAIN_URL = "https://zapier.com/shared-brain";
+
+/**
+ * At-a-glance capability matrix. Honest and balanced: Foreman wins the
+ * build / own / host rows, Shared Brain wins the fully-managed / first-party
+ * rows. "soon" = on Foreman's roadmap, not shipped — never rendered as a check.
+ */
+type Cell = boolean | "soon";
+
+const MATRIX: Array<{ label: string; foreman: Cell; sidekick: Cell }> = [
+  { label: "Drives your 10,000+ Zapier connections", foreman: true, sidekick: true },
+  { label: "Use it from Slack, Discord, Telegram & more", foreman: true, sidekick: false },
+  { label: "Self-host on your own infrastructure", foreman: true, sidekick: false },
+  { label: "Open source (MIT-licensed)", foreman: true, sidekick: false },
+  { label: "Edit the agent in full detail", foreman: true, sidekick: false },
+  { label: "Version its prompts & configuration", foreman: true, sidekick: false },
+  { label: "Choose the model it runs on", foreman: true, sidekick: false },
+  { label: "Watch every step, tool call & decision", foreman: true, sidekick: false },
+  { label: "Memory & semantic recall", foreman: true, sidekick: true },
+  { label: "Shared team brain across people", foreman: "soon", sidekick: true },
+  { label: "Fully hosted & managed by Zapier", foreman: false, sidekick: true },
+  { label: "First-party Zapier support", foreman: false, sidekick: true },
+];
+
+const CHOOSE_FOREMAN = [
+  "You're a builder — you want to own, edit, extend, and contribute to your agent, not just use it",
+  "You want to edit the agent, version its prompts, and choose the model",
+  "You want to reach your agent from the chat tools your team already uses",
+  "You want to test and see exactly what the agent does, step by step, in Mastra Studio",
+  "You need self-hosting, data control, or open source",
+  "You want every action approval-gated and audit-logged",
+];
+
+const CHOOSE_SIDEKICK = [
+  "You want a finished, hosted product that works out of the box",
+  "You're happy using the agent as Zapier designed it — no prompts to edit, no model to pick, no infrastructure to run",
+  "You'd rather not build, customize, or maintain anything yourself",
+  "You want the agent, connections, and team memory all managed for you in one place",
+  "First-party Zapier support and setup matter more to you than ownership or extensibility",
+];
+
+function MatrixCell({ value, brand }: { value: Cell; brand?: boolean }) {
+  if (value === "soon") {
+    return (
+      <span className="inline-flex items-center rounded-full border border-accent/30 bg-accent/5 px-2 py-0.5 text-[10px] font-semibold uppercase tracking-wide text-accent">
+        Soon
+      </span>
+    );
+  }
+  if (value) {
+    return (
+      <>
+        <Check className={`h-4 w-4 ${brand ? "text-accent" : "text-foreground/60"}`} />
+        <span className="sr-only">Yes</span>
+      </>
+    );
+  }
+  return (
+    <>
+      <Ban className="h-4 w-4 text-muted-foreground/40" />
+      <span className="sr-only">No</span>
+    </>
+  );
+}
+
+export default function CompareZapierSharedBrainPage() {
+  return (
+    <div className="landing-brand-lock flex min-h-screen flex-col overflow-x-clip bg-background">
+      <SiteNav />
+      <main className="flex-1 min-w-0">
+        {/* Hero */}
+        <section className="py-14 sm:py-20 md:py-24">
+          <div className="mx-auto max-w-3xl px-4 text-center sm:px-6">
+            <Reveal>
+              <Badge variant="accent" className="mb-4">
+                Comparison
+              </Badge>
+              <h1 className="text-4xl font-semibold tracking-[-0.03em] text-balance sm:text-5xl">
+                Foreman vs Zapier Shared Brain
+              </h1>
+              <p className="mx-auto mt-5 max-w-2xl text-base leading-relaxed text-muted-foreground text-pretty sm:text-lg">
+                Zapier Shared Brain and Foreman both put AI on top of the same Zapier connections,
+                but they are built for different people. Shared Brain is Zapier&apos;s own hosted
+                team workspace — a finished product you use as-is. Foreman is an open, multi-channel
+                driver for the account you already have — one you can edit, version, extend, and
+                watch end to end. Here is an honest side-by-side.
+              </p>
+            </Reveal>
+          </div>
+        </section>
+
+        {/* What each is */}
+        <section className="pb-6">
+          <div className="mx-auto max-w-5xl px-4 sm:px-6">
+            <div className="grid gap-4 sm:grid-cols-2 sm:gap-5">
+              <Reveal>
+                <div className="h-full rounded-2xl border-2 border-accent/30 bg-accent/5 p-6 sm:p-7">
+                  <div className="flex items-center gap-2.5">
+                    {/* biome-ignore lint/performance/noImgElement: small static brand asset, next/image is overkill */}
+                    <img
+                      alt="Foreman"
+                      className="h-6 w-6 object-contain"
+                      height={24}
+                      src="/zapier.svg"
+                      width={24}
+                    />
+                    <h2 className="text-xl font-semibold">Foreman</h2>
+                  </div>
+                  <p className="mt-3 text-sm leading-relaxed text-muted-foreground text-pretty">
+                    A chat driver for your Zapier account. Talk to it from Slack, Discord, Teams, or
+                    Telegram and it runs your 10,000+ connections — approval-gated, audit-logged,
+                    open source, and self-hostable. Edit the agent, version its prompts, and watch
+                    every step in Mastra Studio. Built on the Zapier SDK.
+                  </p>
+                </div>
+              </Reveal>
+              <Reveal delay={0.1}>
+                <div className="h-full rounded-2xl border border-border/60 bg-surface/40 p-6 sm:p-7">
+                  <div className="flex items-center justify-between gap-2">
+                    <h2 className="text-xl font-semibold">Zapier Shared Brain</h2>
+                    <a
+                      href={SHARED_BRAIN_URL}
+                      target="_blank"
+                      rel="noreferrer"
+                      className="inline-flex items-center gap-1 text-xs text-muted-foreground hover:text-foreground"
+                    >
+                      zapier.com <ExternalLink className="h-3 w-3" />
+                    </a>
+                  </div>
+                  <p className="mt-3 text-sm leading-relaxed text-muted-foreground text-pretty">
+                    Zapier&apos;s shared intelligence for teams — a shared brain that remembers
+                    conversations, decisions, and documents, with shared skills anyone can run
+                    across 10,000+ app connections. Hosted by Zapier.
+                  </p>
+                </div>
+              </Reveal>
+            </div>
+          </div>
+        </section>
+
+        {/* At-a-glance feature matrix */}
+        <section className="py-10 sm:py-14">
+          <div className="mx-auto max-w-5xl px-4 sm:px-6">
+            <Reveal className="mb-8 text-center">
+              <h2 className="text-2xl font-semibold tracking-[-0.02em] text-balance sm:text-3xl">
+                At a glance
+              </h2>
+              <p className="mx-auto mt-3 max-w-2xl text-sm leading-relaxed text-muted-foreground text-pretty">
+                The same 10,000+ connections on both sides. Where they differ is who gets to build,
+                host, and see inside the agent.
+              </p>
+            </Reveal>
+            <Reveal>
+              <div className="overflow-hidden rounded-2xl border border-border/60">
+                <div className="grid grid-cols-[1.7fr_1fr_1fr] border-b border-border/60 bg-surface/50 text-[11px] font-semibold uppercase tracking-wider">
+                  <div className="px-4 py-3 text-muted-foreground sm:px-5">Capability</div>
+                  <div className="flex items-center justify-center gap-1.5 bg-accent/5 px-3 py-3 text-center text-accent">
+                    {/* biome-ignore lint/performance/noImgElement: small static brand asset, next/image is overkill */}
+                    <img
+                      alt=""
+                      className="h-3.5 w-3.5 object-contain"
+                      height={14}
+                      src="/zapier.svg"
+                      width={14}
+                    />
+                    Foreman
+                  </div>
+                  <div className="px-3 py-3 text-center text-muted-foreground">Shared Brain</div>
+                </div>
+                {MATRIX.map((row) => (
+                  <div
+                    key={row.label}
+                    className="grid grid-cols-[1.7fr_1fr_1fr] items-center border-b border-border/40 text-sm last:border-b-0"
+                  >
+                    <div className="px-4 py-3.5 font-medium text-pretty sm:px-5">{row.label}</div>
+                    <div className="flex justify-center bg-accent/5 px-3 py-3.5">
+                      <MatrixCell value={row.foreman} brand />
+                    </div>
+                    <div className="flex justify-center px-3 py-3.5">
+                      <MatrixCell value={row.sidekick} />
+                    </div>
+                  </div>
+                ))}
+              </div>
+              <div className="mt-3 flex flex-wrap items-center justify-center gap-x-5 gap-y-1.5 text-xs text-muted-foreground">
+                <span className="inline-flex items-center gap-1.5">
+                  <Check className="h-3.5 w-3.5 text-accent" /> Included
+                </span>
+                <span className="inline-flex items-center gap-1.5">
+                  <Ban className="h-3.5 w-3.5 text-muted-foreground/40" /> Not available
+                </span>
+                <span className="inline-flex items-center gap-1.5">
+                  <span className="rounded-full border border-accent/30 bg-accent/5 px-1.5 py-0.5 text-[10px] font-semibold uppercase tracking-wide text-accent">
+                    Soon
+                  </span>{" "}
+                  On Foreman&apos;s roadmap
+                </span>
+              </div>
+            </Reveal>
+          </div>
+        </section>
+
+        {/* When to choose which */}
+        <section className="py-10 sm:py-14">
+          <div className="mx-auto max-w-5xl px-4 sm:px-6">
+            <Reveal className="mb-8 text-center">
+              <h2 className="text-2xl font-semibold tracking-[-0.02em] text-balance sm:text-3xl">
+                When to choose which
+              </h2>
+              <p className="mx-auto mt-3 max-w-2xl text-sm leading-relaxed text-muted-foreground text-pretty">
+                Neither is better — they fit different people. Shared Brain is for teams who want a
+                polished product they don&apos;t have to build. Foreman is for the people who do
+                want to build, own, and extend their agent.
+              </p>
+            </Reveal>
+            <div className="grid gap-4 sm:grid-cols-2 sm:gap-5">
+              <Reveal>
+                <div className="h-full rounded-2xl border-2 border-accent/30 bg-accent/5 p-6 sm:p-7">
+                  <h3 className="font-semibold">Reach for Foreman if…</h3>
+                  <ul className="mt-4 space-y-2.5 text-sm">
+                    {CHOOSE_FOREMAN.map((line) => (
+                      <li key={line} className="flex items-start gap-2.5">
+                        <Check className="mt-0.5 h-3.5 w-3.5 shrink-0 text-accent" />
+                        <span className="text-pretty">{line}</span>
+                      </li>
+                    ))}
+                  </ul>
+                </div>
+              </Reveal>
+              <Reveal delay={0.1}>
+                <div className="h-full rounded-2xl border border-border/60 bg-surface/40 p-6 sm:p-7">
+                  <h3 className="font-semibold">Reach for Zapier Shared Brain if…</h3>
+                  <ul className="mt-4 space-y-2.5 text-sm">
+                    {CHOOSE_SIDEKICK.map((line) => (
+                      <li key={line} className="flex items-start gap-2.5">
+                        <Check className="mt-0.5 h-3.5 w-3.5 shrink-0 text-muted-foreground" />
+                        <span className="text-pretty">{line}</span>
+                      </li>
+                    ))}
+                  </ul>
+                </div>
+              </Reveal>
+            </div>
+          </div>
+        </section>
+
+        {/* Honest note + CTA */}
+        <section className="py-10 sm:py-16">
+          <div className="mx-auto max-w-3xl px-4 text-center sm:px-6">
+            <Reveal>
+              <p className="text-base leading-relaxed text-muted-foreground text-pretty sm:text-lg">
+                Foreman is built on the Zapier SDK, so it drives the same account and the same
+                connections Shared Brain does. The real difference is who each is for: Shared Brain
+                is the better pick if you want a finished product you don&apos;t have to build.
+                Foreman is for the people who do — an agent you can edit, version, extend, and watch
+                end to end, in your own channels and on your own infrastructure.
+              </p>
+              <div className="mt-7 flex flex-wrap justify-center gap-3">
+                <Button size="lg" variant="accent" asChild>
+                  <Link href="/chat">
+                    Try Foreman <ArrowRight className="h-4 w-4" />
+                  </Link>
+                </Button>
+                <Button size="lg" variant="outline" asChild>
+                  <Link href="/">Back to overview</Link>
+                </Button>
+              </div>
+            </Reveal>
+          </div>
+        </section>
+      </main>
+      <SiteFooter />
+    </div>
+  );
+}
diff --git a/packages/web/src/app/d/[shareToken]/page.tsx b/packages/web/src/app/d/[shareToken]/page.tsx
new file mode 100644
index 00000000..aa015ec7
--- /dev/null
+++ b/packages/web/src/app/d/[shareToken]/page.tsx
@@ -0,0 +1,45 @@
+import Link from "next/link";
+import { notFound } from "next/navigation";
+import { BrandHeader } from "@/components/brand-header";
+import { DashboardRenderer } from "@/components/dashboard/dashboard-renderer";
+import { getPublicDashboard } from "@/lib/apps-client";
+
+// Public, logged-out share page. No auth: the token in the URL is the capability
+// (validated + expiry-checked by the agent's /apps/public/:token endpoint).
+// Rendered dynamically (fetch is no-store) so a share reflects the latest
+// snapshot — matches the in-app dashboard view. (Route-segment `revalidate` ISR
+// is incompatible with this app's Next 16 `cacheComponents` config.)
+export default async function PublicDashboardPage({
+  params,
+}: {
+  params: Promise<{ shareToken: string }>;
+}) {
+  const { shareToken } = await params;
+  const dashboard = await getPublicDashboard(shareToken);
+  if (!dashboard) notFound();
+
+  return (
+    <div className="flex min-h-svh flex-col bg-background">
+      <BrandHeader label={<span className="text-sm text-muted-foreground">Shared app</span>} />
+
+      <main className="mx-auto w-full max-w-5xl flex-1 px-4 py-8 sm:px-8">
+        <div className="mb-6">
+          <h1 className="font-semibold text-2xl tracking-tight" style={{ color: "#201515" }}>
+            {dashboard.title}
+          </h1>
+          <p className="mt-1 text-sm" style={{ color: "#7A6A5C" }}>
+            {dashboard.rowCount} records · updated {new Date(dashboard.updatedAt).toLocaleString()}
+          </p>
+        </div>
+        <DashboardRenderer data={dashboard.records} spec={dashboard.spec} />
+      </main>
+
+      <footer className="border-t border-border px-6 py-4 text-center text-xs text-muted-foreground sm:px-8">
+        Built with{" "}
+        <Link className="font-medium hover:underline" href="/">
+          Foreman
+        </Link>
+      </footer>
+    </div>
+  );
+}
diff --git a/packages/web/src/app/doc/[token]/page.tsx b/packages/web/src/app/doc/[token]/page.tsx
new file mode 100644
index 00000000..f2ee6e20
--- /dev/null
+++ b/packages/web/src/app/doc/[token]/page.tsx
@@ -0,0 +1,38 @@
+import Link from "next/link";
+import { notFound } from "next/navigation";
+import { MessageResponse } from "@/components/ai-elements/message";
+import { BrandHeader } from "@/components/brand-header";
+import { getPublicDocument } from "@/lib/documents-client";
+
+// Public, logged-out share page for a knowledge document (foreman-jz14). No auth:
+// the token in the URL is the capability (validated + expiry-checked by the
+// agent's /documents/public/:token endpoint). Fetched no-store so a share always
+// reflects the latest saved content of the document.
+export default async function PublicDocumentPage({
+  params,
+}: {
+  params: Promise<{ token: string }>;
+}) {
+  const { token } = await params;
+  const doc = await getPublicDocument(token);
+  if (!doc) notFound();
+
+  return (
+    <div className="flex min-h-svh flex-col bg-background">
+      <BrandHeader label={<span className="text-muted-foreground text-sm">Shared document</span>} />
+
+      <main className="mx-auto w-full max-w-3xl flex-1 px-4 py-8 sm:px-8">
+        <article className="prose-sm max-w-none">
+          <MessageResponse>{doc.content}</MessageResponse>
+        </article>
+      </main>
+
+      <footer className="border-border border-t px-6 py-4 text-center text-muted-foreground text-xs sm:px-8">
+        Built with{" "}
+        <Link className="font-medium hover:underline" href="/">
+          Foreman
+        </Link>
+      </footer>
+    </div>
+  );
+}
diff --git a/packages/web/src/app/documents/layout.tsx b/packages/web/src/app/documents/layout.tsx
new file mode 100644
index 00000000..4557f471
--- /dev/null
+++ b/packages/web/src/app/documents/layout.tsx
@@ -0,0 +1,5 @@
+import { AppShell } from "@/components/app-shell";
+
+export default function DocumentsLayout({ children }: { children: React.ReactNode }) {
+  return <AppShell>{children}</AppShell>;
+}
diff --git a/packages/web/src/app/documents/page.tsx b/packages/web/src/app/documents/page.tsx
new file mode 100644
index 00000000..d25ef51a
--- /dev/null
+++ b/packages/web/src/app/documents/page.tsx
@@ -0,0 +1,22 @@
+import { redirect } from "next/navigation";
+import { DocumentsBrowser } from "@/components/documents/documents-browser";
+import { createClient } from "@/lib/server";
+
+export default async function DocumentsPage() {
+  const supabase = await createClient();
+  const {
+    data: { session },
+  } = await supabase.auth.getSession();
+  if (!session) redirect("/auth/login");
+
+  return (
+    <main className="mx-auto w-full max-w-3xl px-4 py-8 sm:px-6">
+      <h1 className="mb-1 font-semibold text-2xl tracking-tight">Documents</h1>
+      <p className="mb-6 text-muted-foreground text-sm">
+        Knowledge documents in your active workspace. Shared docs are visible to your whole team;
+        private docs are only yours. Ask Foreman in a chat to create or edit them.
+      </p>
+      <DocumentsBrowser />
+    </main>
+  );
+}
diff --git a/packages/web/src/app/editor/layout.tsx b/packages/web/src/app/editor/layout.tsx
index b62c9f8b..2d3dc6f9 100644
--- a/packages/web/src/app/editor/layout.tsx
+++ b/packages/web/src/app/editor/layout.tsx
@@ -1,6 +1,6 @@
 import { redirect } from "next/navigation";
 import { Suspense } from "react";
-import { Toaster } from "sonner";
+import { AppShell } from "@/components/app-shell";
 import { EditorShell } from "@/components/editor/editor-shell";
 import { auth } from "@/lib/auth";
 
@@ -10,18 +10,11 @@ export const metadata = {
 
 export default function EditorLayout({ children }: { children: React.ReactNode }) {
   return (
-    <>
-      <Toaster
-        position="top-center"
-        theme="system"
-        toastOptions={{
-          className: "!bg-card !text-foreground !border-border/50",
-        }}
-      />
-      <Suspense fallback={<div className="h-dvh bg-background" />}>
+    <AppShell fullBleed>
+      <Suspense fallback={<div className="h-full bg-background" />}>
         <EditorAuthGate>{children}</EditorAuthGate>
       </Suspense>
-    </>
+    </AppShell>
   );
 }
 
diff --git a/packages/web/src/app/globals.css b/packages/web/src/app/globals.css
index 25ac92b6..2888fa71 100644
--- a/packages/web/src/app/globals.css
+++ b/packages/web/src/app/globals.css
@@ -26,14 +26,14 @@
   --secondary: #f4f4f5;
   --secondary-foreground: #18181b;
   --muted: #f4f4f5;
-  --muted-foreground: #6b7280;
+  --muted-foreground: #52525b;
   --accent: #ff4a00;
   --accent-foreground: #ffffff;
   --destructive: #dc2626;
   --destructive-foreground: #ffffff;
 
-  --border: #e5e7eb;
-  --input: #e5e7eb;
+  --border: #d4d4d8;
+  --input: #d4d4d8;
   --ring: #ff4a00;
 
   /* Foreman custom surface token (used by editor / version history). */
@@ -97,24 +97,31 @@
 }
 
 @theme inline {
-  --color-background: var(--background);
+  /* Surface tokens are blended a few percent toward the brand hue (--primary)
+     so the active color-theme preset reaches the whole UI — cards, inputs,
+     borders, hover/accent states — not just the sidebar nav + focus rings.
+     The mix is subtle on big surfaces (3-7%) and stronger on accent (20%) so
+     hovers clearly pick up the theme. Foreground/text tokens stay untinted for
+     contrast. Switching presets (or the default orange) now visibly recolors
+     the conversation area. See [data-theme-preset] blocks below for the hues. */
+  --color-background: color-mix(in oklab, var(--background), var(--primary) 4%);
   --color-foreground: var(--foreground);
-  --color-card: var(--card);
+  --color-card: color-mix(in oklab, var(--card), var(--primary) 8%);
   --color-card-foreground: var(--card-foreground);
-  --color-popover: var(--popover);
+  --color-popover: color-mix(in oklab, var(--popover), var(--primary) 8%);
   --color-popover-foreground: var(--popover-foreground);
   --color-primary: var(--primary);
   --color-primary-foreground: var(--primary-foreground);
-  --color-secondary: var(--secondary);
+  --color-secondary: color-mix(in oklab, var(--secondary), var(--primary) 12%);
   --color-secondary-foreground: var(--secondary-foreground);
-  --color-muted: var(--muted);
+  --color-muted: color-mix(in oklab, var(--muted), var(--primary) 10%);
   --color-muted-foreground: var(--muted-foreground);
-  --color-accent: var(--accent);
+  --color-accent: color-mix(in oklab, var(--accent), var(--primary) 25%);
   --color-accent-foreground: var(--accent-foreground);
   --color-destructive: var(--destructive);
   --color-destructive-foreground: var(--destructive-foreground);
-  --color-border: var(--border);
-  --color-input: var(--input);
+  --color-border: color-mix(in oklab, var(--border), var(--primary) 16%);
+  --color-input: color-mix(in oklab, var(--input), var(--primary) 16%);
   --color-ring: var(--ring);
   --color-surface: var(--surface);
   --color-chart-1: var(--chart-1);
@@ -122,7 +129,10 @@
   --color-chart-3: var(--chart-3);
   --color-chart-4: var(--chart-4);
   --color-chart-5: var(--chart-5);
-  --color-sidebar: var(--sidebar);
+  /* Sidebar shares the page surface (not the standalone --sidebar slab) so it
+     blends into the canvas in every preset/mode and the chat card is the one
+     floating element. Mirrors --color-background's formula exactly. */
+  --color-sidebar: color-mix(in oklab, var(--background), var(--primary) 4%);
   --color-sidebar-foreground: var(--sidebar-foreground);
   --color-sidebar-primary: var(--sidebar-primary);
   --color-sidebar-primary-foreground: var(--sidebar-primary-foreground);
@@ -147,6 +157,23 @@ body {
   -webkit-font-smoothing: antialiased;
 }
 
+/* The marketing landing locks its brand tokens to the Foreman orange regardless
+   of the in-app theme preset. Presets repurpose --accent as a light neutral and
+   move the brand hue to --primary, which washed out the landing's accent-based
+   brand elements (CTA, badges, highlighted headings) for signed-in users. */
+.landing-brand-lock {
+  --primary: #ff4a00;
+  --primary-foreground: #ffffff;
+  --accent: #ff4a00;
+  --accent-foreground: #ffffff;
+  --ring: #ff4a00;
+}
+.dark .landing-brand-lock {
+  --primary: #ff5a1a;
+  --accent: #ff5a1a;
+  --ring: #ff5a1a;
+}
+
 /* Animations */
 @keyframes fade-in-up {
   from {
@@ -295,7 +322,7 @@ body {
   --card-foreground: oklch(0.279 0.0299 260.05);
   --popover: white;
   --popover-foreground: oklch(0.279 0.0299 260.05);
-  --primary: oklch(0.5315 0.0694 156.19);
+  --primary: oklch(0.53 0.15 156.19);
   --primary-foreground: white;
   --secondary: oklch(0.929 0.0095 255.53);
   --secondary-foreground: oklch(0.279 0.0299 260.05);
@@ -307,20 +334,20 @@ body {
   --destructive-foreground: white;
   --border: oklch(0.929 0.0095 255.53);
   --input: oklch(0.869 0.016 252.91);
-  --ring: oklch(0.5315 0.0694 156.19);
-  --chart-1: oklch(0.5315 0.0694 156.19);
+  --ring: oklch(0.53 0.15 156.19);
+  --chart-1: oklch(0.53 0.15 156.19);
   --chart-2: oklch(0.5748 0.0862 336.52);
   --chart-3: oklch(0.8603 0.0731 158.6);
   --chart-4: oklch(0.8292 0.0422 332);
   --chart-5: oklch(0.9564 0.0234 159.23);
   --sidebar: white;
   --sidebar-foreground: oklch(0.279 0.0299 260.05);
-  --sidebar-primary: oklch(0.5315 0.0694 156.19);
+  --sidebar-primary: oklch(0.53 0.15 156.19);
   --sidebar-primary-foreground: white;
-  --sidebar-accent: oklch(0.5315 0.0694 156.19);
-  --sidebar-accent-foreground: white;
+  --sidebar-accent: var(--accent);
+  --sidebar-accent-foreground: var(--accent-foreground);
   --sidebar-border: oklch(0.929 0.0095 255.53);
-  --sidebar-ring: oklch(0.5315 0.0694 156.19);
+  --sidebar-ring: oklch(0.53 0.15 156.19);
 }
 .dark [data-theme-preset="underground"],
 .dark[data-theme-preset="underground"] {
@@ -330,7 +357,7 @@ body {
   --card-foreground: oklch(0.929 0.0095 255.53);
   --popover: oklch(0.208 0.0306 265.77);
   --popover-foreground: oklch(0.929 0.0095 255.53);
-  --primary: oklch(0.5315 0.0694 156.19);
+  --primary: oklch(0.53 0.15 156.19);
   --primary-foreground: white;
   --secondary: oklch(0.279 0.0299 260.05);
   --secondary-foreground: oklch(0.929 0.0095 255.53);
@@ -342,20 +369,20 @@ body {
   --destructive-foreground: white;
   --border: oklch(0.279 0.0299 260.05);
   --input: oklch(0.372 0.0321 257.31);
-  --ring: oklch(0.5315 0.0694 156.19);
-  --chart-1: oklch(0.5315 0.0694 156.19);
+  --ring: oklch(0.53 0.15 156.19);
+  --chart-1: oklch(0.53 0.15 156.19);
   --chart-2: oklch(0.5748 0.0862 336.52);
   --chart-3: oklch(0.8603 0.0731 158.6);
   --chart-4: oklch(0.8292 0.0422 332);
   --chart-5: oklch(0.9564 0.0234 159.23);
   --sidebar: oklch(0.208 0.0306 265.77);
   --sidebar-foreground: oklch(0.929 0.0095 255.53);
-  --sidebar-primary: oklch(0.5315 0.0694 156.19);
+  --sidebar-primary: oklch(0.53 0.15 156.19);
   --sidebar-primary-foreground: white;
-  --sidebar-accent: oklch(0.5315 0.0694 156.19);
-  --sidebar-accent-foreground: oklch(0.929 0.0095 255.53);
+  --sidebar-accent: var(--accent);
+  --sidebar-accent-foreground: var(--accent-foreground);
   --sidebar-border: oklch(0.279 0.0299 260.05);
-  --sidebar-ring: oklch(0.5315 0.0694 156.19);
+  --sidebar-ring: oklch(0.53 0.15 156.19);
 }
 
 [data-theme-preset="rose-garden"] {
@@ -387,8 +414,8 @@ body {
   --sidebar-foreground: oklch(0.2686 0.0032 34.85);
   --sidebar-primary: oklch(0.5827 0.2418 12.23);
   --sidebar-primary-foreground: white;
-  --sidebar-accent: oklch(0.5827 0.2418 12.23);
-  --sidebar-accent-foreground: white;
+  --sidebar-accent: var(--accent);
+  --sidebar-accent-foreground: var(--accent-foreground);
   --sidebar-border: oklch(0.9227 0.0029 34.49);
   --sidebar-ring: oklch(0.5827 0.2418 12.23);
 }
@@ -422,8 +449,8 @@ body {
   --sidebar-foreground: oklch(0.9227 0.0029 34.49);
   --sidebar-primary: oklch(0.5827 0.2418 12.23);
   --sidebar-primary-foreground: white;
-  --sidebar-accent: oklch(0.5827 0.2418 12.23);
-  --sidebar-accent-foreground: oklch(0.9227 0.0029 34.49);
+  --sidebar-accent: var(--accent);
+  --sidebar-accent-foreground: var(--accent-foreground);
   --sidebar-border: oklch(0.2686 0.0032 34.85);
   --sidebar-ring: oklch(0.5827 0.2418 12.23);
 }
@@ -435,7 +462,7 @@ body {
   --card-foreground: oklch(0.2742 0.0208 165.96);
   --popover: white;
   --popover-foreground: oklch(0.2742 0.0208 165.96);
-  --primary: oklch(0.765 0.177 163.22);
+  --primary: oklch(0.62 0.17 163.22);
   --primary-foreground: black;
   --secondary: oklch(0.551 0.0899 200.52);
   --secondary-foreground: white;
@@ -447,20 +474,20 @@ body {
   --destructive-foreground: white;
   --border: oklch(0.9263 0.0099 162.17);
   --input: oklch(0.8504 0.0147 163.22);
-  --ring: oklch(0.765 0.177 163.22);
-  --chart-1: oklch(0.765 0.177 163.22);
+  --ring: oklch(0.62 0.17 163.22);
+  --chart-1: oklch(0.62 0.17 163.22);
   --chart-2: oklch(0.551 0.0899 200.52);
   --chart-3: oklch(0.845 0.143 164.98);
   --chart-4: oklch(0.8576 0.1202 192.38);
   --chart-5: oklch(0.95 0.052 163.05);
   --sidebar: white;
   --sidebar-foreground: oklch(0.2742 0.0208 165.96);
-  --sidebar-primary: oklch(0.765 0.177 163.22);
+  --sidebar-primary: oklch(0.62 0.17 163.22);
   --sidebar-primary-foreground: black;
-  --sidebar-accent: oklch(0.765 0.177 163.22);
-  --sidebar-accent-foreground: oklch(0.2742 0.0208 165.96);
+  --sidebar-accent: var(--accent);
+  --sidebar-accent-foreground: var(--accent-foreground);
   --sidebar-border: oklch(0.9263 0.0099 162.17);
-  --sidebar-ring: oklch(0.765 0.177 163.22);
+  --sidebar-ring: oklch(0.62 0.17 163.22);
 }
 .dark [data-theme-preset="lake-view"],
 .dark[data-theme-preset="lake-view"] {
@@ -470,7 +497,7 @@ body {
   --card-foreground: oklch(0.9263 0.0099 162.17);
   --popover: oklch(0.2119 0.0173 166.78);
   --popover-foreground: oklch(0.9263 0.0099 162.17);
-  --primary: oklch(0.765 0.177 163.22);
+  --primary: oklch(0.62 0.17 163.22);
   --primary-foreground: black;
   --secondary: oklch(0.551 0.0899 200.52);
   --secondary-foreground: white;
@@ -482,20 +509,20 @@ body {
   --destructive-foreground: white;
   --border: oklch(0.2742 0.0208 165.96);
   --input: oklch(0.3731 0.0248 166.06);
-  --ring: oklch(0.765 0.177 163.22);
-  --chart-1: oklch(0.765 0.177 163.22);
+  --ring: oklch(0.62 0.17 163.22);
+  --chart-1: oklch(0.62 0.17 163.22);
   --chart-2: oklch(0.551 0.0899 200.52);
   --chart-3: oklch(0.845 0.143 164.98);
   --chart-4: oklch(0.8576 0.1202 192.38);
   --chart-5: oklch(0.95 0.052 163.05);
   --sidebar: oklch(0.2119 0.0173 166.78);
   --sidebar-foreground: oklch(0.9263 0.0099 162.17);
-  --sidebar-primary: oklch(0.765 0.177 163.22);
+  --sidebar-primary: oklch(0.62 0.17 163.22);
   --sidebar-primary-foreground: black;
-  --sidebar-accent: oklch(0.765 0.177 163.22);
-  --sidebar-accent-foreground: black;
+  --sidebar-accent: var(--accent);
+  --sidebar-accent-foreground: var(--accent-foreground);
   --sidebar-border: oklch(0.2742 0.0208 165.96);
-  --sidebar-ring: oklch(0.765 0.177 163.22);
+  --sidebar-ring: oklch(0.62 0.17 163.22);
 }
 
 [data-theme-preset="sunset-glow"] {
@@ -527,8 +554,8 @@ body {
   --sidebar-foreground: oklch(0.2738 0.0062 162.35);
   --sidebar-primary: oklch(0.5591 0.1882 25.33);
   --sidebar-primary-foreground: white;
-  --sidebar-accent: oklch(0.5591 0.1882 25.33);
-  --sidebar-accent-foreground: white;
+  --sidebar-accent: var(--accent);
+  --sidebar-accent-foreground: var(--accent-foreground);
   --sidebar-border: oklch(0.9261 0.0057 158.66);
   --sidebar-ring: oklch(0.5591 0.1882 25.33);
 }
@@ -562,8 +589,8 @@ body {
   --sidebar-foreground: oklch(0.9261 0.0057 158.66);
   --sidebar-primary: oklch(0.5591 0.1882 25.33);
   --sidebar-primary-foreground: white;
-  --sidebar-accent: oklch(0.5591 0.1882 25.33);
-  --sidebar-accent-foreground: white;
+  --sidebar-accent: var(--accent);
+  --sidebar-accent-foreground: var(--accent-foreground);
   --sidebar-border: oklch(0.2738 0.0062 162.35);
   --sidebar-ring: oklch(0.5591 0.1882 25.33);
 }
@@ -575,7 +602,7 @@ body {
   --card-foreground: oklch(0.2738 0.021 286.32);
   --popover: white;
   --popover-foreground: oklch(0.2738 0.021 286.32);
-  --primary: oklch(0.5276 0.1072 182.22);
+  --primary: oklch(0.53 0.15 182.22);
   --primary-foreground: white;
   --secondary: oklch(0.5236 0.0505 250.18);
   --secondary-foreground: white;
@@ -587,20 +614,20 @@ body {
   --destructive-foreground: white;
   --border: oklch(0.9197 0.014 286.6);
   --input: oklch(0.8708 0.021 286.57);
-  --ring: oklch(0.5276 0.1072 182.22);
-  --chart-1: oklch(0.5276 0.1072 182.22);
+  --ring: oklch(0.53 0.15 182.22);
+  --chart-1: oklch(0.53 0.15 182.22);
   --chart-2: oklch(0.5236 0.0505 250.18);
   --chart-3: oklch(0.8522 0.1484 177.84);
   --chart-4: oklch(0.8208 0.0278 242.12);
   --chart-5: oklch(0.9511 0.0547 177.24);
   --sidebar: white;
   --sidebar-foreground: oklch(0.2738 0.021 286.32);
-  --sidebar-primary: oklch(0.5276 0.1072 182.22);
+  --sidebar-primary: oklch(0.53 0.15 182.22);
   --sidebar-primary-foreground: white;
-  --sidebar-accent: oklch(0.5276 0.1072 182.22);
-  --sidebar-accent-foreground: white;
+  --sidebar-accent: var(--accent);
+  --sidebar-accent-foreground: var(--accent-foreground);
   --sidebar-border: oklch(0.9197 0.014 286.6);
-  --sidebar-ring: oklch(0.5276 0.1072 182.22);
+  --sidebar-ring: oklch(0.53 0.15 182.22);
 }
 .dark [data-theme-preset="forest-whisper"],
 .dark[data-theme-preset="forest-whisper"] {
@@ -610,7 +637,7 @@ body {
   --card-foreground: oklch(0.9197 0.014 286.6);
   --popover: oklch(0.2098 0.014 286.17);
   --popover-foreground: oklch(0.9197 0.014 286.6);
-  --primary: oklch(0.5276 0.1072 182.22);
+  --primary: oklch(0.53 0.15 182.22);
   --primary-foreground: white;
   --secondary: oklch(0.5236 0.0505 250.18);
   --secondary-foreground: white;
@@ -622,20 +649,20 @@ body {
   --destructive-foreground: white;
   --border: oklch(0.2738 0.021 286.32);
   --input: oklch(0.3698 0.0315 286.09);
-  --ring: oklch(0.5276 0.1072 182.22);
-  --chart-1: oklch(0.5276 0.1072 182.22);
+  --ring: oklch(0.53 0.15 182.22);
+  --chart-1: oklch(0.53 0.15 182.22);
   --chart-2: oklch(0.5236 0.0505 250.18);
   --chart-3: oklch(0.8522 0.1484 177.84);
   --chart-4: oklch(0.8208 0.0278 242.12);
   --chart-5: oklch(0.9511 0.0547 177.24);
   --sidebar: oklch(0.2098 0.014 286.17);
   --sidebar-foreground: oklch(0.9197 0.014 286.6);
-  --sidebar-primary: oklch(0.5276 0.1072 182.22);
+  --sidebar-primary: oklch(0.53 0.15 182.22);
   --sidebar-primary-foreground: white;
-  --sidebar-accent: oklch(0.5276 0.1072 182.22);
-  --sidebar-accent-foreground: white;
+  --sidebar-accent: var(--accent);
+  --sidebar-accent-foreground: var(--accent-foreground);
   --sidebar-border: oklch(0.2738 0.021 286.32);
-  --sidebar-ring: oklch(0.5276 0.1072 182.22);
+  --sidebar-ring: oklch(0.53 0.15 182.22);
 }
 
 [data-theme-preset="ocean-breeze"] {
@@ -667,8 +694,8 @@ body {
   --sidebar-foreground: oklch(0.2708 0.008 110.04);
   --sidebar-primary: oklch(0.5461 0.2152 262.88);
   --sidebar-primary-foreground: white;
-  --sidebar-accent: oklch(0.5461 0.2152 262.88);
-  --sidebar-accent-foreground: white;
+  --sidebar-accent: var(--accent);
+  --sidebar-accent-foreground: var(--accent-foreground);
   --sidebar-border: oklch(0.9245 0.0074 107.89);
   --sidebar-ring: oklch(0.5461 0.2152 262.88);
 }
@@ -702,8 +729,8 @@ body {
   --sidebar-foreground: oklch(0.9245 0.0074 107.89);
   --sidebar-primary: oklch(0.5461 0.2152 262.88);
   --sidebar-primary-foreground: white;
-  --sidebar-accent: oklch(0.5461 0.2152 262.88);
-  --sidebar-accent-foreground: white;
+  --sidebar-accent: var(--accent);
+  --sidebar-accent-foreground: var(--accent-foreground);
   --sidebar-border: oklch(0.2708 0.008 110.04);
   --sidebar-ring: oklch(0.5461 0.2152 262.88);
 }
@@ -737,8 +764,8 @@ body {
   --sidebar-foreground: oklch(0.278 0.0277 258.85);
   --sidebar-primary: oklch(0.5709 0.1808 306.89);
   --sidebar-primary-foreground: white;
-  --sidebar-accent: oklch(0.5709 0.1808 306.89);
-  --sidebar-accent-foreground: white;
+  --sidebar-accent: var(--accent);
+  --sidebar-accent-foreground: var(--accent-foreground);
   --sidebar-border: oklch(0.9253 0.0117 262.53);
   --sidebar-ring: oklch(0.5709 0.1808 306.89);
 }
@@ -772,8 +799,8 @@ body {
   --sidebar-foreground: oklch(0.9253 0.0117 262.53);
   --sidebar-primary: oklch(0.5709 0.1808 306.89);
   --sidebar-primary-foreground: white;
-  --sidebar-accent: oklch(0.5709 0.1808 306.89);
-  --sidebar-accent-foreground: white;
+  --sidebar-accent: var(--accent);
+  --sidebar-accent-foreground: var(--accent-foreground);
   --sidebar-border: oklch(0.278 0.0277 258.85);
   --sidebar-ring: oklch(0.5709 0.1808 306.89);
 }
diff --git a/packages/web/src/app/inbox/layout.tsx b/packages/web/src/app/inbox/layout.tsx
new file mode 100644
index 00000000..0f00466f
--- /dev/null
+++ b/packages/web/src/app/inbox/layout.tsx
@@ -0,0 +1,5 @@
+import { AppShell } from "@/components/app-shell";
+
+export default function InboxLayout({ children }: { children: React.ReactNode }) {
+  return <AppShell>{children}</AppShell>;
+}
diff --git a/packages/web/src/app/inbox/page.tsx b/packages/web/src/app/inbox/page.tsx
new file mode 100644
index 00000000..65d9bd4d
--- /dev/null
+++ b/packages/web/src/app/inbox/page.tsx
@@ -0,0 +1,347 @@
+import Link from "next/link";
+import { redirect } from "next/navigation";
+import { Alert, AlertDescription } from "@/components/ui/alert";
+import {
+  Empty,
+  EmptyContent,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+} from "@/components/ui/empty";
+import { getWorkspaceInbox } from "@/data/automations";
+import type {
+  AutomationDigest,
+  InboxMessage,
+  InboxPriorityLevel,
+  WorkspaceInboxEntry,
+} from "@/data/automations-types";
+import { createClient } from "@/lib/server";
+
+type EntryAutomation = WorkspaceInboxEntry["automation"];
+type EntryOwner = WorkspaceInboxEntry["owner"];
+
+export default async function InboxPage() {
+  const supabase = await createClient();
+  const {
+    data: { session },
+  } = await supabase.auth.getSession();
+  if (!session) redirect("/auth/login");
+
+  let entries: WorkspaceInboxEntry[] = [];
+  let digest: AutomationDigest | null = null;
+  let loadErr: string | null = null;
+  try {
+    ({ entries, digest } = await getWorkspaceInbox());
+  } catch (e) {
+    loadErr = (e as Error).message;
+  }
+
+  const rows = entries
+    .flatMap((entry) =>
+      entry.messages.map((msg) => ({ msg, automation: entry.automation, owner: entry.owner })),
+    )
+    .sort((a, b) => (a.msg.created_at < b.msg.created_at ? 1 : -1));
+  // Entries arrive ranked highest-priority first (server-side scoring); keep that order.
+  const subscriptions = entries.filter((e) => e.inbox);
+  const needsAttention = entries.filter((e) => e.priority.level !== "low");
+
+  return (
+    <main className="mx-auto w-full max-w-4xl px-4 py-8 sm:px-6">
+      <h1 className="mb-1 font-semibold text-2xl tracking-tight">Inbox</h1>
+      <p className="mb-6 max-w-2xl text-muted-foreground text-sm">
+        Incoming triggers that fire your automations — new rows, webhooks, emails, and more land
+        here before Foreman runs.
+      </p>
+
+      {loadErr ? (
+        <Alert variant="destructive">
+          <AlertDescription>Couldn&apos;t load the inbox: {loadErr}</AlertDescription>
+        </Alert>
+      ) : entries.length === 0 && !digest ? (
+        <InboxEmpty />
+      ) : (
+        <div className="space-y-8">
+          {digest && <DigestCard digest={digest} />}
+
+          {needsAttention.length > 0 && (
+            <section>
+              <h2 className="mb-3 text-xs font-semibold uppercase tracking-wider text-muted-foreground">
+                Needs attention ({needsAttention.length})
+              </h2>
+              <ul className="divide-y divide-border overflow-hidden rounded-xl border border-border">
+                {needsAttention.map((entry) => (
+                  <AttentionRow key={entry.automation.id} entry={entry} />
+                ))}
+              </ul>
+            </section>
+          )}
+
+          <section>
+            <h2 className="mb-3 text-xs font-semibold uppercase tracking-wider text-muted-foreground">
+              Listening ({subscriptions.length})
+            </h2>
+            <div className="grid gap-3 sm:grid-cols-2">
+              {subscriptions.map((entry) => (
+                <SubscriptionCard key={entry.automation.id} entry={entry} />
+              ))}
+            </div>
+          </section>
+
+          <section>
+            <h2 className="mb-3 text-xs font-semibold uppercase tracking-wider text-muted-foreground">
+              Recent activity
+            </h2>
+            {rows.length === 0 ? (
+              <div className="rounded-xl border border-dashed border-border bg-surface/30 px-4 py-8 text-center text-sm text-muted-foreground">
+                No events yet. When a trigger fires, it shows up here before the run.
+              </div>
+            ) : (
+              <ul className="divide-y divide-border overflow-hidden rounded-xl border border-border">
+                {rows.map(({ msg, automation, owner }) => (
+                  <MessageRow key={msg.id} msg={msg} automation={automation} owner={owner} />
+                ))}
+              </ul>
+            )}
+          </section>
+        </div>
+      )}
+    </main>
+  );
+}
+
+function triggerLabel(automation: EntryAutomation): string {
+  const t = automation.trigger;
+  if (t?.app && t?.action) return `${t.app} · ${t.action}`;
+  if (t?.app) return t.app;
+  return "trigger";
+}
+
+function DigestCard({ digest }: { digest: AutomationDigest }) {
+  const { totals, failures, waiting } = digest;
+  const when = new Date(digest.periodEnd).toLocaleDateString(undefined, {
+    weekday: "long",
+    month: "short",
+    day: "numeric",
+  });
+  return (
+    <section className="rounded-xl border border-border bg-surface/40 p-4">
+      <div className="mb-2 flex flex-wrap items-baseline justify-between gap-x-3 gap-y-1">
+        <h2 className="font-semibold text-sm text-foreground">Daily digest</h2>
+        <span className="text-muted-foreground text-xs">{when}</span>
+      </div>
+      {digest.narrative && (
+        <p className="text-foreground text-sm leading-relaxed">{digest.narrative}</p>
+      )}
+      <p
+        className={`text-sm ${digest.narrative ? "mt-1 text-muted-foreground" : "font-medium text-foreground"}`}
+      >
+        {digest.headline}
+      </p>
+      {totals.total > 0 && (failures.length > 0 || waiting.length > 0) && (
+        <ul className="mt-3 space-y-1.5 text-sm">
+          {failures.map((f) => (
+            <li key={`f-${f.automationId}-${f.createdAt}`} className="flex items-start gap-2">
+              <PriorityDot level="high" className="mt-1.5" />
+              <span className="min-w-0">
+                <span className="font-medium text-foreground">{f.automationName}</span>{" "}
+                <span className="text-destructive text-xs">
+                  failed{f.error ? ` — ${f.error}` : ""}
+                </span>
+              </span>
+            </li>
+          ))}
+          {waiting.map((w) => (
+            <li key={`w-${w.automationId}-${w.createdAt}`} className="flex items-start gap-2">
+              <PriorityDot level="medium" className="mt-1.5" />
+              <span className="min-w-0">
+                <span className="font-medium text-foreground">{w.automationName}</span>{" "}
+                <span className="text-muted-foreground text-xs">waiting for approval</span>
+              </span>
+            </li>
+          ))}
+        </ul>
+      )}
+    </section>
+  );
+}
+
+function SubscriptionCard({ entry }: { entry: WorkspaceInboxEntry }) {
+  const { automation, inbox, owner, priority } = entry;
+  const paused = inbox?.paused_reason;
+  return (
+    <Link
+      href={`/automations?selected=${automation.id}`}
+      className="block rounded-xl border border-border bg-surface/40 p-4 transition-colors hover:bg-surface/70"
+    >
+      <div className="flex items-center justify-between gap-2">
+        <span className="truncate text-sm font-medium text-foreground">{automation.name}</span>
+        <div className="flex shrink-0 items-center gap-1.5">
+          <PriorityPill level={priority.level} />
+          <StatusDot ok={!paused && automation.enabled && priority.level !== "high"} />
+        </div>
+      </div>
+      <div className="mt-1 flex flex-wrap items-center gap-x-2 gap-y-1">
+        <span className="truncate font-mono text-xs text-muted-foreground">
+          {triggerLabel(automation)}
+        </span>
+        <OwnerChip owner={owner} />
+      </div>
+      {paused ? (
+        <p className="mt-2 text-xs text-amber-600 dark:text-amber-400">Paused — {paused}</p>
+      ) : priority.reasons.length > 0 && priority.level !== "low" ? (
+        <p className="mt-2 truncate text-xs text-muted-foreground">
+          {priority.reasons.join(" · ")}
+        </p>
+      ) : (
+        <p className="mt-2 text-xs text-muted-foreground">
+          {automation.enabled ? "Active" : "Disabled"}
+        </p>
+      )}
+    </Link>
+  );
+}
+
+/** One high/medium-priority automation in the "Needs attention" list. */
+function AttentionRow({ entry }: { entry: WorkspaceInboxEntry }) {
+  const { automation, owner, priority } = entry;
+  return (
+    <li className="bg-card px-4 py-3 text-sm">
+      <Link href={`/automations?selected=${automation.id}`} className="flex items-start gap-3">
+        <PriorityDot level={priority.level} className="mt-1.5" />
+        <div className="min-w-0 flex-1">
+          <div className="flex flex-wrap items-center gap-x-2 gap-y-1">
+            <span className="font-medium text-foreground">{automation.name}</span>
+            <span className="font-mono text-xs text-muted-foreground">
+              {triggerLabel(automation)}
+            </span>
+            <OwnerChip owner={owner} />
+          </div>
+          {priority.reasons.length > 0 && (
+            <p className="mt-1 text-xs text-muted-foreground">{priority.reasons.join(" · ")}</p>
+          )}
+        </div>
+        <PriorityPill level={priority.level} />
+      </Link>
+    </li>
+  );
+}
+
+function MessageRow({
+  msg,
+  automation,
+  owner,
+}: {
+  msg: InboxMessage;
+  automation: EntryAutomation;
+  owner: EntryOwner;
+}) {
+  const dup = msg.message_attributes?.possible_duplicate_data;
+  const err = msg.message_attributes?.error_message;
+  return (
+    <li className="flex items-start gap-3 bg-card px-4 py-3 text-sm">
+      <StatusDot ok={!err} className="mt-1.5" />
+      <div className="min-w-0 flex-1">
+        <div className="flex flex-wrap items-center gap-x-2 gap-y-1">
+          <span className="font-medium text-foreground">{automation.name}</span>
+          <span className="font-mono text-xs text-muted-foreground">
+            {triggerLabel(automation)}
+          </span>
+          <OwnerChip owner={owner} />
+          <Badge>{msg.status}</Badge>
+          {dup && <Badge tone="warn">duplicate</Badge>}
+        </div>
+        {err && <p className="mt-1 text-xs text-destructive">{err}</p>}
+      </div>
+      <time className="shrink-0 text-xs text-muted-foreground tabular-nums">
+        {new Date(msg.created_at).toLocaleString()}
+      </time>
+    </li>
+  );
+}
+
+function OwnerChip({ owner }: { owner: EntryOwner }) {
+  if (owner.isSelf) return null;
+  return <Badge tone="teammate">teammate</Badge>;
+}
+
+function PriorityPill({ level }: { level: InboxPriorityLevel }) {
+  if (level === "low") return null;
+  const label = level === "high" ? "High" : "Medium";
+  const cls =
+    level === "high"
+      ? "bg-destructive/10 text-destructive"
+      : "bg-amber-500/10 text-amber-600 dark:text-amber-400";
+  return (
+    <span
+      className={`inline-flex items-center rounded-full px-2 py-0.5 text-[10px] font-medium uppercase tracking-wide ${cls}`}
+    >
+      {label}
+    </span>
+  );
+}
+
+function PriorityDot({ level, className = "" }: { level: InboxPriorityLevel; className?: string }) {
+  const color =
+    level === "high"
+      ? "bg-destructive"
+      : level === "medium"
+        ? "bg-amber-500"
+        : "bg-muted-foreground";
+  return <span className={`h-2 w-2 shrink-0 rounded-full ${color} ${className}`} aria-hidden />;
+}
+
+function Badge({ children, tone }: { children: React.ReactNode; tone?: "warn" | "teammate" }) {
+  const cls =
+    tone === "warn"
+      ? "bg-amber-500/10 text-amber-600 dark:text-amber-400"
+      : tone === "teammate"
+        ? "bg-accent/10 text-accent-foreground/80"
+        : "bg-surface text-muted-foreground";
+  return (
+    <span
+      className={`inline-flex items-center rounded-full px-2 py-0.5 text-[10px] font-medium uppercase tracking-wide ${cls}`}
+    >
+      {children}
+    </span>
+  );
+}
+
+function StatusDot({ ok, className = "" }: { ok: boolean; className?: string }) {
+  return (
+    <span
+      className={`h-2 w-2 shrink-0 rounded-full ${ok ? "bg-green-500" : "bg-amber-500"} ${className}`}
+      aria-hidden
+    />
+  );
+}
+
+function InboxEmpty() {
+  return (
+    <Empty className="border bg-card">
+      <EmptyHeader>
+        <EmptyTitle>No inbox activity yet</EmptyTitle>
+        <EmptyDescription>
+          When you have an automation with a trigger, every incoming event — a new row, a webhook,
+          an email — lands here before Foreman runs it. Ask Foreman in chat to build an automation
+          to start listening.
+        </EmptyDescription>
+      </EmptyHeader>
+      <EmptyContent>
+        <div className="flex flex-wrap items-center justify-center gap-2">
+          <Link
+            href="/chat"
+            className="inline-flex items-center rounded-md bg-accent px-4 py-2 text-sm font-medium text-accent-foreground"
+          >
+            Go to chat
+          </Link>
+          <Link
+            href="/automations"
+            className="inline-flex items-center rounded-md border border-border px-4 py-2 text-sm font-medium text-foreground hover:bg-surface"
+          >
+            View automations
+          </Link>
+        </div>
+      </EmptyContent>
+    </Empty>
+  );
+}
diff --git a/packages/web/src/app/layout.tsx b/packages/web/src/app/layout.tsx
index e4967e34..a6b77398 100644
--- a/packages/web/src/app/layout.tsx
+++ b/packages/web/src/app/layout.tsx
@@ -16,7 +16,7 @@ const geistMono = Geist_Mono({
 
 export const metadata: Metadata = {
   title: "Foreman",
-  description: "AI assistant that helps you take actions across 9000+ apps via Zapier",
+  description: "AI assistant that helps you take actions across 10,000+ apps via Zapier",
 };
 
 export default function RootLayout({
diff --git a/packages/web/src/app/page.tsx b/packages/web/src/app/page.tsx
index d4905f6a..dea6db84 100644
--- a/packages/web/src/app/page.tsx
+++ b/packages/web/src/app/page.tsx
@@ -1,3 +1,4 @@
+import { Automations } from "@/components/landing/sections/automations";
 import { Channels } from "@/components/landing/sections/channels";
 import { ClosingCta } from "@/components/landing/sections/closing-cta";
 import { FiveThings } from "@/components/landing/sections/five-things";
@@ -6,29 +7,30 @@ import { Hero } from "@/components/landing/sections/hero";
 import { HistorySection } from "@/components/landing/sections/history-section";
 import { Hosting } from "@/components/landing/sections/hosting";
 import { HowItWorks } from "@/components/landing/sections/how-it-works";
+import { MoreCapabilities } from "@/components/landing/sections/more-capabilities";
 import { PiiSection } from "@/components/landing/sections/pii-section";
 import { ReasoningTrace } from "@/components/landing/sections/reasoning-trace";
 import { SiteFooter } from "@/components/landing/sections/site-footer";
 import { ToolDiscoverySection } from "@/components/landing/sections/tool-discovery-section";
 import { WhyNotZap } from "@/components/landing/sections/why-not-zap";
-import { Workflows } from "@/components/landing/sections/workflows";
 import { SiteNav } from "@/components/landing/site-nav";
 
 export default function LandingPage() {
   return (
-    <div className="min-h-screen flex flex-col bg-background overflow-x-hidden">
+    <div className="landing-brand-lock min-h-screen flex flex-col bg-background overflow-x-clip">
       <SiteNav />
       <main className="flex-1 min-w-0">
         <Hero />
         <WhyNotZap />
         <HowItWorks />
         <ReasoningTrace />
+        <Automations />
         <ToolDiscoverySection />
         <Channels />
         <Guardrails />
         <HistorySection />
         <PiiSection />
-        <Workflows />
+        <MoreCapabilities />
         <Hosting />
         <FiveThings />
         <ClosingCta />
diff --git a/packages/web/src/app/settings/layout.tsx b/packages/web/src/app/settings/layout.tsx
index bcb69753..fa795d4d 100644
--- a/packages/web/src/app/settings/layout.tsx
+++ b/packages/web/src/app/settings/layout.tsx
@@ -1,5 +1,6 @@
 import { redirect } from "next/navigation";
 import { Suspense } from "react";
+import { AppShell } from "@/components/app-shell";
 import { SettingsShell } from "@/components/settings/settings-shell";
 import { createClient } from "@/lib/server";
 
@@ -14,8 +15,10 @@ async function AuthedLayout({ children }: { children: React.ReactNode }) {
 
 export default function SettingsLayout({ children }: { children: React.ReactNode }) {
   return (
-    <Suspense fallback={<SettingsShell>{children}</SettingsShell>}>
-      <AuthedLayout>{children}</AuthedLayout>
-    </Suspense>
+    <AppShell>
+      <Suspense fallback={<SettingsShell>{children}</SettingsShell>}>
+        <AuthedLayout>{children}</AuthedLayout>
+      </Suspense>
+    </AppShell>
   );
 }
diff --git a/packages/web/src/app/settings/profile/page.tsx b/packages/web/src/app/settings/profile/page.tsx
new file mode 100644
index 00000000..f4533f78
--- /dev/null
+++ b/packages/web/src/app/settings/profile/page.tsx
@@ -0,0 +1,5 @@
+import { ProfileForm } from "@/components/settings/profile-form";
+
+export default function ProfilePage() {
+  return <ProfileForm />;
+}
diff --git a/packages/web/src/app/workflows/[id]/page.tsx b/packages/web/src/app/workflows/[id]/page.tsx
deleted file mode 100644
index 8626ebda..00000000
--- a/packages/web/src/app/workflows/[id]/page.tsx
+++ /dev/null
@@ -1,194 +0,0 @@
-import Link from "next/link";
-import { notFound, redirect } from "next/navigation";
-import { TriggerControls } from "@/components/workflows/trigger-controls";
-import { WorkflowDetailActions } from "@/components/workflows/workflow-detail-actions";
-import { createClient } from "@/lib/server";
-import {
-  getWorkflow,
-  listRuns,
-  listTriggers,
-  type WorkflowRun,
-  type WorkflowTrigger,
-} from "@/lib/workflows-client";
-
-export default async function WorkflowDetailPage({ params }: { params: Promise<{ id: string }> }) {
-  const { id } = await params;
-  const supabase = await createClient();
-  const {
-    data: { session },
-  } = await supabase.auth.getSession();
-  if (!session) redirect("/auth/login");
-
-  let detail: Awaited<ReturnType<typeof getWorkflow>>;
-  try {
-    detail = await getWorkflow(id, session.access_token);
-  } catch {
-    notFound();
-  }
-  const [{ triggers }, runs] = await Promise.all([
-    listTriggers(id, session.access_token).catch(() => ({ triggers: [] as WorkflowTrigger[] })),
-    listRuns(id, session.access_token).catch(() => [] as WorkflowRun[]),
-  ]);
-
-  return (
-    <div className="space-y-8">
-      <div>
-        <Link href="/workflows" className="text-xs hover:underline" style={{ color: "#7A6A5C" }}>
-          ← All workflows
-        </Link>
-        <h1 className="mt-2 text-2xl font-semibold tracking-tight" style={{ color: "#201515" }}>
-          {detail.workflow.name}
-        </h1>
-        <p className="mt-1 text-xs" style={{ color: "#7A6A5C" }}>
-          {detail.workflow.parameters.length === 0
-            ? "no parameters"
-            : `parameters: ${detail.workflow.parameters.join(", ")}`}
-        </p>
-      </div>
-
-      <WorkflowDetailActions workflowId={detail.workflow.id} currentName={detail.workflow.name} />
-
-      <Section title="Steps">
-        <ol className="space-y-2">
-          {detail.steps.map((s, i) => {
-            const t = s.proposal_template;
-            return (
-              <li
-                key={s.id}
-                className="rounded border px-4 py-3"
-                style={{ borderColor: "#FFF3E6", backgroundColor: "#FFF" }}
-              >
-                <div className="text-xs uppercase tracking-wide" style={{ color: "#7A6A5C" }}>
-                  Step {i + 1}
-                </div>
-                <div className="text-sm font-medium" style={{ color: "#201515" }}>
-                  {t.human_label ?? `${t.app_key ?? "?"}.${t.action_key ?? "?"}`}
-                </div>
-                {t.inputs && Object.keys(t.inputs).length > 0 ? (
-                  <pre
-                    className="mt-2 overflow-x-auto rounded p-2 text-[11px]"
-                    style={{ backgroundColor: "#FAF5EE", color: "#201515" }}
-                  >
-                    {JSON.stringify(t.inputs, null, 2)}
-                  </pre>
-                ) : null}
-              </li>
-            );
-          })}
-        </ol>
-      </Section>
-
-      <Section title="Triggers">
-        {triggers.length === 0 ? (
-          <p className="text-sm" style={{ color: "#7A6A5C" }}>
-            No triggers attached. Ask Foreman in chat to schedule this or bind it to a chat command.
-          </p>
-        ) : (
-          <ul className="space-y-2">
-            {triggers.map((t) => (
-              <TriggerRow key={t.id} workflowId={detail.workflow.id} trigger={t} />
-            ))}
-          </ul>
-        )}
-      </Section>
-
-      <Section title="Run history">
-        {runs.length === 0 ? (
-          <p className="text-sm" style={{ color: "#7A6A5C" }}>
-            No runs yet.
-          </p>
-        ) : (
-          <ul className="divide-y rounded-lg border" style={{ borderColor: "#FFF3E6" }}>
-            {runs.map((r) => (
-              <li key={r.id}>
-                <Link
-                  href={`/workflows/${detail.workflow.id}/runs/${r.id}`}
-                  className="flex items-center justify-between px-4 py-3 hover:bg-black/[0.02]"
-                >
-                  <div className="min-w-0 text-sm">
-                    <span className="font-medium" style={{ color: "#201515" }}>
-                      {new Date(r.created_at).toLocaleString()}
-                    </span>
-                    <span className="ml-2 text-xs" style={{ color: "#7A6A5C" }}>
-                      · {r.fired_by ?? "manual"}
-                    </span>
-                    {r.status === "failed" && r.error_message ? (
-                      <span className="ml-2 truncate text-xs" style={{ color: "#A61B1B" }}>
-                        — {r.error_message}
-                      </span>
-                    ) : null}
-                  </div>
-                  <StatusBadge status={r.status} />
-                </Link>
-              </li>
-            ))}
-          </ul>
-        )}
-      </Section>
-    </div>
-  );
-}
-
-function Section({ title, children }: { title: string; children: React.ReactNode }) {
-  return (
-    <section>
-      <h2
-        className="mb-3 text-sm font-semibold uppercase tracking-wide"
-        style={{ color: "#7A6A5C" }}
-      >
-        {title}
-      </h2>
-      {children}
-    </section>
-  );
-}
-
-function StatusBadge({ status }: { status: WorkflowRun["status"] }) {
-  const map: Record<WorkflowRun["status"], { bg: string; fg: string; label: string }> = {
-    success: { bg: "#E6F4EA", fg: "#1B6633", label: "succeeded" },
-    failed: { bg: "#FCE8E6", fg: "#A61B1B", label: "failed" },
-    running: { bg: "#FFF1E0", fg: "#7A4A1A", label: "running" },
-  };
-  const s = map[status] ?? map.running;
-  return (
-    <span
-      className="inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium"
-      style={{ backgroundColor: s.bg, color: s.fg }}
-    >
-      {s.label}
-    </span>
-  );
-}
-
-function TriggerRow({ workflowId, trigger }: { workflowId: string; trigger: WorkflowTrigger }) {
-  return (
-    <li
-      className="flex items-center justify-between rounded border px-4 py-3"
-      style={{ borderColor: "#FFF3E6", backgroundColor: "#FFF" }}
-    >
-      <div className="text-sm">
-        <div className="font-medium" style={{ color: "#201515" }}>
-          {triggerLabel(trigger)}
-        </div>
-        <div className="mt-0.5 text-xs" style={{ color: "#7A6A5C" }}>
-          {trigger.last_fired_at
-            ? `last fired ${new Date(trigger.last_fired_at).toLocaleString()}`
-            : "never fired"}
-        </div>
-      </div>
-      <TriggerControls workflowId={workflowId} trigger={trigger} />
-    </li>
-  );
-}
-
-function triggerLabel(t: WorkflowTrigger): string {
-  if (t.type === "cron") {
-    const c = t.config as { schedule?: string; timezone?: string };
-    return `Cron · ${c.schedule ?? "?"}${c.timezone ? ` (${c.timezone})` : ""}`;
-  }
-  if (t.type === "channel") {
-    const c = t.config as { channel?: string; match?: { command?: string } };
-    return `Channel · ${c.channel ?? "?"}${c.match?.command ? ` · ${c.match.command}` : ""}`;
-  }
-  return `${t.type}`;
-}
diff --git a/packages/web/src/app/workflows/[id]/runs/[runId]/page.tsx b/packages/web/src/app/workflows/[id]/runs/[runId]/page.tsx
deleted file mode 100644
index 8f59364b..00000000
--- a/packages/web/src/app/workflows/[id]/runs/[runId]/page.tsx
+++ /dev/null
@@ -1,90 +0,0 @@
-import Link from "next/link";
-import { notFound, redirect } from "next/navigation";
-import { createClient } from "@/lib/server";
-import { listRuns } from "@/lib/workflows-client";
-
-export default async function RunDetailPage({
-  params,
-}: {
-  params: Promise<{ id: string; runId: string }>;
-}) {
-  const { id, runId } = await params;
-  const supabase = await createClient();
-  const {
-    data: { session },
-  } = await supabase.auth.getSession();
-  if (!session) redirect("/auth/login");
-
-  const runs = await listRuns(id, session.access_token).catch(() => []);
-  const run = runs.find((r) => r.id === runId);
-  if (!run) notFound();
-
-  const duration =
-    run.completed_at && run.created_at
-      ? Math.round(
-          (new Date(run.completed_at).getTime() - new Date(run.created_at).getTime()) / 1000,
-        )
-      : null;
-
-  return (
-    <div className="space-y-6">
-      <div>
-        <Link
-          href={`/workflows/${id}`}
-          className="text-xs hover:underline"
-          style={{ color: "#7A6A5C" }}
-        >
-          ← Back to workflow
-        </Link>
-        <h1 className="mt-2 text-2xl font-semibold tracking-tight" style={{ color: "#201515" }}>
-          Run · {new Date(run.created_at).toLocaleString()}
-        </h1>
-        <p className="mt-1 text-xs" style={{ color: "#7A6A5C" }}>
-          status: <span style={{ color: "#201515" }}>{run.status}</span>
-          {" · started by: "}
-          <span style={{ color: "#201515" }}>{run.fired_by ?? "manual"}</span>
-          {duration != null ? (
-            <>
-              {" · duration: "}
-              <span style={{ color: "#201515" }}>{duration}s</span>
-            </>
-          ) : null}
-        </p>
-        {run.status === "failed" && run.error_message ? (
-          <p
-            className="mt-2 rounded border px-3 py-2 text-xs"
-            style={{ borderColor: "#FAD2CE", backgroundColor: "#FFF6F5", color: "#A61B1B" }}
-          >
-            {run.error_message}
-          </p>
-        ) : null}
-      </div>
-
-      <section>
-        <h2
-          className="mb-2 text-sm font-semibold uppercase tracking-wide"
-          style={{ color: "#7A6A5C" }}
-        >
-          Inputs
-        </h2>
-        {Object.keys(run.inputs ?? {}).length === 0 ? (
-          <p className="text-sm" style={{ color: "#7A6A5C" }}>
-            No inputs.
-          </p>
-        ) : (
-          <pre
-            className="overflow-x-auto rounded border p-3 text-xs"
-            style={{ borderColor: "#FFF3E6", backgroundColor: "#FFF" }}
-          >
-            {JSON.stringify(run.inputs, null, 2)}
-          </pre>
-        )}
-      </section>
-
-      <p className="text-xs" style={{ color: "#7A6A5C" }}>
-        Per-step input/output capture is on the roadmap. For now the run shows status, timing, and
-        the inputs you provided. The agent server logs hold full step traces.
-      </p>
-    </div>
-  );
-}
diff --git a/packages/web/src/app/workflows/layout.tsx b/packages/web/src/app/workflows/layout.tsx
deleted file mode 100644
index d681e97f..00000000
--- a/packages/web/src/app/workflows/layout.tsx
+++ /dev/null
@@ -1,21 +0,0 @@
-import { redirect } from "next/navigation";
-import { Suspense } from "react";
-import { WorkflowsShell } from "@/components/workflows/workflows-shell";
-import { createClient } from "@/lib/server";
-
-async function AuthedLayout({ children }: { children: React.ReactNode }) {
-  const supabase = await createClient();
-  const {
-    data: { session },
-  } = await supabase.auth.getSession();
-  if (!session) redirect("/auth/login");
-  return <WorkflowsShell>{children}</WorkflowsShell>;
-}
-
-export default function WorkflowsLayout({ children }: { children: React.ReactNode }) {
-  return (
-    <Suspense fallback={<WorkflowsShell>{children}</WorkflowsShell>}>
-      <AuthedLayout>{children}</AuthedLayout>
-    </Suspense>
-  );
-}
diff --git a/packages/web/src/app/workflows/page.tsx b/packages/web/src/app/workflows/page.tsx
deleted file mode 100644
index 9cd16b65..00000000
--- a/packages/web/src/app/workflows/page.tsx
+++ /dev/null
@@ -1,108 +0,0 @@
-import Link from "next/link";
-import { redirect } from "next/navigation";
-import { createClient } from "@/lib/server";
-import { listWorkflows, type WorkflowSummary } from "@/lib/workflows-client";
-
-export default async function WorkflowsListPage() {
-  const supabase = await createClient();
-  const {
-    data: { session },
-  } = await supabase.auth.getSession();
-  if (!session) redirect("/auth/login");
-
-  let workflows: WorkflowSummary[] = [];
-  let loadError: string | null = null;
-  try {
-    workflows = await listWorkflows(session.access_token);
-  } catch (e) {
-    loadError = (e as Error).message;
-  }
-
-  return (
-    <div className="space-y-6">
-      <header className="flex items-end justify-between">
-        <div>
-          <h1 className="text-2xl font-semibold tracking-tight" style={{ color: "#201515" }}>
-            Saved workflows
-          </h1>
-          <p className="mt-1 text-sm" style={{ color: "#7A6A5C" }}>
-            Workflows you've saved from chat. Re-run, schedule, or delete from here.
-          </p>
-        </div>
-      </header>
-
-      {loadError ? (
-        <div
-          className="rounded-md border px-4 py-3 text-sm"
-          style={{ borderColor: "#FFD7B5", backgroundColor: "#FFF5EB", color: "#7A4A1A" }}
-        >
-          Couldn't load workflows: {loadError}
-        </div>
-      ) : workflows.length === 0 ? (
-        <EmptyState />
-      ) : (
-        <ul className="divide-y rounded-lg border" style={{ borderColor: "#FFF3E6" }}>
-          {workflows.map((w) => (
-            <li key={w.id}>
-              <Link
-                href={`/workflows/${w.id}`}
-                className="flex items-center justify-between px-5 py-4 hover:bg-black/[0.02]"
-              >
-                <div className="min-w-0">
-                  <div className="font-medium truncate" style={{ color: "#201515" }}>
-                    {w.name}
-                  </div>
-                  <div className="mt-0.5 text-xs" style={{ color: "#7A6A5C" }}>
-                    {w.parameters.length === 0
-                      ? "no parameters"
-                      : `parameters: ${w.parameters.join(", ")}`}
-                  </div>
-                </div>
-                <div className="text-xs whitespace-nowrap pl-4" style={{ color: "#7A6A5C" }}>
-                  updated {formatRelative(w.updated_at)}
-                </div>
-              </Link>
-            </li>
-          ))}
-        </ul>
-      )}
-    </div>
-  );
-}
-
-function EmptyState() {
-  return (
-    <div
-      className="rounded-lg border px-8 py-12 text-center"
-      style={{ borderColor: "#FFF3E6", backgroundColor: "#FFF" }}
-    >
-      <div className="text-base font-medium" style={{ color: "#201515" }}>
-        No workflows saved yet
-      </div>
-      <p className="mt-2 text-sm max-w-md mx-auto" style={{ color: "#7A6A5C" }}>
-        After Foreman runs a multi-step or recurring task in chat, you'll be offered to save it.
-        Saved workflows show up here.
-      </p>
-      <Link
-        href="/chat"
-        className="mt-4 inline-flex items-center rounded-md px-4 py-2 text-sm font-medium text-white"
-        style={{ backgroundColor: "#FF4F00" }}
-      >
-        Go to chat
-      </Link>
-    </div>
-  );
-}
-
-function formatRelative(iso: string): string {
-  const t = new Date(iso).getTime();
-  const diff = Date.now() - t;
-  const m = Math.round(diff / 60_000);
-  if (m < 1) return "just now";
-  if (m < 60) return `${m}m ago`;
-  const h = Math.round(m / 60);
-  if (h < 24) return `${h}h ago`;
-  const d = Math.round(h / 24);
-  if (d < 30) return `${d}d ago`;
-  return new Date(iso).toLocaleDateString();
-}
diff --git a/packages/web/src/app/workspaces/layout.tsx b/packages/web/src/app/workspaces/layout.tsx
new file mode 100644
index 00000000..6dcf0808
--- /dev/null
+++ b/packages/web/src/app/workspaces/layout.tsx
@@ -0,0 +1,5 @@
+import { AppShell } from "@/components/app-shell";
+
+export default function WorkspacesLayout({ children }: { children: React.ReactNode }) {
+  return <AppShell>{children}</AppShell>;
+}
diff --git a/packages/web/src/app/workspaces/page.tsx b/packages/web/src/app/workspaces/page.tsx
new file mode 100644
index 00000000..42cbb51f
--- /dev/null
+++ b/packages/web/src/app/workspaces/page.tsx
@@ -0,0 +1,21 @@
+import { redirect } from "next/navigation";
+import { WorkspacesManager } from "@/components/workspaces/workspaces-manager";
+import { createClient } from "@/lib/server";
+
+export default async function WorkspacesPage() {
+  const supabase = await createClient();
+  const {
+    data: { session },
+  } = await supabase.auth.getSession();
+  if (!session) redirect("/auth/login");
+
+  return (
+    <main className="mx-auto w-full max-w-3xl px-4 py-8 sm:px-6">
+      <h1 className="mb-1 font-semibold text-2xl tracking-tight">Workspaces</h1>
+      <p className="mb-6 text-muted-foreground text-sm">
+        Manage your workspaces, members, invitations, and connection settings.
+      </p>
+      <WorkspacesManager />
+    </main>
+  );
+}
diff --git a/packages/web/src/components/ai-elements/artifact.tsx b/packages/web/src/components/ai-elements/artifact.tsx
new file mode 100644
index 00000000..26aa854e
--- /dev/null
+++ b/packages/web/src/components/ai-elements/artifact.tsx
@@ -0,0 +1,118 @@
+"use client";
+
+import { type LucideIcon, XIcon } from "lucide-react";
+import type { ComponentProps, HTMLAttributes } from "react";
+import { Button } from "@/components/ui/button";
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "@/components/ui/tooltip";
+import { cn } from "@/lib/utils";
+
+export type ArtifactProps = HTMLAttributes<HTMLDivElement>;
+
+export const Artifact = ({ className, ...props }: ArtifactProps) => (
+  <div
+    className={cn(
+      "flex flex-col overflow-hidden rounded-lg border bg-background shadow-sm",
+      className,
+    )}
+    {...props}
+  />
+);
+
+export type ArtifactHeaderProps = HTMLAttributes<HTMLDivElement>;
+
+export const ArtifactHeader = ({ className, ...props }: ArtifactHeaderProps) => (
+  <div
+    className={cn("flex items-center justify-between border-b bg-muted/50 px-4 py-3", className)}
+    {...props}
+  />
+);
+
+export type ArtifactCloseProps = ComponentProps<typeof Button>;
+
+export const ArtifactClose = ({
+  className,
+  children,
+  size = "sm",
+  variant = "ghost",
+  ...props
+}: ArtifactCloseProps) => (
+  <Button
+    className={cn("size-8 p-0 text-muted-foreground hover:text-foreground", className)}
+    size={size}
+    type="button"
+    variant={variant}
+    {...props}
+  >
+    {children ?? <XIcon className="size-4" />}
+    <span className="sr-only">Close</span>
+  </Button>
+);
+
+export type ArtifactTitleProps = HTMLAttributes<HTMLParagraphElement>;
+
+export const ArtifactTitle = ({ className, ...props }: ArtifactTitleProps) => (
+  <p className={cn("font-medium text-foreground text-sm", className)} {...props} />
+);
+
+export type ArtifactDescriptionProps = HTMLAttributes<HTMLParagraphElement>;
+
+export const ArtifactDescription = ({ className, ...props }: ArtifactDescriptionProps) => (
+  <p className={cn("text-muted-foreground text-sm", className)} {...props} />
+);
+
+export type ArtifactActionsProps = HTMLAttributes<HTMLDivElement>;
+
+export const ArtifactActions = ({ className, ...props }: ArtifactActionsProps) => (
+  <div className={cn("flex items-center gap-1", className)} {...props} />
+);
+
+export type ArtifactActionProps = ComponentProps<typeof Button> & {
+  tooltip?: string;
+  label?: string;
+  icon?: LucideIcon;
+};
+
+export const ArtifactAction = ({
+  tooltip,
+  label,
+  icon: Icon,
+  children,
+  className,
+  size = "sm",
+  variant = "ghost",
+  ...props
+}: ArtifactActionProps) => {
+  const button = (
+    <Button
+      className={cn("size-8 p-0 text-muted-foreground hover:text-foreground", className)}
+      size={size}
+      type="button"
+      variant={variant}
+      {...props}
+    >
+      {Icon ? <Icon className="size-4" /> : children}
+      <span className="sr-only">{label || tooltip}</span>
+    </Button>
+  );
+
+  if (tooltip) {
+    return (
+      <TooltipProvider>
+        <Tooltip>
+          <TooltipTrigger asChild>{button}</TooltipTrigger>
+          <TooltipContent>
+            <p>{tooltip}</p>
+          </TooltipContent>
+        </Tooltip>
+      </TooltipProvider>
+    );
+  }
+
+  return button;
+};
+
+export type ArtifactContentProps = HTMLAttributes<HTMLDivElement>;
+
+export const ArtifactContent = ({ className, ...props }: ArtifactContentProps) => (
+  <div className={cn("flex-1 overflow-auto p-4", className)} {...props} />
+);
diff --git a/packages/web/src/components/ai-elements/checkpoint.tsx b/packages/web/src/components/ai-elements/checkpoint.tsx
deleted file mode 100644
index 4cc8c6c2..00000000
--- a/packages/web/src/components/ai-elements/checkpoint.tsx
+++ /dev/null
@@ -1,61 +0,0 @@
-/**
- * Checkpoint — AI Elements component (https://elements.ai-sdk.dev/components/checkpoint).
- * A restore-point marker for the conversation (icon + trigger + separator lines),
- * inspired by VSCode Copilot checkpoints. UI-only — the parent owns what "restore"
- * does. Ported from myrp-build, retokenized to Foreman's shadcn palette.
- */
-"use client";
-
-import { BookmarkIcon } from "lucide-react";
-import type { ComponentProps, ReactNode } from "react";
-import { Button } from "@/components/ui/button";
-import { cn } from "@/lib/utils";
-
-export type CheckpointProps = ComponentProps<"div">;
-
-/** Centered marker flanked by separator lines, dividing conversation segments. */
-export function Checkpoint({ className, children, ...props }: CheckpointProps) {
-  return (
-    <div
-      className={cn("flex items-center gap-2 py-2 text-[11px] text-muted-foreground", className)}
-      {...props}
-    >
-      <div className="h-px flex-1 bg-border" />
-      <div className="flex items-center gap-1.5">{children}</div>
-      <div className="h-px flex-1 bg-border" />
-    </div>
-  );
-}
-
-export type CheckpointIconProps = ComponentProps<"span"> & { children?: ReactNode };
-
-export function CheckpointIcon({ className, children, ...props }: CheckpointIconProps) {
-  return (
-    <span className={cn("flex items-center text-muted-foreground", className)} {...props}>
-      {children ?? <BookmarkIcon className="size-3.5" />}
-    </span>
-  );
-}
-
-export type CheckpointTriggerProps = ComponentProps<typeof Button> & { tooltip?: string };
-
-export function CheckpointTrigger({
-  variant = "ghost",
-  size = "sm",
-  className,
-  tooltip,
-  children,
-  ...props
-}: CheckpointTriggerProps) {
-  return (
-    <Button
-      variant={variant}
-      size={size}
-      title={tooltip}
-      className={cn("h-6 gap-1.5 px-2 text-[11px]", className)}
-      {...props}
-    >
-      {children}
-    </Button>
-  );
-}
diff --git a/packages/web/src/components/ai-elements/inline-citation.tsx b/packages/web/src/components/ai-elements/inline-citation.tsx
new file mode 100644
index 00000000..a0a11bb9
--- /dev/null
+++ b/packages/web/src/components/ai-elements/inline-citation.tsx
@@ -0,0 +1,251 @@
+"use client";
+
+import { ArrowLeftIcon, ArrowRightIcon } from "lucide-react";
+import {
+  type ComponentProps,
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useState,
+} from "react";
+import { Badge } from "@/components/ui/badge";
+import {
+  Carousel,
+  type CarouselApi,
+  CarouselContent,
+  CarouselItem,
+} from "@/components/ui/carousel";
+import { HoverCard, HoverCardContent, HoverCardTrigger } from "@/components/ui/hover-card";
+import { cn } from "@/lib/utils";
+
+export type InlineCitationProps = ComponentProps<"span">;
+
+export const InlineCitation = ({ className, ...props }: InlineCitationProps) => (
+  <span className={cn("group inline items-center gap-1", className)} {...props} />
+);
+
+export type InlineCitationTextProps = ComponentProps<"span">;
+
+export const InlineCitationText = ({ className, ...props }: InlineCitationTextProps) => (
+  <span className={cn("transition-colors group-hover:bg-accent", className)} {...props} />
+);
+
+export type InlineCitationCardProps = ComponentProps<typeof HoverCard>;
+
+export const InlineCitationCard = (props: InlineCitationCardProps) => (
+  <HoverCard closeDelay={0} openDelay={0} {...props} />
+);
+
+export type InlineCitationCardTriggerProps = ComponentProps<typeof Badge> & {
+  sources: string[];
+};
+
+export const InlineCitationCardTrigger = ({
+  sources,
+  className,
+  ...props
+}: InlineCitationCardTriggerProps) => (
+  <HoverCardTrigger asChild>
+    <Badge className={cn("ml-1 rounded-full", className)} variant="secondary" {...props}>
+      {sources[0] ? (
+        <>
+          {new URL(sources[0]).hostname} {sources.length > 1 && `+${sources.length - 1}`}
+        </>
+      ) : (
+        "unknown"
+      )}
+    </Badge>
+  </HoverCardTrigger>
+);
+
+export type InlineCitationCardBodyProps = ComponentProps<"div">;
+
+export const InlineCitationCardBody = ({ className, ...props }: InlineCitationCardBodyProps) => (
+  <HoverCardContent className={cn("relative w-80 p-0", className)} {...props} />
+);
+
+const CarouselApiContext = createContext<CarouselApi | undefined>(undefined);
+
+const useCarouselApi = () => {
+  const context = useContext(CarouselApiContext);
+  return context;
+};
+
+export type InlineCitationCarouselProps = ComponentProps<typeof Carousel>;
+
+export const InlineCitationCarousel = ({
+  className,
+  children,
+  ...props
+}: InlineCitationCarouselProps) => {
+  const [api, setApi] = useState<CarouselApi>();
+
+  return (
+    <CarouselApiContext.Provider value={api}>
+      <Carousel className={cn("w-full", className)} setApi={setApi} {...props}>
+        {children}
+      </Carousel>
+    </CarouselApiContext.Provider>
+  );
+};
+
+export type InlineCitationCarouselContentProps = ComponentProps<"div">;
+
+export const InlineCitationCarouselContent = (props: InlineCitationCarouselContentProps) => (
+  <CarouselContent {...props} />
+);
+
+export type InlineCitationCarouselItemProps = ComponentProps<"div">;
+
+export const InlineCitationCarouselItem = ({
+  className,
+  ...props
+}: InlineCitationCarouselItemProps) => (
+  <CarouselItem className={cn("w-full space-y-2 p-4 pl-8", className)} {...props} />
+);
+
+export type InlineCitationCarouselHeaderProps = ComponentProps<"div">;
+
+export const InlineCitationCarouselHeader = ({
+  className,
+  ...props
+}: InlineCitationCarouselHeaderProps) => (
+  <div
+    className={cn(
+      "flex items-center justify-between gap-2 rounded-t-md bg-secondary p-2",
+      className,
+    )}
+    {...props}
+  />
+);
+
+export type InlineCitationCarouselIndexProps = ComponentProps<"div">;
+
+export const InlineCitationCarouselIndex = ({
+  children,
+  className,
+  ...props
+}: InlineCitationCarouselIndexProps) => {
+  const api = useCarouselApi();
+  const [current, setCurrent] = useState(0);
+  const [count, setCount] = useState(0);
+
+  useEffect(() => {
+    if (!api) {
+      return;
+    }
+
+    setCount(api.scrollSnapList().length);
+    setCurrent(api.selectedScrollSnap() + 1);
+
+    api.on("select", () => {
+      setCurrent(api.selectedScrollSnap() + 1);
+    });
+  }, [api]);
+
+  return (
+    <div
+      className={cn(
+        "flex flex-1 items-center justify-end px-3 py-1 text-muted-foreground text-xs",
+        className,
+      )}
+      {...props}
+    >
+      {children ?? `${current}/${count}`}
+    </div>
+  );
+};
+
+export type InlineCitationCarouselPrevProps = ComponentProps<"button">;
+
+export const InlineCitationCarouselPrev = ({
+  className,
+  ...props
+}: InlineCitationCarouselPrevProps) => {
+  const api = useCarouselApi();
+
+  const handleClick = useCallback(() => {
+    if (api) {
+      api.scrollPrev();
+    }
+  }, [api]);
+
+  return (
+    <button
+      aria-label="Previous"
+      className={cn("shrink-0", className)}
+      onClick={handleClick}
+      type="button"
+      {...props}
+    >
+      <ArrowLeftIcon className="size-4 text-muted-foreground" />
+    </button>
+  );
+};
+
+export type InlineCitationCarouselNextProps = ComponentProps<"button">;
+
+export const InlineCitationCarouselNext = ({
+  className,
+  ...props
+}: InlineCitationCarouselNextProps) => {
+  const api = useCarouselApi();
+
+  const handleClick = useCallback(() => {
+    if (api) {
+      api.scrollNext();
+    }
+  }, [api]);
+
+  return (
+    <button
+      aria-label="Next"
+      className={cn("shrink-0", className)}
+      onClick={handleClick}
+      type="button"
+      {...props}
+    >
+      <ArrowRightIcon className="size-4 text-muted-foreground" />
+    </button>
+  );
+};
+
+export type InlineCitationSourceProps = ComponentProps<"div"> & {
+  title?: string;
+  url?: string;
+  description?: string;
+};
+
+export const InlineCitationSource = ({
+  title,
+  url,
+  description,
+  className,
+  children,
+  ...props
+}: InlineCitationSourceProps) => (
+  <div className={cn("space-y-1", className)} {...props}>
+    {title && <h4 className="truncate font-medium text-sm leading-tight">{title}</h4>}
+    {url && <p className="truncate break-all text-muted-foreground text-xs">{url}</p>}
+    {description && (
+      <p className="line-clamp-3 text-muted-foreground text-sm leading-relaxed">{description}</p>
+    )}
+    {children}
+  </div>
+);
+
+export type InlineCitationQuoteProps = ComponentProps<"blockquote">;
+
+export const InlineCitationQuote = ({
+  children,
+  className,
+  ...props
+}: InlineCitationQuoteProps) => (
+  <blockquote
+    className={cn("border-muted border-l-2 pl-3 text-muted-foreground text-sm italic", className)}
+    {...props}
+  >
+    {children}
+  </blockquote>
+);
diff --git a/packages/web/src/components/ai-elements/message.tsx b/packages/web/src/components/ai-elements/message.tsx
index ed12fd2c..a51bdea5 100644
--- a/packages/web/src/components/ai-elements/message.tsx
+++ b/packages/web/src/components/ai-elements/message.tsx
@@ -5,15 +5,32 @@ import { code } from "@streamdown/code";
 import { math } from "@streamdown/math";
 import { mermaid } from "@streamdown/mermaid";
 import type { UIMessage } from "ai";
-import { CheckCircle, ChevronLeftIcon, ChevronRightIcon, Copy, ExternalLink } from "lucide-react";
-import type { ComponentProps, HTMLAttributes, JSX, ReactElement } from "react";
+import {
+  ArrowUpRightIcon,
+  CheckCircle,
+  ChevronLeftIcon,
+  ChevronRightIcon,
+  Copy,
+  ExternalLink,
+  FileTextIcon,
+} from "lucide-react";
+import type { ComponentProps, HTMLAttributes, JSX, ReactElement, ReactNode } from "react";
 import { createContext, memo, useCallback, useContext, useEffect, useMemo, useState } from "react";
 import type { LinkSafetyConfig, LinkSafetyModalProps } from "streamdown";
 import { Streamdown } from "streamdown";
 import { Button } from "@/components/ui/button";
 import { ButtonGroup, ButtonGroupText } from "@/components/ui/button-group";
+import { HoverCardTrigger } from "@/components/ui/hover-card";
 import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "@/components/ui/tooltip";
+import { useKnowledgePanel } from "@/hooks/use-knowledge-panel";
 import { cn } from "@/lib/utils";
+import {
+  InlineCitation,
+  InlineCitationCard,
+  InlineCitationCardBody,
+  InlineCitationSource,
+  InlineCitationText,
+} from "./inline-citation";
 
 type MessageProps = HTMLAttributes<HTMLDivElement> & {
   from: UIMessage["role"];
@@ -271,21 +288,88 @@ type MessageResponseProps = ComponentProps<typeof Streamdown>;
 
 const streamdownPlugins = { cjk, code, math, mermaid };
 
-// Custom link renderer — breaks long URLs, adds hover transition
+/**
+ * Inline citation to a saved knowledge document (foreman-ugu3). The agent cites
+ * a doc with a plain markdown link using the `doc:` scheme —
+ * `[cited text](doc:documents/<slug>.md "Title")` — so it streams through
+ * Streamdown like any link, and we render the AI Elements InlineCitation here.
+ * Clicking the badge (or "Open document") opens the KnowledgePanel side panel;
+ * it is a button, not an anchor, so it never triggers link-safety/navigation.
+ */
+const DocCitation = ({
+  path,
+  title,
+  children,
+}: {
+  path: string;
+  title: string;
+  children?: ReactNode;
+}) => {
+  const { open } = useKnowledgePanel();
+  const handleOpen = () => open({ path, title });
+
+  return (
+    <InlineCitation>
+      <InlineCitationText className="rounded-[3px] decoration-primary/30 underline-offset-2 group-hover:bg-primary/10">
+        {children}
+      </InlineCitationText>
+      <InlineCitationCard>
+        <HoverCardTrigger asChild>
+          <button
+            aria-label={`Cited document: ${title}`}
+            className="ml-1 inline-flex size-[18px] translate-y-[-1px] items-center justify-center rounded-full bg-primary/10 align-middle text-primary transition-colors hover:bg-primary/20"
+            onClick={handleOpen}
+            type="button"
+          >
+            <FileTextIcon className="size-3" />
+          </button>
+        </HoverCardTrigger>
+        <InlineCitationCardBody>
+          <div className="space-y-2 p-3">
+            <InlineCitationSource description="Saved knowledge document" title={title} />
+            <button
+              className="inline-flex items-center gap-1 text-primary text-xs hover:underline"
+              onClick={handleOpen}
+              type="button"
+            >
+              Open document
+              <ArrowUpRightIcon className="size-3" />
+            </button>
+          </div>
+        </InlineCitationCardBody>
+      </InlineCitationCard>
+    </InlineCitation>
+  );
+};
+
+// Custom link renderer — breaks long URLs, adds hover transition. A `doc:` href
+// is a knowledge-document citation (see DocCitation), not a real link.
 const StreamdownLink = ({
   href,
+  title,
   children,
   node: _node,
   ...props
-}: JSX.IntrinsicElements["a"] & { node?: unknown }) => (
-  <a
-    href={href}
-    className="break-all cursor-pointer text-primary underline underline-offset-2 decoration-primary/40 transition-[text-decoration-color] hover:decoration-primary"
-    {...props}
-  >
-    {children}
-  </a>
-);
+}: JSX.IntrinsicElements["a"] & { node?: unknown }) => {
+  if (typeof href === "string" && href.startsWith("doc:")) {
+    const path = href.slice("doc:".length);
+    return (
+      <DocCitation path={path} title={typeof title === "string" && title ? title : "Document"}>
+        {children}
+      </DocCitation>
+    );
+  }
+  return (
+    <a
+      href={href}
+      title={title}
+      className="break-all cursor-pointer text-primary underline underline-offset-2 decoration-primary/40 transition-[text-decoration-color] hover:decoration-primary"
+      {...props}
+    >
+      {children}
+    </a>
+  );
+};
 
 // iOS-style action sheet for link safety confirmation
 const StreamdownLinkModal = ({ isOpen, onClose, onConfirm, url }: LinkSafetyModalProps) => {
diff --git a/packages/web/src/components/ai-elements/sandbox.tsx b/packages/web/src/components/ai-elements/sandbox.tsx
new file mode 100644
index 00000000..e8c3bec8
--- /dev/null
+++ b/packages/web/src/components/ai-elements/sandbox.tsx
@@ -0,0 +1,94 @@
+"use client";
+
+import type { ToolUIPart } from "ai";
+import { ChevronDownIcon, Code } from "lucide-react";
+import type { ComponentProps } from "react";
+import { Collapsible, CollapsibleContent, CollapsibleTrigger } from "@/components/ui/collapsible";
+import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
+import { cn } from "@/lib/utils";
+
+import { getStatusBadge } from "./tool";
+
+export type SandboxRootProps = ComponentProps<typeof Collapsible>;
+
+export const Sandbox = ({ className, ...props }: SandboxRootProps) => (
+  <Collapsible
+    className={cn("not-prose group mb-4 w-full overflow-hidden rounded-md border", className)}
+    defaultOpen
+    {...props}
+  />
+);
+
+export interface SandboxHeaderProps {
+  title?: string;
+  state: ToolUIPart["state"];
+  className?: string;
+}
+
+export const SandboxHeader = ({ className, title, state, ...props }: SandboxHeaderProps) => (
+  <CollapsibleTrigger
+    className={cn("flex w-full items-center justify-between gap-4 p-3", className)}
+    {...props}
+  >
+    <div className="flex items-center gap-2">
+      <Code className="size-4 text-muted-foreground" />
+      <span className="font-medium text-sm">{title}</span>
+      {getStatusBadge(state)}
+    </div>
+    <ChevronDownIcon className="size-4 text-muted-foreground transition-transform group-data-[state=open]:rotate-180" />
+  </CollapsibleTrigger>
+);
+
+export type SandboxContentProps = ComponentProps<typeof CollapsibleContent>;
+
+export const SandboxContent = ({ className, ...props }: SandboxContentProps) => (
+  <CollapsibleContent
+    className={cn(
+      "data-[state=closed]:fade-out-0 data-[state=closed]:slide-out-to-top-2 data-[state=open]:slide-in-from-top-2 outline-none data-[state=closed]:animate-out data-[state=open]:animate-in",
+      className,
+    )}
+    {...props}
+  />
+);
+
+export type SandboxTabsProps = ComponentProps<typeof Tabs>;
+
+export const SandboxTabs = ({ className, ...props }: SandboxTabsProps) => (
+  <Tabs className={cn("w-full gap-0", className)} {...props} />
+);
+
+export type SandboxTabsBarProps = ComponentProps<"div">;
+
+export const SandboxTabsBar = ({ className, ...props }: SandboxTabsBarProps) => (
+  <div
+    className={cn("flex w-full items-center border-border border-t border-b", className)}
+    {...props}
+  />
+);
+
+export type SandboxTabsListProps = ComponentProps<typeof TabsList>;
+
+export const SandboxTabsList = ({ className, ...props }: SandboxTabsListProps) => (
+  <TabsList
+    className={cn("h-auto rounded-none border-0 bg-transparent p-0", className)}
+    {...props}
+  />
+);
+
+export type SandboxTabsTriggerProps = ComponentProps<typeof TabsTrigger>;
+
+export const SandboxTabsTrigger = ({ className, ...props }: SandboxTabsTriggerProps) => (
+  <TabsTrigger
+    className={cn(
+      "rounded-none border-0 border-transparent border-b-2 px-4 py-2 font-medium text-muted-foreground text-sm transition-colors data-[state=active]:border-primary data-[state=active]:bg-transparent data-[state=active]:text-foreground data-[state=active]:shadow-none",
+      className,
+    )}
+    {...props}
+  />
+);
+
+export type SandboxTabContentProps = ComponentProps<typeof TabsContent>;
+
+export const SandboxTabContent = ({ className, ...props }: SandboxTabContentProps) => (
+  <TabsContent className={cn("mt-0 text-sm", className)} {...props} />
+);
diff --git a/packages/web/src/components/ai-elements/terminal.tsx b/packages/web/src/components/ai-elements/terminal.tsx
new file mode 100644
index 00000000..811f12af
--- /dev/null
+++ b/packages/web/src/components/ai-elements/terminal.tsx
@@ -0,0 +1,244 @@
+"use client";
+
+import Ansi from "ansi-to-react";
+import { CheckIcon, CopyIcon, TerminalIcon, Trash2Icon } from "lucide-react";
+import type { ComponentProps, HTMLAttributes } from "react";
+import {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+} from "react";
+import { Button } from "@/components/ui/button";
+import { cn } from "@/lib/utils";
+
+interface TerminalContextType {
+  output: string;
+  isStreaming: boolean;
+  autoScroll: boolean;
+  onClear?: () => void;
+}
+
+const TerminalContext = createContext<TerminalContextType>({
+  autoScroll: true,
+  isStreaming: false,
+  output: "",
+});
+
+export type TerminalHeaderProps = HTMLAttributes<HTMLDivElement>;
+
+export const TerminalHeader = ({ className, children, ...props }: TerminalHeaderProps) => (
+  <div
+    className={cn(
+      "flex items-center justify-between border-zinc-800 border-b px-4 py-2",
+      className,
+    )}
+    {...props}
+  >
+    {children}
+  </div>
+);
+
+export type TerminalTitleProps = HTMLAttributes<HTMLDivElement>;
+
+export const TerminalTitle = ({ className, children, ...props }: TerminalTitleProps) => (
+  <div className={cn("flex items-center gap-2 text-sm text-zinc-400", className)} {...props}>
+    <TerminalIcon className="size-4" />
+    {children ?? "Terminal"}
+  </div>
+);
+
+export type TerminalStatusProps = HTMLAttributes<HTMLDivElement>;
+
+export const TerminalStatus = ({ className, children, ...props }: TerminalStatusProps) => {
+  const { isStreaming } = useContext(TerminalContext);
+
+  if (!isStreaming) {
+    return null;
+  }
+
+  return (
+    <div className={cn("flex items-center gap-2 text-xs text-zinc-400", className)} {...props}>
+      {children}
+    </div>
+  );
+};
+
+export type TerminalActionsProps = HTMLAttributes<HTMLDivElement>;
+
+export const TerminalActions = ({ className, children, ...props }: TerminalActionsProps) => (
+  <div className={cn("flex items-center gap-1", className)} {...props}>
+    {children}
+  </div>
+);
+
+export type TerminalCopyButtonProps = ComponentProps<typeof Button> & {
+  onCopy?: () => void;
+  onError?: (error: Error) => void;
+  timeout?: number;
+};
+
+export const TerminalCopyButton = ({
+  onCopy,
+  onError,
+  timeout = 2000,
+  children,
+  className,
+  ...props
+}: TerminalCopyButtonProps) => {
+  const [isCopied, setIsCopied] = useState(false);
+  const timeoutRef = useRef<number>(0);
+  const { output } = useContext(TerminalContext);
+
+  const copyToClipboard = useCallback(async () => {
+    if (typeof window === "undefined" || !navigator?.clipboard?.writeText) {
+      onError?.(new Error("Clipboard API not available"));
+      return;
+    }
+
+    try {
+      await navigator.clipboard.writeText(output);
+      setIsCopied(true);
+      onCopy?.();
+      timeoutRef.current = window.setTimeout(() => setIsCopied(false), timeout);
+    } catch (error) {
+      onError?.(error as Error);
+    }
+  }, [output, onCopy, onError, timeout]);
+
+  useEffect(
+    () => () => {
+      window.clearTimeout(timeoutRef.current);
+    },
+    [],
+  );
+
+  const Icon = isCopied ? CheckIcon : CopyIcon;
+
+  return (
+    <Button
+      className={cn(
+        "size-7 shrink-0 text-zinc-400 hover:bg-zinc-800 hover:text-zinc-100",
+        className,
+      )}
+      onClick={copyToClipboard}
+      size="icon"
+      variant="ghost"
+      {...props}
+    >
+      {children ?? <Icon size={14} />}
+    </Button>
+  );
+};
+
+export type TerminalClearButtonProps = ComponentProps<typeof Button>;
+
+export const TerminalClearButton = ({
+  children,
+  className,
+  ...props
+}: TerminalClearButtonProps) => {
+  const { onClear } = useContext(TerminalContext);
+
+  if (!onClear) {
+    return null;
+  }
+
+  return (
+    <Button
+      className={cn(
+        "size-7 shrink-0 text-zinc-400 hover:bg-zinc-800 hover:text-zinc-100",
+        className,
+      )}
+      onClick={onClear}
+      size="icon"
+      variant="ghost"
+      {...props}
+    >
+      {children ?? <Trash2Icon size={14} />}
+    </Button>
+  );
+};
+
+export type TerminalContentProps = HTMLAttributes<HTMLDivElement>;
+
+export const TerminalContent = ({ className, children, ...props }: TerminalContentProps) => {
+  const { output, isStreaming, autoScroll } = useContext(TerminalContext);
+  const containerRef = useRef<HTMLDivElement>(null);
+
+  useEffect(() => {
+    if (autoScroll && containerRef.current) {
+      containerRef.current.scrollTop = containerRef.current.scrollHeight;
+    }
+  }, [output, autoScroll]);
+
+  return (
+    <div
+      className={cn("max-h-96 overflow-auto p-4 font-mono text-sm leading-relaxed", className)}
+      ref={containerRef}
+      {...props}
+    >
+      {children ?? (
+        <pre className="whitespace-pre-wrap break-words">
+          <Ansi>{output}</Ansi>
+          {isStreaming && (
+            <span className="ml-0.5 inline-block h-4 w-2 animate-pulse bg-zinc-100" />
+          )}
+        </pre>
+      )}
+    </div>
+  );
+};
+
+export type TerminalProps = HTMLAttributes<HTMLDivElement> & {
+  output: string;
+  isStreaming?: boolean;
+  autoScroll?: boolean;
+  onClear?: () => void;
+};
+
+export const Terminal = ({
+  output,
+  isStreaming = false,
+  autoScroll = true,
+  onClear,
+  className,
+  children,
+  ...props
+}: TerminalProps) => {
+  const contextValue = useMemo(
+    () => ({ autoScroll, isStreaming, onClear, output }),
+    [autoScroll, isStreaming, onClear, output],
+  );
+
+  return (
+    <TerminalContext.Provider value={contextValue}>
+      <div
+        className={cn(
+          "flex flex-col overflow-hidden rounded-lg border bg-zinc-950 text-zinc-100",
+          className,
+        )}
+        {...props}
+      >
+        {children ?? (
+          <>
+            <TerminalHeader>
+              <TerminalTitle />
+              <div className="flex items-center gap-1">
+                <TerminalStatus />
+                <TerminalActions>
+                  <TerminalCopyButton />
+                  {onClear && <TerminalClearButton />}
+                </TerminalActions>
+              </div>
+            </TerminalHeader>
+            <TerminalContent />
+          </>
+        )}
+      </div>
+    </TerminalContext.Provider>
+  );
+};
diff --git a/packages/web/src/components/ai-elements/tool.tsx b/packages/web/src/components/ai-elements/tool.tsx
index e725e798..7a8d53e9 100644
--- a/packages/web/src/components/ai-elements/tool.tsx
+++ b/packages/web/src/components/ai-elements/tool.tsx
@@ -63,7 +63,7 @@ const statusIcons: Record<ToolPart["state"], ReactNode> = {
   "output-error": <XCircleIcon className="size-4 text-red-600" />,
 };
 
-const getStatusBadge = (status: ToolPart["state"]) => (
+export const getStatusBadge = (status: ToolPart["state"]) => (
   <Badge
     className="gap-1 rounded-full px-2 py-0 text-[11px] leading-5 bg-transparent border-0 text-muted-foreground"
     variant="secondary"
diff --git a/packages/web/src/components/ai-elements/web-preview.tsx b/packages/web/src/components/ai-elements/web-preview.tsx
new file mode 100644
index 00000000..2ac786a7
--- /dev/null
+++ b/packages/web/src/components/ai-elements/web-preview.tsx
@@ -0,0 +1,233 @@
+"use client";
+
+import { ChevronDownIcon } from "lucide-react";
+import type { ComponentProps, ReactNode } from "react";
+import { createContext, useContext, useEffect, useState } from "react";
+import { Button } from "@/components/ui/button";
+import { Collapsible, CollapsibleContent, CollapsibleTrigger } from "@/components/ui/collapsible";
+import { Input } from "@/components/ui/input";
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "@/components/ui/tooltip";
+import { cn } from "@/lib/utils";
+
+export type WebPreviewContextValue = {
+  url: string;
+  setUrl: (url: string) => void;
+  consoleOpen: boolean;
+  setConsoleOpen: (open: boolean) => void;
+};
+
+const WebPreviewContext = createContext<WebPreviewContextValue | null>(null);
+
+const useWebPreview = () => {
+  const context = useContext(WebPreviewContext);
+  if (!context) {
+    throw new Error("WebPreview components must be used within a WebPreview");
+  }
+  return context;
+};
+
+export type WebPreviewProps = ComponentProps<"div"> & {
+  defaultUrl?: string;
+  onUrlChange?: (url: string) => void;
+};
+
+export const WebPreview = ({
+  className,
+  children,
+  defaultUrl = "",
+  onUrlChange,
+  ...props
+}: WebPreviewProps) => {
+  const [url, setUrl] = useState(defaultUrl);
+  const [consoleOpen, setConsoleOpen] = useState(false);
+
+  const handleUrlChange = (newUrl: string) => {
+    setUrl(newUrl);
+    onUrlChange?.(newUrl);
+  };
+
+  const contextValue: WebPreviewContextValue = {
+    url,
+    setUrl: handleUrlChange,
+    consoleOpen,
+    setConsoleOpen,
+  };
+
+  return (
+    <WebPreviewContext.Provider value={contextValue}>
+      <div
+        className={cn("flex size-full flex-col rounded-lg border bg-card", className)}
+        {...props}
+      >
+        {children}
+      </div>
+    </WebPreviewContext.Provider>
+  );
+};
+
+export type WebPreviewNavigationProps = ComponentProps<"div">;
+
+export const WebPreviewNavigation = ({
+  className,
+  children,
+  ...props
+}: WebPreviewNavigationProps) => (
+  <div className={cn("flex items-center gap-1 border-b p-2", className)} {...props}>
+    {children}
+  </div>
+);
+
+export type WebPreviewNavigationButtonProps = ComponentProps<typeof Button> & {
+  tooltip?: string;
+};
+
+export const WebPreviewNavigationButton = ({
+  onClick,
+  disabled,
+  tooltip,
+  children,
+  ...props
+}: WebPreviewNavigationButtonProps) => (
+  <TooltipProvider>
+    <Tooltip>
+      <TooltipTrigger asChild>
+        <Button
+          className="h-8 w-8 p-0 hover:text-foreground"
+          disabled={disabled}
+          onClick={onClick}
+          size="sm"
+          variant="ghost"
+          {...props}
+        >
+          {children}
+        </Button>
+      </TooltipTrigger>
+      <TooltipContent>
+        <p>{tooltip}</p>
+      </TooltipContent>
+    </Tooltip>
+  </TooltipProvider>
+);
+
+export type WebPreviewUrlProps = ComponentProps<typeof Input>;
+
+export const WebPreviewUrl = ({ value, onChange, onKeyDown, ...props }: WebPreviewUrlProps) => {
+  const { url, setUrl } = useWebPreview();
+  const [inputValue, setInputValue] = useState(url);
+
+  // Sync input value with context URL when it changes externally
+  useEffect(() => {
+    setInputValue(url);
+  }, [url]);
+
+  const handleChange = (event: React.ChangeEvent<HTMLInputElement>) => {
+    setInputValue(event.target.value);
+    onChange?.(event);
+  };
+
+  const handleKeyDown = (event: React.KeyboardEvent<HTMLInputElement>) => {
+    if (event.key === "Enter") {
+      const target = event.target as HTMLInputElement;
+      setUrl(target.value);
+    }
+    onKeyDown?.(event);
+  };
+
+  return (
+    <Input
+      className="h-8 flex-1 text-sm"
+      onChange={onChange ?? handleChange}
+      onKeyDown={handleKeyDown}
+      placeholder="Enter URL..."
+      value={value ?? inputValue}
+      {...props}
+    />
+  );
+};
+
+export type WebPreviewBodyProps = ComponentProps<"iframe"> & {
+  loading?: ReactNode;
+};
+
+export const WebPreviewBody = ({ className, loading, src, ...props }: WebPreviewBodyProps) => {
+  const { url } = useWebPreview();
+
+  return (
+    <div className="flex-1">
+      <iframe
+        className={cn("size-full", className)}
+        sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-presentation"
+        src={(src ?? url) || undefined}
+        title="Preview"
+        {...props}
+      />
+      {loading}
+    </div>
+  );
+};
+
+export type WebPreviewConsoleProps = ComponentProps<"div"> & {
+  logs?: Array<{
+    level: "log" | "warn" | "error";
+    message: string;
+    timestamp: Date;
+  }>;
+};
+
+export const WebPreviewConsole = ({
+  className,
+  logs = [],
+  children,
+  ...props
+}: WebPreviewConsoleProps) => {
+  const { consoleOpen, setConsoleOpen } = useWebPreview();
+
+  return (
+    <Collapsible
+      className={cn("border-t bg-muted/50 font-mono text-sm", className)}
+      onOpenChange={setConsoleOpen}
+      open={consoleOpen}
+      {...props}
+    >
+      <CollapsibleTrigger asChild>
+        <Button
+          className="flex w-full items-center justify-between p-4 text-left font-medium hover:bg-muted/50"
+          variant="ghost"
+        >
+          Console
+          <ChevronDownIcon
+            className={cn("h-4 w-4 transition-transform duration-200", consoleOpen && "rotate-180")}
+          />
+        </Button>
+      </CollapsibleTrigger>
+      <CollapsibleContent
+        className={cn(
+          "px-4 pb-4",
+          "data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 outline-none data-[state=closed]:animate-out data-[state=open]:animate-in",
+        )}
+      >
+        <div className="max-h-48 space-y-1 overflow-y-auto">
+          {logs.length === 0 ? (
+            <p className="text-muted-foreground">No console output</p>
+          ) : (
+            logs.map((log, index) => (
+              <div
+                className={cn(
+                  "text-xs",
+                  log.level === "error" && "text-destructive",
+                  log.level === "warn" && "text-yellow-600",
+                  log.level === "log" && "text-foreground",
+                )}
+                key={`${log.timestamp.getTime()}-${index}`}
+              >
+                <span className="text-muted-foreground">{log.timestamp.toLocaleTimeString()}</span>{" "}
+                {log.message}
+              </div>
+            ))
+          )}
+          {children}
+        </div>
+      </CollapsibleContent>
+    </Collapsible>
+  );
+};
diff --git a/packages/web/src/components/app-shell.tsx b/packages/web/src/components/app-shell.tsx
new file mode 100644
index 00000000..51f5ddde
--- /dev/null
+++ b/packages/web/src/components/app-shell.tsx
@@ -0,0 +1,65 @@
+import { cookies } from "next/headers";
+import { Toaster } from "sonner";
+import { AppSidebar } from "@/components/chat/app-sidebar";
+import { SidebarInset, SidebarProvider } from "@/components/ui/sidebar";
+import { TooltipProvider } from "@/components/ui/tooltip";
+import { createClient } from "@/lib/server";
+
+/**
+ * Shared app shell — the same shadcn sidebar (AppSidebar) the chat uses, wrapped
+ * around any authed section (Automations, Inbox, Dashboards, Workspaces, Settings,
+ * Editor) so the whole app keeps one persistent sidebar instead of bare pages /
+ * one-off headers. Server component: reads the user + persisted collapse state,
+ * like the chat layout's SidebarShell.
+ *
+ * `fullBleed` drops the scrolling content wrapper + top bar so a full-height tool
+ * (the agent editor) can fill the inset itself.
+ */
+export async function AppShell({
+  children,
+  fullBleed = false,
+}: {
+  children: React.ReactNode;
+  fullBleed?: boolean;
+}) {
+  const supabase = await createClient();
+  const cookieStore = await cookies();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+  const isCollapsed = cookieStore.get("sidebar_state")?.value !== "true";
+
+  const sidebarUser = user
+    ? {
+        id: user.id,
+        email: user.email ?? "",
+        image: user.user_metadata?.avatar_url ?? null,
+      }
+    : undefined;
+
+  return (
+    <TooltipProvider delayDuration={0}>
+      <SidebarProvider defaultOpen={!isCollapsed}>
+        <AppSidebar user={sidebarUser} />
+        <SidebarInset>
+          <Toaster
+            position="top-center"
+            theme="system"
+            toastOptions={{
+              className:
+                "!bg-card !text-foreground !border-border/50 !shadow-[var(--shadow-float)]",
+            }}
+          />
+          {fullBleed ? (
+            children
+          ) : (
+            // The sidebar owns the only collapse control (app-sidebar.tsx); this
+            // shell no longer renders a redundant top header just to hold a second
+            // SidebarTrigger. Pages render their own <main> + title.
+            <div className="min-h-0 flex-1 overflow-y-auto">{children}</div>
+          )}
+        </SidebarInset>
+      </SidebarProvider>
+    </TooltipProvider>
+  );
+}
diff --git a/packages/web/src/components/apps/app-picker.tsx b/packages/web/src/components/apps/app-picker.tsx
new file mode 100644
index 00000000..d55871de
--- /dev/null
+++ b/packages/web/src/components/apps/app-picker.tsx
@@ -0,0 +1,53 @@
+"use client";
+
+import { useRouter } from "next/navigation";
+import {
+  Combobox,
+  ComboboxContent,
+  ComboboxEmpty,
+  ComboboxInput,
+  ComboboxItem,
+  ComboboxList,
+} from "@/components/ui/combobox";
+
+interface AppOption {
+  appKey: string;
+  rowCount: number;
+}
+
+/**
+ * Searchable picker for switching the Apps page between the workspace's apps.
+ * Replaces the URL-param-only app switch with a real combobox so the apps are
+ * discoverable and filterable (foreman-1ybk). Selecting an app navigates to
+ * `/apps?app=<key>`, which re-runs the server component with new data.
+ */
+export function AppPicker({ apps, current }: { apps: AppOption[]; current: string }) {
+  const router = useRouter();
+  const items = apps.map((a) => a.appKey);
+  const rowCounts = new Map(apps.map((a) => [a.appKey, a.rowCount] as const));
+
+  return (
+    <Combobox
+      items={items}
+      value={current || null}
+      onValueChange={(value) => {
+        if (value) router.push(`/apps?app=${encodeURIComponent(value)}`);
+      }}
+    >
+      <ComboboxInput placeholder="Search apps…" aria-label="Select an app" className="w-56" />
+      <ComboboxContent>
+        <ComboboxEmpty>No apps found.</ComboboxEmpty>
+        <ComboboxList>
+          {(item: string) => (
+            <ComboboxItem key={item} value={item}>
+              <span className="flex-1 truncate">{item}</span>
+              <span className="text-xs text-muted-foreground tabular-nums">
+                {rowCounts.get(item) ?? 0}
+              </span>
+            </ComboboxItem>
+          )}
+        </ComboboxList>
+      </ComboboxContent>
+    </Combobox>
+  );
+}
diff --git a/packages/web/src/components/auth-shell.tsx b/packages/web/src/components/auth-shell.tsx
index 761822ce..b30b136a 100644
--- a/packages/web/src/components/auth-shell.tsx
+++ b/packages/web/src/components/auth-shell.tsx
@@ -36,13 +36,15 @@ export function AuthShell({ children }: { children: React.ReactNode }) {
         {/* Logo */}
         <div className="relative z-10">
           <Link href="/" className="flex items-center gap-2.5">
-            <span className="inline-flex h-7 w-7 items-center justify-center rounded-md bg-[#ff4a00] text-white text-sm font-bold">
-              F
-            </span>
+            {/* biome-ignore lint/performance/noImgElement: small static brand asset, next/image is overkill */}
+            <img
+              alt="Foreman"
+              className="h-7 w-7 object-contain"
+              height={28}
+              src="/zapier.svg"
+              width={28}
+            />
             <span className="text-white text-[15px] font-semibold tracking-tight">Foreman</span>
-            <span className="text-[10px] font-medium text-[#ff4a00] border border-[#ff4a00]/30 rounded-full px-2 py-0.5 uppercase tracking-wider">
-              Alpha
-            </span>
           </Link>
         </div>
 
@@ -75,9 +77,14 @@ export function AuthShell({ children }: { children: React.ReactNode }) {
         <div className="w-full max-w-md space-y-8 px-4">
           {/* Mobile logo */}
           <div className="flex items-center gap-2 lg:hidden">
-            <span className="inline-flex h-6 w-6 items-center justify-center rounded-md bg-[#ff4a00] text-white text-xs font-bold">
-              F
-            </span>
+            {/* biome-ignore lint/performance/noImgElement: small static brand asset, next/image is overkill */}
+            <img
+              alt="Foreman"
+              className="h-6 w-6 object-contain"
+              height={24}
+              src="/zapier.svg"
+              width={24}
+            />
             <span className="text-foreground text-sm font-semibold tracking-tight">Foreman</span>
           </div>
 
diff --git a/packages/web/src/components/automations/automations-manager.tsx b/packages/web/src/components/automations/automations-manager.tsx
new file mode 100644
index 00000000..80e2146b
--- /dev/null
+++ b/packages/web/src/components/automations/automations-manager.tsx
@@ -0,0 +1,582 @@
+"use client";
+
+import {
+  CheckIcon,
+  ChevronDownIcon,
+  ChevronRightIcon,
+  ExternalLinkIcon,
+  InboxIcon,
+  PlayIcon,
+  RefreshCwIcon,
+  Trash2Icon,
+  XIcon,
+  ZapIcon,
+} from "lucide-react";
+import { Fragment, useCallback, useEffect, useRef, useState, useTransition } from "react";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import {
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyMedia,
+  EmptyTitle,
+} from "@/components/ui/empty";
+import {
+  Pagination,
+  PaginationContent,
+  PaginationItem,
+  PaginationNext,
+  PaginationPrevious,
+} from "@/components/ui/pagination";
+import { Switch } from "@/components/ui/switch";
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from "@/components/ui/table";
+import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
+import {
+  cancelRun,
+  deleteAutomation,
+  getAutomation,
+  getAutomations,
+  getInboxState,
+  respondToCallback,
+  runAutomation,
+  setAutomationEnabled,
+} from "@/data/automations";
+import type {
+  Automation,
+  AutomationDetail,
+  InboxState,
+  ScheduleSpec,
+} from "@/data/automations-types";
+
+/**
+ * Human label for a cron schedule (foreman-bhb5). Humanizes the common daily case
+ * ("0 9 * * *" → "Daily 09:00"); otherwise shows the raw cron. Appends the tz.
+ */
+function scheduleLabel(s: ScheduleSpec): string {
+  const tz = s.timezone ?? "UTC";
+  const parts = s.cron.trim().split(/\s+/);
+  if (parts.length === 5) {
+    const [min, hour, dom, mon, dow] = parts;
+    if (dom === "*" && mon === "*" && dow === "*" && /^\d+$/.test(min) && /^\d+$/.test(hour)) {
+      return `Daily ${hour.padStart(2, "0")}:${min.padStart(2, "0")} ${tz}`;
+    }
+  }
+  return `${s.cron} (${tz})`;
+}
+
+function statusVariant(status: string, enabled: boolean): "default" | "secondary" | "destructive" {
+  // trigger_claim_failed = the deploy-time claim failed; trigger_failed = the inbox
+  // subscription later went into initialization_failure (foreman-dwf8). Both mean
+  // "enabled but won't fire" → flag them red.
+  if (status === "trigger_claim_failed" || status === "trigger_failed") return "destructive";
+  return enabled ? "default" : "secondary";
+}
+
+function shortId(id: string): string {
+  return id.length > 10 ? `${id.slice(0, 8)}…` : id;
+}
+
+/** Run statuses the reconcile worker may still advance — drives live polling. */
+const NON_TERMINAL_RUN = new Set(["initialized", "started", "retrying", "waiting"]);
+const RUNS_PER_PAGE = 10;
+/** Poll cadence while a run is in flight. DB-cheap (getAutomation reads Postgres, not Zapier). */
+const RUN_POLL_MS = 3500;
+
+function runStatusVariant(status: string): "default" | "secondary" | "destructive" | "outline" {
+  if (status === "failed") return "destructive";
+  if (status === "finished") return "default";
+  if (status === "retrying" || status === "waiting") return "outline"; // surfaced, not failed
+  return "secondary"; // initialized / started / cancelled
+}
+
+function prettyJson(value: unknown): string {
+  try {
+    return JSON.stringify(value, null, 2);
+  } catch {
+    return String(value);
+  }
+}
+
+export function AutomationsManager() {
+  const [automations, setAutomations] = useState<Automation[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [selectedId, setSelectedId] = useState<string | null>(null);
+  const [detail, setDetail] = useState<AutomationDetail | null>(null);
+  const [inbox, setInbox] = useState<InboxState | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, startTransition] = useTransition();
+  const [confirmDelete, setConfirmDelete] = useState(false);
+  const [expandedRunId, setExpandedRunId] = useState<string | null>(null);
+  const [runsPage, setRunsPage] = useState(0);
+  const selectedIdRef = useRef<string | null>(null);
+  selectedIdRef.current = selectedId;
+
+  const loadList = useCallback(() => {
+    getAutomations()
+      .then((rows) => {
+        setAutomations(rows);
+        setSelectedId((cur) => cur ?? rows[0]?.id ?? null);
+      })
+      .catch((e) => setError((e as Error).message))
+      .finally(() => setLoading(false));
+  }, []);
+
+  useEffect(() => {
+    loadList();
+  }, [loadList]);
+
+  const loadDetail = useCallback((id: string) => {
+    setDetail(null);
+    setInbox(null);
+    setConfirmDelete(false);
+    setExpandedRunId(null);
+    setRunsPage(0);
+    getAutomation(id)
+      .then(setDetail)
+      .catch((e) => setError((e as Error).message));
+    getInboxState(id)
+      .then(setInbox)
+      .catch(() => setInbox(null));
+  }, []);
+
+  useEffect(() => {
+    if (selectedId) loadDetail(selectedId);
+  }, [selectedId, loadDetail]);
+
+  // Live run-status: while the selected automation has an in-flight run, re-fetch
+  // its detail in place (no spinner, no flicker) so the reconcile worker's
+  // started → finished/failed advance shows up without a manual reload. The SDK
+  // exposes no run-status stream, so Foreman owns this — getAutomation is a cheap
+  // Postgres read. Polling stops as soon as every run is terminal.
+  const hasPendingRun = !!detail?.runs.some((r) => NON_TERMINAL_RUN.has(r.status));
+
+  const allRuns = detail?.runs ?? [];
+  const runsPageCount = Math.max(1, Math.ceil(allRuns.length / RUNS_PER_PAGE));
+  const runsSafePage = Math.min(runsPage, runsPageCount - 1);
+  const pagedRuns = allRuns.slice(runsSafePage * RUNS_PER_PAGE, (runsSafePage + 1) * RUNS_PER_PAGE);
+  useEffect(() => {
+    if (!selectedId || !hasPendingRun) return;
+    let active = true;
+    let timer: ReturnType<typeof setTimeout>;
+    const tick = async () => {
+      try {
+        const fresh = await getAutomation(selectedId);
+        if (active && selectedIdRef.current === selectedId) {
+          setDetail((cur) => (cur && cur.automation.id === fresh.automation.id ? fresh : cur));
+        }
+      } catch {
+        // Transient — keep polling; a hard error surfaces on the next user action.
+      }
+      if (active) timer = setTimeout(tick, RUN_POLL_MS);
+    };
+    timer = setTimeout(tick, RUN_POLL_MS);
+    return () => {
+      active = false;
+      clearTimeout(timer);
+    };
+  }, [selectedId, hasPendingRun]);
+
+  function act(fn: () => Promise<unknown>, reloadList = false) {
+    setError(null);
+    startTransition(async () => {
+      try {
+        await fn();
+        if (selectedId) loadDetail(selectedId);
+        if (reloadList) loadList();
+      } catch (e) {
+        setError((e as Error).message);
+      }
+    });
+  }
+
+  if (loading) {
+    return <p className="text-muted-foreground text-sm">Loading automations…</p>;
+  }
+
+  if (automations.length === 0) {
+    return (
+      <Empty className="rounded-xl border border-dashed">
+        <EmptyHeader>
+          <EmptyMedia variant="icon">
+            <ZapIcon className="size-5" />
+          </EmptyMedia>
+          <EmptyTitle>No automations yet</EmptyTitle>
+          <EmptyDescription>
+            Ask Foreman in chat to build one — e.g. "every time a GitHub issue is opened, post it to
+            Slack." Deployed automations show up here.
+          </EmptyDescription>
+        </EmptyHeader>
+      </Empty>
+    );
+  }
+
+  const selected = detail?.automation ?? automations.find((a) => a.id === selectedId) ?? null;
+
+  return (
+    <div className="grid gap-4 md:grid-cols-[260px_1fr]">
+      {error && <p className="text-destructive text-sm md:col-span-2">{error}</p>}
+
+      {/* List */}
+      <ul className="flex flex-col gap-1">
+        {automations.map((a) => (
+          <li key={a.id}>
+            <button
+              className={`flex w-full items-center justify-between gap-2 rounded-lg border px-3 py-2 text-left text-sm transition-colors ${
+                a.id === selectedId
+                  ? "border-border bg-muted"
+                  : "border-transparent hover:bg-muted/50"
+              }`}
+              onClick={() => setSelectedId(a.id)}
+              type="button"
+            >
+              <span className="truncate font-medium">{a.name}</span>
+              <span className="flex shrink-0 items-center gap-1.5">
+                {a.trigger?.schedule && (
+                  <span className="text-muted-foreground text-xs">
+                    {a.trigger.digest ? "Digest" : scheduleLabel(a.trigger.schedule)}
+                  </span>
+                )}
+                <Badge variant={statusVariant(a.status, a.enabled)}>
+                  {a.enabled ? "on" : "off"}
+                </Badge>
+              </span>
+            </button>
+          </li>
+        ))}
+      </ul>
+
+      {/* Detail */}
+      {selected && (
+        <div className="rounded-xl border p-4">
+          <div className="flex flex-wrap items-start justify-between gap-3">
+            <div className="min-w-0">
+              <div className="flex items-center gap-2">
+                <h2 className="truncate font-semibold text-lg">{selected.name}</h2>
+                <Badge variant={statusVariant(selected.status, selected.enabled)}>
+                  {selected.status}
+                </Badge>
+                {selected.trigger?.digest && <Badge variant="secondary">Digest</Badge>}
+                {selected.trigger?.schedule && (
+                  <Badge variant="outline">{scheduleLabel(selected.trigger.schedule)}</Badge>
+                )}
+              </div>
+              {selected.description && (
+                <p className="mt-0.5 text-muted-foreground text-sm">{selected.description}</p>
+              )}
+            </div>
+            <div className="flex items-center gap-2">
+              <Switch
+                aria-label="Enabled"
+                checked={selected.enabled}
+                disabled={pending}
+                onCheckedChange={(v) => act(() => setAutomationEnabled(selected.id, v))}
+              />
+              <span className="text-muted-foreground text-xs">
+                {selected.enabled ? "Enabled" : "Disabled"}
+              </span>
+            </div>
+          </div>
+
+          <div className="mt-3 flex flex-wrap gap-2">
+            <Button
+              disabled={pending}
+              onClick={() => act(() => runAutomation(selected.id))}
+              size="sm"
+              variant="outline"
+            >
+              <PlayIcon className="size-4" /> Run now
+            </Button>
+            {selected.editor_url && (
+              <Button asChild size="sm" variant="ghost">
+                <a href={selected.editor_url} rel="noopener noreferrer" target="_blank">
+                  <ExternalLinkIcon className="size-4" /> Editor
+                </a>
+              </Button>
+            )}
+            {confirmDelete ? (
+              <Button
+                disabled={pending}
+                onClick={() => act(() => deleteAutomation(selected.id), true)}
+                size="sm"
+                variant="destructive"
+              >
+                <Trash2Icon className="size-4" /> Confirm delete
+              </Button>
+            ) : (
+              <Button
+                disabled={pending}
+                onClick={() => setConfirmDelete(true)}
+                size="sm"
+                variant="ghost"
+              >
+                <Trash2Icon className="size-4" /> Delete
+              </Button>
+            )}
+          </div>
+
+          {(selected.status === "trigger_failed" || selected.status === "trigger_claim_failed") && (
+            <p className="mt-3 rounded-md border border-destructive/40 bg-destructive/10 px-3 py-2 text-destructive text-sm">
+              This automation’s trigger couldn’t subscribe, so it won’t fire. Reconnect the app or
+              check the trigger inputs, then toggle it off and on to re-arm.
+            </p>
+          )}
+
+          <Tabs className="mt-4" defaultValue="runs">
+            <TabsList>
+              <TabsTrigger value="runs">
+                <RefreshCwIcon className="size-3.5" /> Runs
+              </TabsTrigger>
+              <TabsTrigger value="inbox">
+                <InboxIcon className="size-3.5" /> Trigger inbox
+              </TabsTrigger>
+            </TabsList>
+
+            <TabsContent value="runs">
+              {detail && detail.runs.length > 0 ? (
+                <div className="space-y-2">
+                  {hasPendingRun && (
+                    <p className="flex items-center gap-1.5 text-muted-foreground text-xs">
+                      <RefreshCwIcon className="size-3 animate-spin" /> Live — updating as runs
+                      complete…
+                    </p>
+                  )}
+                  <Table>
+                    <TableHeader>
+                      <TableRow>
+                        <TableHead className="w-6" />
+                        <TableHead>When</TableHead>
+                        <TableHead>Status</TableHead>
+                        <TableHead>Durable run</TableHead>
+                        <TableHead className="w-16" />
+                      </TableRow>
+                    </TableHeader>
+                    <TableBody>
+                      {pagedRuns.map((r) => {
+                        const detailJson = r.error != null ? r.error : (r.output ?? null);
+                        const expandable = detailJson != null;
+                        const expanded = expandedRunId === r.id;
+                        return (
+                          <Fragment key={r.id}>
+                            <TableRow
+                              className={expandable ? "cursor-pointer" : undefined}
+                              onClick={
+                                expandable
+                                  ? () => setExpandedRunId(expanded ? null : r.id)
+                                  : undefined
+                              }
+                            >
+                              <TableCell className="text-muted-foreground">
+                                {expandable &&
+                                  (expanded ? (
+                                    <ChevronDownIcon className="size-4" />
+                                  ) : (
+                                    <ChevronRightIcon className="size-4" />
+                                  ))}
+                              </TableCell>
+                              <TableCell className="text-muted-foreground text-xs">
+                                {new Date(r.created_at).toLocaleString()}
+                              </TableCell>
+                              <TableCell>
+                                <Badge variant={runStatusVariant(r.status)}>{r.status}</Badge>
+                              </TableCell>
+                              <TableCell className="font-mono text-xs">
+                                {r.durable_run_id ? shortId(r.durable_run_id) : "—"}
+                              </TableCell>
+                              <TableCell className="text-right">
+                                {r.status === "waiting" ? (
+                                  <div className="flex items-center justify-end gap-1">
+                                    <Button
+                                      aria-label="Approve"
+                                      className="h-7 px-2 text-muted-foreground hover:text-primary"
+                                      disabled={pending}
+                                      onClick={(e) => {
+                                        e.stopPropagation();
+                                        act(() =>
+                                          respondToCallback(r.id, { payload: { approved: true } }),
+                                        );
+                                      }}
+                                      size="sm"
+                                      variant="ghost"
+                                    >
+                                      <CheckIcon className="size-4" /> Approve
+                                    </Button>
+                                    <Button
+                                      aria-label="Deny"
+                                      className="size-7 text-muted-foreground hover:text-destructive"
+                                      disabled={pending}
+                                      onClick={(e) => {
+                                        e.stopPropagation();
+                                        act(() => respondToCallback(r.id, { cancel: true }));
+                                      }}
+                                      size="icon"
+                                      variant="ghost"
+                                    >
+                                      <XIcon className="size-4" />
+                                    </Button>
+                                  </div>
+                                ) : (
+                                  NON_TERMINAL_RUN.has(r.status) && (
+                                    <Button
+                                      aria-label="Cancel run"
+                                      className="size-7 text-muted-foreground hover:text-destructive"
+                                      disabled={pending}
+                                      onClick={(e) => {
+                                        e.stopPropagation();
+                                        act(() => cancelRun(r.id));
+                                      }}
+                                      size="icon"
+                                      variant="ghost"
+                                    >
+                                      <XIcon className="size-4" />
+                                    </Button>
+                                  )
+                                )}
+                              </TableCell>
+                            </TableRow>
+                            {expanded && detailJson != null && (
+                              <TableRow className="hover:bg-transparent">
+                                <TableCell className="p-0" colSpan={5}>
+                                  <div className="px-3 pb-3">
+                                    <p className="mb-1 text-muted-foreground text-xs">
+                                      {r.status === "waiting"
+                                        ? "Waiting for approval"
+                                        : r.status === "retrying"
+                                          ? "Retry detail"
+                                          : r.error != null
+                                            ? "Error"
+                                            : "Output"}
+                                    </p>
+                                    <pre className="max-h-64 overflow-auto rounded-md bg-muted p-3 text-xs">
+                                      {prettyJson(detailJson)}
+                                    </pre>
+                                  </div>
+                                </TableCell>
+                              </TableRow>
+                            )}
+                          </Fragment>
+                        );
+                      })}
+                    </TableBody>
+                  </Table>
+                  {runsPageCount > 1 && (
+                    <Pagination className="justify-end">
+                      <PaginationContent>
+                        <PaginationItem>
+                          <PaginationPrevious
+                            aria-disabled={runsSafePage === 0}
+                            className={
+                              runsSafePage === 0 ? "pointer-events-none opacity-50" : undefined
+                            }
+                            href="#"
+                            onClick={(e) => {
+                              e.preventDefault();
+                              setRunsPage(Math.max(0, runsSafePage - 1));
+                            }}
+                          />
+                        </PaginationItem>
+                        <PaginationItem>
+                          <span className="px-2 text-muted-foreground text-xs">
+                            Page {runsSafePage + 1} of {runsPageCount}
+                          </span>
+                        </PaginationItem>
+                        <PaginationItem>
+                          <PaginationNext
+                            aria-disabled={runsSafePage >= runsPageCount - 1}
+                            className={
+                              runsSafePage >= runsPageCount - 1
+                                ? "pointer-events-none opacity-50"
+                                : undefined
+                            }
+                            href="#"
+                            onClick={(e) => {
+                              e.preventDefault();
+                              setRunsPage(Math.min(runsPageCount - 1, runsSafePage + 1));
+                            }}
+                          />
+                        </PaginationItem>
+                      </PaginationContent>
+                    </Pagination>
+                  )}
+                </div>
+              ) : (
+                <p className="py-4 text-muted-foreground text-sm">No runs yet.</p>
+              )}
+            </TabsContent>
+
+            <TabsContent value="inbox">
+              {selected.trigger?.schedule ? (
+                <p className="py-4 text-muted-foreground text-sm">
+                  {selected.trigger.digest
+                    ? `Daily digest — ${scheduleLabel(selected.trigger.schedule)}. Synthesizes a prioritized summary of recent activity into the Inbox. No trigger inbox.`
+                    : `Scheduled automation — fires ${scheduleLabel(selected.trigger.schedule).toLowerCase()}. No trigger inbox.`}
+                </p>
+              ) : !selected.trigger ? (
+                <p className="py-4 text-muted-foreground text-sm">
+                  Manual automation — no trigger inbox. Use “Run now” to fire it.
+                </p>
+              ) : inbox?.inbox ? (
+                <div className="space-y-3">
+                  <div className="flex flex-wrap items-center gap-2 text-sm">
+                    <Badge variant={inbox.inbox.status === "active" ? "default" : "secondary"}>
+                      {inbox.inbox.status}
+                    </Badge>
+                    <span className="font-mono text-muted-foreground text-xs">
+                      {inbox.inbox.subscription.app_key}/{inbox.inbox.subscription.action_key}
+                    </span>
+                  </div>
+                  {inbox.messages.length > 0 ? (
+                    <Table>
+                      <TableHeader>
+                        <TableRow>
+                          <TableHead>Message</TableHead>
+                          <TableHead>When</TableHead>
+                          <TableHead>Leases</TableHead>
+                          <TableHead>Dup?</TableHead>
+                        </TableRow>
+                      </TableHeader>
+                      <TableBody>
+                        {inbox.messages.map((m) => (
+                          <TableRow key={m.id}>
+                            <TableCell className="font-mono text-xs">{shortId(m.id)}</TableCell>
+                            <TableCell className="text-muted-foreground text-xs">
+                              {new Date(m.created_at).toLocaleString()}
+                            </TableCell>
+                            <TableCell>{m.message_attributes.lease_count}</TableCell>
+                            <TableCell>
+                              {m.message_attributes.possible_duplicate_data ? (
+                                <Badge variant="destructive">dup</Badge>
+                              ) : (
+                                "—"
+                              )}
+                            </TableCell>
+                          </TableRow>
+                        ))}
+                      </TableBody>
+                    </Table>
+                  ) : (
+                    <p className="text-muted-foreground text-sm">
+                      Inbox armed, no messages yet. The first poll of a fresh subscription can take
+                      several minutes.
+                    </p>
+                  )}
+                </div>
+              ) : (
+                <p className="py-4 text-muted-foreground text-sm">
+                  Not armed yet — the worker creates the trigger inbox on its next cycle.
+                </p>
+              )}
+            </TabsContent>
+          </Tabs>
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/packages/web/src/components/brand-header.tsx b/packages/web/src/components/brand-header.tsx
new file mode 100644
index 00000000..387cede4
--- /dev/null
+++ b/packages/web/src/components/brand-header.tsx
@@ -0,0 +1,24 @@
+import Link from "next/link";
+
+/**
+ * Shared app brand header: the Zapier mark + "Foreman" wordmark, with an
+ * optional breadcrumb segment. Matches the chat sidebar's brand mark
+ * (`/zapier.svg`) so branding stays consistent across the app.
+ */
+export function BrandHeader({ label }: { label?: React.ReactNode }) {
+  return (
+    <header className="flex items-center gap-4 border-b border-border px-6 py-4 sm:px-8">
+      <Link className="flex items-center gap-2.5" href="/chat">
+        {/* biome-ignore lint/performance/noImgElement: small static brand asset, next/image is overkill */}
+        <img alt="Zapier" className="size-5" height={20} src="/zapier.svg" width={20} />
+        <span className="text-sm font-semibold tracking-tight text-foreground">Foreman</span>
+      </Link>
+      {label != null && (
+        <>
+          <span className="text-sm text-muted-foreground">/</span>
+          {label}
+        </>
+      )}
+    </header>
+  );
+}
diff --git a/packages/web/src/components/chat/app-sidebar.tsx b/packages/web/src/components/chat/app-sidebar.tsx
index f5ae7232..c346a3e6 100644
--- a/packages/web/src/components/chat/app-sidebar.tsx
+++ b/packages/web/src/components/chat/app-sidebar.tsx
@@ -1,21 +1,22 @@
 "use client";
 
 import {
-  MessageSquareIcon,
+  FileTextIcon,
+  InboxIcon,
+  LayoutDashboardIcon,
+  type LucideIcon,
   PanelLeftIcon,
   PenSquareIcon,
-  Settings2Icon,
-  TrashIcon,
-  WorkflowIcon,
+  SearchIcon,
+  UsersIcon,
+  ZapIcon,
 } from "lucide-react";
 import Link from "next/link";
-import { useRouter } from "next/navigation";
-import { useState } from "react";
-import { toast } from "sonner";
-import { useSWRConfig } from "swr";
-import { unstable_serialize } from "swr/infinite";
-import { getChatHistoryPaginationKey, SidebarHistory } from "@/components/chat/sidebar-history";
+import { usePathname, useRouter } from "next/navigation";
+import { SidebarHistory } from "@/components/chat/sidebar-history";
 import { SidebarUserNav } from "@/components/chat/sidebar-user-nav";
+import { CommandPalette, OPEN_COMMAND_PALETTE_EVENT } from "@/components/command-palette";
+import { Kbd } from "@/components/ui/kbd";
 import {
   Sidebar,
   SidebarContent,
@@ -30,41 +31,26 @@ import {
   SidebarTrigger,
   useSidebar,
 } from "@/components/ui/sidebar";
+import { WorkspaceSwitcher } from "@/components/workspaces/workspace-switcher";
 import type { SessionUser as User } from "@/lib/auth";
-import {
-  AlertDialog,
-  AlertDialogAction,
-  AlertDialogCancel,
-  AlertDialogContent,
-  AlertDialogDescription,
-  AlertDialogFooter,
-  AlertDialogHeader,
-  AlertDialogTitle,
-} from "../ui/alert-dialog";
 import { Tooltip, TooltipContent, TooltipTrigger } from "../ui/tooltip";
 
+const NAV: Array<{ href: string; label: string; Icon: LucideIcon }> = [
+  { href: "/automations", label: "Automations", Icon: ZapIcon },
+  { href: "/inbox", label: "Inbox", Icon: InboxIcon },
+  { href: "/apps", label: "Apps", Icon: LayoutDashboardIcon },
+  { href: "/documents", label: "Documents", Icon: FileTextIcon },
+  { href: "/workspaces", label: "Workspaces", Icon: UsersIcon },
+];
+
 export function AppSidebar({ user }: { user: User | undefined }) {
   const router = useRouter();
+  const pathname = usePathname();
   const { setOpenMobile, toggleSidebar } = useSidebar();
-  const { mutate } = useSWRConfig();
-  const [showDeleteAllDialog, setShowDeleteAllDialog] = useState(false);
-
-  const handleDeleteAll = () => {
-    setShowDeleteAllDialog(false);
-    router.replace("/");
-    mutate(unstable_serialize(getChatHistoryPaginationKey), [], {
-      revalidate: false,
-    });
-
-    fetch(`${process.env.NEXT_PUBLIC_BASE_PATH ?? ""}/api/history`, {
-      method: "DELETE",
-    });
-
-    toast.success("All chats deleted");
-  };
 
   return (
     <>
+      <CommandPalette />
       <Sidebar collapsible="icon">
         <SidebarHeader className="pb-0 pt-3">
           <SidebarMenu>
@@ -73,10 +59,17 @@ export function AppSidebar({ user }: { user: User | undefined }) {
                 <SidebarMenuButton
                   asChild
                   className="size-8 !px-0 items-center justify-center group-data-[collapsible=icon]:group-hover/logo:opacity-0"
-                  tooltip="Chatbot"
+                  tooltip="Foreman"
                 >
                   <Link href="/" onClick={() => setOpenMobile(false)}>
-                    <MessageSquareIcon className="size-4 text-sidebar-foreground/50" />
+                    {/* biome-ignore lint/performance/noImgElement: small static brand asset, next/image is overkill */}
+                    <img
+                      alt="Zapier"
+                      className="size-5 object-contain group-data-[collapsible=icon]:size-4"
+                      height={20}
+                      src="/zapier.svg"
+                      width={20}
+                    />
                   </Link>
                 </SidebarMenuButton>
                 <Tooltip>
@@ -98,90 +91,67 @@ export function AppSidebar({ user }: { user: User | undefined }) {
               </div>
             </SidebarMenuItem>
           </SidebarMenu>
+          <WorkspaceSwitcher />
         </SidebarHeader>
         <SidebarContent>
-          <SidebarGroup className="pt-1">
+          <SidebarGroup className="pt-2">
             <SidebarGroupContent>
               <SidebarMenu>
                 <SidebarMenuItem>
                   <SidebarMenuButton
-                    className="h-8 rounded-lg border border-sidebar-border text-[13px] text-sidebar-foreground/70 transition-colors duration-150 hover:bg-sidebar-accent/50 hover:text-sidebar-foreground"
+                    className="h-8 rounded-lg text-[13px] font-medium text-sidebar-foreground/80 transition-colors duration-150 hover:bg-sidebar-accent/50 hover:text-sidebar-foreground"
                     onClick={() => {
                       setOpenMobile(false);
-                      router.push("/");
+                      router.push("/chat");
                     }}
                     tooltip="New Chat"
                   >
                     <PenSquareIcon className="size-4" />
-                    <span className="font-medium">New chat</span>
+                    <span>New chat</span>
                   </SidebarMenuButton>
                 </SidebarMenuItem>
                 {user && (
                   <SidebarMenuItem>
                     <SidebarMenuButton
-                      asChild
-                      className="rounded-lg text-sidebar-foreground/60 transition-colors duration-150 hover:bg-sidebar-accent/50 hover:text-sidebar-foreground"
-                      tooltip="Workflows"
-                    >
-                      <Link href="/workflows" onClick={() => setOpenMobile(false)}>
-                        <WorkflowIcon className="size-4" />
-                        <span className="text-[13px]">Workflows</span>
-                      </Link>
-                    </SidebarMenuButton>
-                  </SidebarMenuItem>
-                )}
-                {user && (
-                  <SidebarMenuItem>
-                    <SidebarMenuButton
-                      asChild
-                      className="rounded-lg text-sidebar-foreground/60 transition-colors duration-150 hover:bg-sidebar-accent/50 hover:text-sidebar-foreground"
-                      tooltip="Settings"
-                    >
-                      <Link href="/settings/integrations" onClick={() => setOpenMobile(false)}>
-                        <Settings2Icon className="size-4" />
-                        <span className="text-[13px]">Settings</span>
-                      </Link>
-                    </SidebarMenuButton>
-                  </SidebarMenuItem>
-                )}
-                {user && (
-                  <SidebarMenuItem>
-                    <SidebarMenuButton
-                      className="rounded-lg text-sidebar-foreground/40 transition-colors duration-150 hover:bg-destructive/10 hover:text-destructive"
-                      onClick={() => setShowDeleteAllDialog(true)}
-                      tooltip="Delete All Chats"
+                      className="h-8 rounded-lg text-[13px] text-sidebar-foreground/60 transition-colors duration-150 hover:bg-sidebar-accent/50 hover:text-sidebar-foreground"
+                      onClick={() => {
+                        setOpenMobile(false);
+                        window.dispatchEvent(new Event(OPEN_COMMAND_PALETTE_EVENT));
+                      }}
+                      tooltip="Search (⌘K)"
                     >
-                      <TrashIcon className="size-4" />
-                      <span className="text-[13px]">Delete all</span>
+                      <SearchIcon className="size-4" />
+                      <span>Search</span>
+                      <Kbd className="ml-auto group-data-[collapsible=icon]:hidden">⌘K</Kbd>
                     </SidebarMenuButton>
                   </SidebarMenuItem>
                 )}
+                {user &&
+                  NAV.map(({ href, label, Icon }) => (
+                    <SidebarMenuItem key={href}>
+                      <SidebarMenuButton
+                        asChild
+                        isActive={pathname.startsWith(href)}
+                        className="h-8 rounded-lg text-sidebar-foreground/60 transition-colors duration-150 hover:bg-sidebar-accent/50 hover:text-sidebar-foreground data-[active=true]:bg-sidebar-accent data-[active=true]:text-sidebar-foreground"
+                        tooltip={label}
+                      >
+                        <Link href={href} onClick={() => setOpenMobile(false)}>
+                          <Icon className="size-4" />
+                          <span className="text-[13px]">{label}</span>
+                        </Link>
+                      </SidebarMenuButton>
+                    </SidebarMenuItem>
+                  ))}
               </SidebarMenu>
             </SidebarGroupContent>
           </SidebarGroup>
           <SidebarHistory user={user} />
         </SidebarContent>
-        <SidebarFooter className="border-t border-sidebar-border pt-2 pb-3">
+        <SidebarFooter className="border-t border-sidebar-border pt-2 pb-5">
           {user && <SidebarUserNav user={user} />}
         </SidebarFooter>
         <SidebarRail />
       </Sidebar>
-
-      <AlertDialog onOpenChange={setShowDeleteAllDialog} open={showDeleteAllDialog}>
-        <AlertDialogContent>
-          <AlertDialogHeader>
-            <AlertDialogTitle>Delete all chats?</AlertDialogTitle>
-            <AlertDialogDescription>
-              This action cannot be undone. This will permanently delete all your chats and remove
-              them from our servers.
-            </AlertDialogDescription>
-          </AlertDialogHeader>
-          <AlertDialogFooter>
-            <AlertDialogCancel>Cancel</AlertDialogCancel>
-            <AlertDialogAction onClick={handleDeleteAll}>Delete All</AlertDialogAction>
-          </AlertDialogFooter>
-        </AlertDialogContent>
-      </AlertDialog>
     </>
   );
 }
diff --git a/packages/web/src/components/chat/artifact-actions.tsx b/packages/web/src/components/chat/artifact-actions.tsx
index b609cad5..dcf067f8 100644
--- a/packages/web/src/components/chat/artifact-actions.tsx
+++ b/packages/web/src/components/chat/artifact-actions.tsx
@@ -1,6 +1,7 @@
 import { memo, useState } from "react";
 import { toast } from "sonner";
 import { cn } from "@/lib/utils";
+import { Button } from "../ui/button";
 import { Tooltip, TooltipContent, TooltipTrigger } from "../ui/tooltip";
 import { artifactDefinitions, type UIArtifact } from "./artifact";
 import type { ArtifactActionContext } from "./create-artifact";
@@ -57,10 +58,9 @@ function PureArtifactActions({
         return (
           <Tooltip key={action.description}>
             <TooltipTrigger asChild>
-              <button
+              <Button
                 className={cn(
-                  "flex items-center justify-center rounded-full p-3 text-muted-foreground transition-all duration-150",
-                  "hover:text-foreground",
+                  "rounded-full p-3 text-muted-foreground",
                   "active:scale-95",
                   "disabled:pointer-events-none disabled:opacity-30",
                   {
@@ -80,9 +80,10 @@ function PureArtifactActions({
                   }
                 }}
                 type="button"
+                variant="ghost"
               >
                 {action.icon}
-              </button>
+              </Button>
             </TooltipTrigger>
             <TooltipContent side="left" sideOffset={8}>
               {action.description}
diff --git a/packages/web/src/components/chat/artifact-close-button.tsx b/packages/web/src/components/chat/artifact-close-button.tsx
index 0027db04..fd6f6370 100644
--- a/packages/web/src/components/chat/artifact-close-button.tsx
+++ b/packages/web/src/components/chat/artifact-close-button.tsx
@@ -1,13 +1,14 @@
 import { memo } from "react";
 import { initialArtifactData, useArtifact } from "@/hooks/use-artifact";
+import { Button } from "../ui/button";
 import { CrossIcon } from "./icons";
 
 function PureArtifactCloseButton() {
   const { setArtifact } = useArtifact();
 
   return (
-    <button
-      className="group flex size-8 items-center justify-center rounded-lg border border-transparent text-muted-foreground transition-all duration-150 hover:border-border hover:bg-muted hover:text-foreground active:scale-95"
+    <Button
+      className="group rounded-lg border-transparent text-muted-foreground hover:border-border active:scale-95"
       data-testid="artifact-close-button"
       onClick={() => {
         setArtifact((currentArtifact) =>
@@ -19,10 +20,12 @@ function PureArtifactCloseButton() {
             : { ...initialArtifactData, status: "idle" },
         );
       }}
+      size="icon-sm"
       type="button"
+      variant="ghost"
     >
       <CrossIcon size={16} />
-    </button>
+    </Button>
   );
 }
 
diff --git a/packages/web/src/components/chat/chat-header.tsx b/packages/web/src/components/chat/chat-header.tsx
index 93da4167..d95d8b76 100644
--- a/packages/web/src/components/chat/chat-header.tsx
+++ b/packages/web/src/components/chat/chat-header.tsx
@@ -4,16 +4,19 @@ import { PanelLeftIcon } from "lucide-react";
 import { memo } from "react";
 import { Button } from "@/components/ui/button";
 import { useSidebar } from "@/components/ui/sidebar";
+import { ShareButton } from "./share-button";
 import { VisibilitySelector, type VisibilityType } from "./visibility-selector";
 
 function PureChatHeader({
   chatId,
+  title,
   selectedVisibilityType,
-  isReadonly,
+  isOwner,
 }: {
   chatId: string;
+  title: string | null;
   selectedVisibilityType: VisibilityType;
-  isReadonly: boolean;
+  isOwner: boolean;
 }) {
   const { state, toggleSidebar, isMobile } = useSidebar();
 
@@ -22,13 +25,20 @@ function PureChatHeader({
   }
 
   return (
-    <header className="sticky top-0 flex h-14 items-center gap-2 bg-sidebar px-3">
+    <header className="flex h-12 items-center gap-2 border-b border-border/50 px-3">
       <Button className="md:hidden" onClick={toggleSidebar} size="icon-sm" variant="ghost">
         <PanelLeftIcon className="size-4" />
       </Button>
 
-      {!isReadonly && (
-        <VisibilitySelector chatId={chatId} selectedVisibilityType={selectedVisibilityType} />
+      <h1 className="min-w-0 flex-1 truncate font-medium text-foreground/80 text-sm">
+        {title || "New chat"}
+      </h1>
+
+      {isOwner && (
+        <>
+          <ShareButton chatId={chatId} />
+          <VisibilitySelector chatId={chatId} selectedVisibilityType={selectedVisibilityType} />
+        </>
       )}
     </header>
   );
@@ -37,7 +47,8 @@ function PureChatHeader({
 export const ChatHeader = memo(PureChatHeader, (prevProps, nextProps) => {
   return (
     prevProps.chatId === nextProps.chatId &&
+    prevProps.title === nextProps.title &&
     prevProps.selectedVisibilityType === nextProps.selectedVisibilityType &&
-    prevProps.isReadonly === nextProps.isReadonly
+    prevProps.isOwner === nextProps.isOwner
   );
 });
diff --git a/packages/web/src/components/chat/context-usage.tsx b/packages/web/src/components/chat/context-usage.tsx
new file mode 100644
index 00000000..8197ae90
--- /dev/null
+++ b/packages/web/src/components/chat/context-usage.tsx
@@ -0,0 +1,93 @@
+"use client";
+
+import { HoverCard, HoverCardContent, HoverCardTrigger } from "@/components/ui/hover-card";
+import { cn } from "@/lib/utils";
+
+export type TokenUsage = {
+  inputTokens?: number;
+  outputTokens?: number;
+  totalTokens?: number;
+  reasoningTokens?: number;
+  cachedInputTokens?: number;
+};
+
+function format(n: number | undefined): string {
+  if (!n) return "0";
+  if (n >= 1000) return `${(n / 1000).toFixed(n >= 10_000 ? 0 : 1)}k`;
+  return String(n);
+}
+
+function Row({ label, value }: { label: string; value: string }) {
+  return (
+    <div className="flex items-center justify-between gap-4">
+      <span className="text-muted-foreground">{label}</span>
+      <span className="tabular-nums">{value}</span>
+    </div>
+  );
+}
+
+/**
+ * Context-window usage gauge for the composer — a small ring + percent that
+ * expands (on hover) into the input/output/reasoning/cache breakdown. Faithful
+ * to Vercel AI Elements' Context component, built on the vendored hover-card
+ * primitive (no tokenlens dependency; window size comes from the models config).
+ */
+export function ContextUsage({
+  usage,
+  maxTokens,
+  className,
+}: {
+  usage: TokenUsage | null | undefined;
+  maxTokens: number;
+  className?: string;
+}) {
+  const used = usage?.totalTokens ?? (usage?.inputTokens ?? 0) + (usage?.outputTokens ?? 0);
+  if (!usage || !used) return null;
+
+  const pct = Math.min(100, Math.round((used / maxTokens) * 100));
+  // 14px ring (r=6 → circumference ≈ 37.7).
+  const circumference = 2 * Math.PI * 6;
+  const dashoffset = circumference * (1 - pct / 100);
+
+  return (
+    <HoverCard openDelay={120}>
+      <HoverCardTrigger asChild>
+        <button
+          aria-label={`Context: ${pct}% of ${format(maxTokens)} tokens used`}
+          className={cn(
+            "flex items-center gap-1.5 rounded-md px-1.5 py-1 text-[11px] text-muted-foreground transition-colors hover:text-foreground",
+            className,
+          )}
+          type="button"
+        >
+          <svg aria-hidden className="-rotate-90 size-3.5" fill="none" viewBox="0 0 14 14">
+            <circle cx="7" cy="7" r="6" stroke="currentColor" strokeOpacity={0.2} strokeWidth={2} />
+            <circle
+              cx="7"
+              cy="7"
+              r="6"
+              stroke="currentColor"
+              strokeDasharray={circumference}
+              strokeDashoffset={dashoffset}
+              strokeLinecap="round"
+              strokeWidth={2}
+            />
+          </svg>
+          <span className="tabular-nums">{pct}%</span>
+        </button>
+      </HoverCardTrigger>
+      <HoverCardContent align="end" className="w-52 space-y-1.5 text-xs">
+        <div className="font-medium text-foreground">Context usage</div>
+        <Row label="Used" value={`${format(used)} / ${format(maxTokens)}`} />
+        <Row label="Input" value={format(usage.inputTokens)} />
+        <Row label="Output" value={format(usage.outputTokens)} />
+        {usage.reasoningTokens ? (
+          <Row label="Reasoning" value={format(usage.reasoningTokens)} />
+        ) : null}
+        {usage.cachedInputTokens ? (
+          <Row label="Cached" value={format(usage.cachedInputTokens)} />
+        ) : null}
+      </HoverCardContent>
+    </HoverCard>
+  );
+}
diff --git a/packages/web/src/components/chat/dev-console.tsx b/packages/web/src/components/chat/dev-console.tsx
index 872f590e..7125c16c 100644
--- a/packages/web/src/components/chat/dev-console.tsx
+++ b/packages/web/src/components/chat/dev-console.tsx
@@ -113,7 +113,7 @@ export function DevConsolePanel() {
   }
 
   return (
-    <div className="fixed bottom-0 right-0 z-[9999] flex h-[350px] w-[600px] flex-col overflow-hidden rounded-tl-lg border border-border/50 bg-background/95 shadow-2xl backdrop-blur-lg">
+    <div className="fixed bottom-0 right-0 z-[9999] flex h-[350px] w-[min(100%,600px)] flex-col overflow-hidden rounded-tl-lg border border-border/50 bg-background/95 shadow-2xl backdrop-blur-lg">
       {/* Header */}
       <div className="flex items-center justify-between border-b border-border/50 bg-muted/30 px-3 py-1.5">
         <div className="flex items-center gap-2">
diff --git a/packages/web/src/components/chat/document-preview.tsx b/packages/web/src/components/chat/document-preview.tsx
index d75a419d..aa18e100 100644
--- a/packages/web/src/components/chat/document-preview.tsx
+++ b/packages/web/src/components/chat/document-preview.tsx
@@ -3,6 +3,7 @@
 import equal from "fast-deep-equal";
 import { type MouseEvent, memo, useCallback, useEffect, useMemo, useRef } from "react";
 import useSWR from "swr";
+import { Skeleton } from "@/components/ui/skeleton";
 import { useArtifact } from "@/hooks/use-artifact";
 import type { Document } from "@/lib/db/schema";
 import { cn, fetcher } from "@/lib/utils";
@@ -65,8 +66,8 @@ export function DocumentPreview({ isReadonly: _isReadonly, result, args }: Docum
         ) : (
           <div className="flex flex-row items-center justify-between gap-2 rounded-t-2xl border border-b-0 border-border/50 px-4 py-3 dark:bg-muted">
             <div className="flex flex-row items-center gap-2.5">
-              <div className="size-3.5 animate-pulse rounded bg-muted-foreground/15" />
-              <div className="h-3.5 w-24 animate-pulse rounded bg-muted-foreground/15" />
+              <Skeleton className="size-3.5 rounded bg-muted-foreground/15" />
+              <Skeleton className="h-3.5 w-24 rounded bg-muted-foreground/15" />
             </div>
             <div className="w-8" />
           </div>
@@ -112,14 +113,14 @@ const LoadingSkeleton = ({ artifactKind }: { artifactKind: ArtifactKind }) => (
   <div className="w-full max-w-[450px]">
     <div className="flex flex-row items-center justify-between gap-2 rounded-t-2xl border border-b-0 border-border/50 px-4 py-3 dark:bg-muted">
       <div className="flex flex-row items-center gap-2.5">
-        <div className="size-3.5 animate-pulse rounded bg-muted-foreground/15" />
-        <div className="h-3.5 w-24 animate-pulse rounded bg-muted-foreground/15" />
+        <Skeleton className="size-3.5 rounded bg-muted-foreground/15" />
+        <Skeleton className="h-3.5 w-24 rounded bg-muted-foreground/15" />
       </div>
       <div className="w-8" />
     </div>
     {artifactKind === "image" ? (
       <div className="overflow-hidden rounded-b-2xl border border-t-0 border-border/50 bg-muted">
-        <div className="h-[257px] w-full animate-pulse bg-muted-foreground/10" />
+        <Skeleton className="h-[257px] w-full rounded-none bg-muted-foreground/10" />
       </div>
     ) : (
       <div className="h-[257px] overflow-hidden rounded-b-2xl border border-t-0 border-border/50 bg-muted p-6">
diff --git a/packages/web/src/components/chat/document-skeleton.tsx b/packages/web/src/components/chat/document-skeleton.tsx
index e0a18f8e..fe26e5d6 100644
--- a/packages/web/src/components/chat/document-skeleton.tsx
+++ b/packages/web/src/components/chat/document-skeleton.tsx
@@ -1,22 +1,23 @@
 "use client";
 
+import { Skeleton } from "@/components/ui/skeleton";
 import type { ArtifactKind } from "./artifact";
 
 export const DocumentSkeleton = ({ artifactKind }: { artifactKind: ArtifactKind }) => {
   return artifactKind === "image" ? (
     <div className="flex h-[calc(100dvh-60px)] w-full flex-col items-center justify-center gap-4">
-      <div className="size-96 animate-pulse rounded-lg bg-muted-foreground/10" />
+      <Skeleton className="size-96 rounded-lg bg-muted-foreground/10" />
     </div>
   ) : (
     <div className="flex w-full flex-col gap-4 px-4 py-8 md:px-20 md:py-12">
-      <div className="h-8 w-2/5 animate-pulse rounded-md bg-muted-foreground/10" />
-      <div className="h-4 w-full animate-pulse rounded-md bg-muted-foreground/8" />
-      <div className="h-4 w-full animate-pulse rounded-md bg-muted-foreground/8" />
-      <div className="h-4 w-3/4 animate-pulse rounded-md bg-muted-foreground/8" />
+      <Skeleton className="h-8 w-2/5 rounded-md bg-muted-foreground/10" />
+      <Skeleton className="h-4 w-full rounded-md bg-muted-foreground/8" />
+      <Skeleton className="h-4 w-full rounded-md bg-muted-foreground/8" />
+      <Skeleton className="h-4 w-3/4 rounded-md bg-muted-foreground/8" />
       <div className="h-4 w-0 rounded-md" />
-      <div className="h-6 w-1/3 animate-pulse rounded-md bg-muted-foreground/10" />
-      <div className="h-4 w-5/6 animate-pulse rounded-md bg-muted-foreground/8" />
-      <div className="h-4 w-2/3 animate-pulse rounded-md bg-muted-foreground/8" />
+      <Skeleton className="h-6 w-1/3 rounded-md bg-muted-foreground/10" />
+      <Skeleton className="h-4 w-5/6 rounded-md bg-muted-foreground/8" />
+      <Skeleton className="h-4 w-2/3 rounded-md bg-muted-foreground/8" />
     </div>
   );
 };
@@ -24,11 +25,11 @@ export const DocumentSkeleton = ({ artifactKind }: { artifactKind: ArtifactKind
 export const InlineDocumentSkeleton = () => {
   return (
     <div className="flex w-full flex-col gap-3">
-      <div className="h-3.5 w-48 animate-pulse rounded bg-muted-foreground/10" />
-      <div className="h-3.5 w-3/4 animate-pulse rounded bg-muted-foreground/8" />
-      <div className="h-3.5 w-1/2 animate-pulse rounded bg-muted-foreground/8" />
-      <div className="h-3.5 w-64 animate-pulse rounded bg-muted-foreground/8" />
-      <div className="h-3.5 w-40 animate-pulse rounded bg-muted-foreground/8" />
+      <Skeleton className="h-3.5 w-48 rounded bg-muted-foreground/10" />
+      <Skeleton className="h-3.5 w-3/4 rounded bg-muted-foreground/8" />
+      <Skeleton className="h-3.5 w-1/2 rounded bg-muted-foreground/8" />
+      <Skeleton className="h-3.5 w-64 rounded bg-muted-foreground/8" />
+      <Skeleton className="h-3.5 w-40 rounded bg-muted-foreground/8" />
     </div>
   );
 };
diff --git a/packages/web/src/components/chat/document.tsx b/packages/web/src/components/chat/document.tsx
index 9f5a4bae..01aeb02f 100644
--- a/packages/web/src/components/chat/document.tsx
+++ b/packages/web/src/components/chat/document.tsx
@@ -1,6 +1,7 @@
 import { memo } from "react";
 import { toast } from "sonner";
 import { useArtifact } from "@/hooks/use-artifact";
+import { Button } from "../ui/button";
 import type { ArtifactKind } from "./artifact";
 import { FileIcon, LoaderIcon, MessageIcon, PencilEditIcon } from "./icons";
 
@@ -30,8 +31,8 @@ function PureDocumentToolResult({ type, result, isReadonly }: DocumentToolResult
   const { setArtifact } = useArtifact();
 
   return (
-    <button
-      className="flex w-fit cursor-pointer flex-row items-center gap-2 rounded-xl border bg-background px-3 py-2"
+    <Button
+      className="h-auto w-fit cursor-pointer flex-row items-center gap-2 rounded-xl border bg-background px-3 py-2"
       onClick={(event) => {
         if (isReadonly) {
           toast.error("Viewing files in shared chats is currently not supported.");
@@ -58,6 +59,7 @@ function PureDocumentToolResult({ type, result, isReadonly }: DocumentToolResult
         }));
       }}
       type="button"
+      variant="ghost"
     >
       <div className="text-muted-foreground">
         {type === "create" ? (
@@ -69,7 +71,7 @@ function PureDocumentToolResult({ type, result, isReadonly }: DocumentToolResult
         ) : null}
       </div>
       <div className="text-left">{`${getActionText(type, "past")} "${result.title}"`}</div>
-    </button>
+    </Button>
   );
 }
 
@@ -88,8 +90,8 @@ function PureDocumentToolCall({ type, args, isReadonly }: DocumentToolCallProps)
   const { setArtifact } = useArtifact();
 
   return (
-    <button
-      className="cursor pointer flex w-fit flex-row items-start justify-between gap-3 rounded-xl border px-3 py-2"
+    <Button
+      className="h-auto w-fit cursor-pointer flex-row items-start justify-between gap-3 rounded-xl border px-3 py-2"
       onClick={(event) => {
         if (isReadonly) {
           toast.error("Viewing files in shared chats is currently not supported.");
@@ -112,6 +114,7 @@ function PureDocumentToolCall({ type, args, isReadonly }: DocumentToolCallProps)
         }));
       }}
       type="button"
+      variant="ghost"
     >
       <div className="flex flex-row items-start gap-3">
         <div className="mt-1 text-neutral-500">
@@ -138,7 +141,7 @@ function PureDocumentToolCall({ type, args, isReadonly }: DocumentToolCallProps)
       </div>
 
       <div className="mt-1 animate-spin">{<LoaderIcon />}</div>
-    </button>
+    </Button>
   );
 }
 
diff --git a/packages/web/src/components/chat/greeting.tsx b/packages/web/src/components/chat/greeting.tsx
index 9878bad7..3fb6700e 100644
--- a/packages/web/src/components/chat/greeting.tsx
+++ b/packages/web/src/components/chat/greeting.tsx
@@ -1,6 +1,42 @@
+"use client";
+
 import { motion } from "framer-motion";
+import { useEffect, useState } from "react";
+import { createClient } from "@/lib/client";
+
+function timeGreeting(hour: number): string {
+  if (hour >= 5 && hour < 12) return "Good morning";
+  if (hour >= 12 && hour < 17) return "Good afternoon";
+  if (hour >= 17 && hour < 22) return "Good evening";
+  return "Welcome back";
+}
+
+function firstNameFrom(metadata: Record<string, unknown> | undefined): string | null {
+  const candidate =
+    metadata?.full_name ?? metadata?.name ?? metadata?.given_name ?? metadata?.first_name;
+  if (typeof candidate !== "string") return null;
+  const first = candidate.trim().split(/\s+/)[0];
+  return first || null;
+}
 
 export const Greeting = () => {
+  // Computed client-side (local time + session) to avoid SSR/timezone hydration
+  // mismatch; starts neutral, then fills in on mount.
+  const [greeting, setGreeting] = useState("Welcome back");
+  const [firstName, setFirstName] = useState<string | null>(null);
+
+  useEffect(() => {
+    setGreeting(timeGreeting(new Date().getHours()));
+    createClient()
+      .auth.getUser()
+      .then(({ data: { user } }) => {
+        if (user) setFirstName(firstNameFrom(user.user_metadata));
+      })
+      .catch(() => {});
+  }, []);
+
+  const heading = firstName ? `${greeting}, ${firstName}` : greeting;
+
   return (
     <div className="flex flex-col items-center px-4" key="overview">
       <motion.div
@@ -9,7 +45,7 @@ export const Greeting = () => {
         initial={{ opacity: 0, y: 10 }}
         transition={{ delay: 0.35, duration: 0.5, ease: [0.22, 1, 0.36, 1] }}
       >
-        What can I help with?
+        {heading}
       </motion.div>
       <motion.div
         animate={{ opacity: 1, y: 0 }}
@@ -17,7 +53,7 @@ export const Greeting = () => {
         initial={{ opacity: 0, y: 10 }}
         transition={{ delay: 0.5, duration: 0.5, ease: [0.22, 1, 0.36, 1] }}
       >
-        Ask a question, write code, or explore ideas.
+        What can I help with?
       </motion.div>
     </div>
   );
diff --git a/packages/web/src/components/chat/knowledge-panel.tsx b/packages/web/src/components/chat/knowledge-panel.tsx
new file mode 100644
index 00000000..dbf41df7
--- /dev/null
+++ b/packages/web/src/components/chat/knowledge-panel.tsx
@@ -0,0 +1,351 @@
+"use client";
+
+import {
+  CheckIcon,
+  CopyIcon,
+  FileTextIcon,
+  HistoryIcon,
+  Link2OffIcon,
+  LockIcon,
+  RotateCcwIcon,
+  Share2Icon,
+  UsersIcon,
+  XIcon,
+} from "lucide-react";
+import { useEffect, useRef, useState } from "react";
+import useSWR, { useSWRConfig } from "swr";
+import {
+  Artifact,
+  ArtifactContent,
+  ArtifactHeader,
+  ArtifactTitle,
+} from "@/components/ai-elements/artifact";
+import { MessageResponse } from "@/components/ai-elements/message";
+import { Button } from "@/components/ui/button";
+import { Popover, PopoverContent, PopoverTrigger } from "@/components/ui/popover";
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/components/ui/select";
+import { Skeleton } from "@/components/ui/skeleton";
+import { useKnowledgePanel } from "@/hooks/use-knowledge-panel";
+import {
+  type DocumentShare,
+  getDocument,
+  getDocumentShare,
+  getDocumentVersion,
+  listDocumentVersions,
+  restoreDocumentVersion,
+  shareDocument,
+  spaceOfPath,
+  unshareDocument,
+} from "@/lib/documents-client";
+
+/** A compact Space badge — "Private" (personal) or "Shared" (team). */
+function SpaceBadge({ path }: { path: string }) {
+  const personal = spaceOfPath(path) === "personal";
+  return (
+    <span
+      className={
+        personal
+          ? "inline-flex shrink-0 items-center gap-1 rounded-full bg-amber-500/10 px-2 py-0.5 font-medium text-[11px] text-amber-600 dark:text-amber-500"
+          : "inline-flex shrink-0 items-center gap-1 rounded-full bg-muted px-2 py-0.5 font-medium text-[11px] text-muted-foreground"
+      }
+    >
+      {personal ? <LockIcon className="size-3" /> : <UsersIcon className="size-3" />}
+      {personal ? "Private" : "Shared"}
+    </span>
+  );
+}
+
+function formatStamp(iso: string): string {
+  const d = new Date(iso);
+  if (Number.isNaN(d.getTime())) return "";
+  return d.toLocaleString(undefined, {
+    month: "short",
+    day: "numeric",
+    hour: "numeric",
+    minute: "2-digit",
+  });
+}
+
+/**
+ * Share a knowledge document via a public link (foreman-jz14). Mints/revokes a
+ * capability token through /documents/share; the link opens the logged-out
+ * /doc/<token> page. Lazy-loads the current share state when the popover opens.
+ */
+function DocumentShareButton({ path }: { path: string }) {
+  const [open, setOpen] = useState(false);
+  // undefined = not loaded yet, null = not shared, object = shared.
+  const [share, setShare] = useState<DocumentShare | null | undefined>(undefined);
+  const [busy, setBusy] = useState(false);
+  const [copied, setCopied] = useState(false);
+
+  // Forget cached state when the document changes.
+  useEffect(() => {
+    setShare(undefined);
+    setCopied(false);
+  }, [path]);
+
+  // Load share state the first time the popover opens for this document.
+  useEffect(() => {
+    if (open && share === undefined) {
+      getDocumentShare(path)
+        .then(setShare)
+        .catch(() => setShare(null));
+    }
+  }, [open, share, path]);
+
+  const url =
+    share && typeof window !== "undefined" ? `${window.location.origin}/doc/${share.token}` : null;
+
+  async function createLink() {
+    setBusy(true);
+    try {
+      setShare(await shareDocument(path));
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  async function stopSharing() {
+    if (!share) return;
+    setBusy(true);
+    try {
+      await unshareDocument(share.token);
+      setShare(null);
+      setCopied(false);
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  async function copy() {
+    if (!url) return;
+    try {
+      await navigator.clipboard.writeText(url);
+      setCopied(true);
+      setTimeout(() => setCopied(false), 1500);
+    } catch {
+      // Clipboard blocked (insecure context) — link is still visible to copy.
+    }
+  }
+
+  return (
+    <Popover onOpenChange={setOpen} open={open}>
+      <PopoverTrigger asChild>
+        <Button className="size-7" size="icon" type="button" variant="ghost">
+          <Share2Icon className={share ? "size-4 text-primary" : "size-4"} />
+          <span className="sr-only">Share document</span>
+        </Button>
+      </PopoverTrigger>
+      <PopoverContent align="end" className="w-80">
+        <p className="font-medium text-sm">Share document</p>
+        {share === undefined ? (
+          <p className="mt-2 text-muted-foreground text-sm">Loading…</p>
+        ) : share ? (
+          <div className="mt-3 space-y-3">
+            <p className="text-muted-foreground text-xs">Anyone with this link can view it.</p>
+            <div className="flex items-center gap-1.5">
+              <input
+                className="min-w-0 flex-1 rounded-md border bg-muted/40 px-2 py-1.5 text-xs"
+                onFocus={(e) => e.currentTarget.select()}
+                readOnly
+                value={url ?? ""}
+              />
+              <Button className="h-8 shrink-0 gap-1" onClick={copy} size="sm" variant="outline">
+                {copied ? <CheckIcon className="size-3.5" /> : <CopyIcon className="size-3.5" />}
+                {copied ? "Copied" : "Copy"}
+              </Button>
+            </div>
+            <button
+              className="inline-flex items-center gap-1.5 text-destructive text-xs hover:underline disabled:opacity-50"
+              disabled={busy}
+              onClick={stopSharing}
+              type="button"
+            >
+              <Link2OffIcon className="size-3.5" />
+              Stop sharing
+            </button>
+          </div>
+        ) : (
+          <div className="mt-3 space-y-3">
+            <p className="text-muted-foreground text-xs">
+              Create a public link anyone can open — no account needed.
+            </p>
+            <Button className="w-full gap-1.5" disabled={busy} onClick={createLink} size="sm">
+              <Share2Icon className="size-3.5" />
+              {busy ? "Creating…" : "Create public link"}
+            </Button>
+          </div>
+        )}
+      </PopoverContent>
+    </Popover>
+  );
+}
+
+/**
+ * The knowledge-document side panel (foreman-aqjx). Renders a workspace document
+ * (markdown) using the AI Elements Artifact primitives + the same markdown
+ * renderer as chat — shown in the live-preview side panel slot so it reads "just
+ * like the web preview". Docked in the resizable chat split (shell.tsx).
+ *
+ * Version history (foreman-udji): a dropdown lists every revision (from the
+ * Mastra BlobStore-backed version manifest). Picking an older revision shows its
+ * content read-only with a Restore action; the live document is always the
+ * default selection.
+ */
+export function KnowledgePanel() {
+  const { path, title, isOpen, close } = useKnowledgePanel();
+  const { mutate } = useSWRConfig();
+  // null = view the live/current document.
+  const [viewVersion, setViewVersion] = useState<number | null>(null);
+  const [restoring, setRestoring] = useState(false);
+
+  // Reset to the live view whenever a different document is opened.
+  useEffect(() => {
+    setViewVersion(null);
+  }, [path]);
+
+  const { data: history } = useSWR(isOpen && path ? ["doc-versions", path] : null, () =>
+    listDocumentVersions(path),
+  );
+  const current = history?.current ?? null;
+  const isHistorical = viewVersion !== null && current !== null && viewVersion !== current;
+
+  const { data, isLoading, error } = useSWR(
+    isOpen && path ? ["document", path, isHistorical ? viewVersion : "current"] : null,
+    () => (isHistorical ? getDocumentVersion(path, viewVersion as number) : getDocument(path)),
+  );
+
+  if (!isOpen || !path) {
+    return null;
+  }
+
+  const hasHistory = (history?.versions.length ?? 0) > 0;
+  const selectValue = isHistorical ? String(viewVersion) : "current";
+
+  async function handleRestore() {
+    if (viewVersion === null) return;
+    setRestoring(true);
+    try {
+      await restoreDocumentVersion(path, viewVersion);
+      setViewVersion(null);
+      // Refresh the version list + every cached view of this document.
+      await mutate(["doc-versions", path]);
+      await mutate(
+        (key) => Array.isArray(key) && key[0] === "document" && key[1] === path,
+        undefined,
+        { revalidate: true },
+      );
+    } finally {
+      setRestoring(false);
+    }
+  }
+
+  return (
+    <div className="m-2 flex min-h-0 flex-1 flex-col overflow-hidden md:m-3">
+      <Artifact className="size-full rounded-xl border-foreground/10 bg-card">
+        <ArtifactHeader className="gap-2 border-foreground/10 bg-transparent">
+          <ArtifactTitle className="min-w-0 flex-1 truncate">{title}</ArtifactTitle>
+          <SpaceBadge path={path} />
+          {hasHistory && (
+            <Select
+              onValueChange={(v) => setViewVersion(v === "current" ? null : Number(v))}
+              value={selectValue}
+            >
+              <SelectTrigger className="h-7 w-auto gap-1.5 border-foreground/10 text-xs" size="sm">
+                <HistoryIcon className="size-3.5 text-muted-foreground" />
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent align="end">
+                {history?.versions.map((v) => (
+                  <SelectItem className="text-xs" key={v.version} value={String(v.version)}>
+                    v{v.version}
+                    {v.version === current ? " · current" : ""}
+                    {v.note ? ` · ${v.note}` : ""}
+                    <span className="ml-2 text-muted-foreground">{formatStamp(v.createdAt)}</span>
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+          )}
+          {isHistorical && (
+            <Button
+              className="h-7 gap-1.5 text-xs"
+              disabled={restoring}
+              onClick={handleRestore}
+              size="sm"
+              type="button"
+              variant="outline"
+            >
+              <RotateCcwIcon className="size-3.5" />
+              {restoring ? "Restoring…" : "Restore"}
+            </Button>
+          )}
+          <DocumentShareButton path={path} />
+          <Button className="size-7" onClick={close} size="icon" type="button" variant="ghost">
+            <XIcon className="size-4" />
+            <span className="sr-only">Close document</span>
+          </Button>
+        </ArtifactHeader>
+        <ArtifactContent>
+          {isHistorical && (
+            <p className="mb-3 rounded-md bg-muted/60 px-3 py-1.5 text-muted-foreground text-xs">
+              Viewing version {viewVersion} (read-only). Restore to make it the live document.
+            </p>
+          )}
+          {isLoading && (
+            <div className="flex flex-col gap-2 px-1 py-2">
+              <Skeleton className="h-4 w-2/3" />
+              <Skeleton className="h-4 w-full" />
+              <Skeleton className="h-4 w-full" />
+              <Skeleton className="h-4 w-4/5" />
+            </div>
+          )}
+          {error && <p className="text-destructive text-sm">Couldn&apos;t load this document.</p>}
+          {data && <MessageResponse>{data.content}</MessageResponse>}
+        </ArtifactContent>
+      </Artifact>
+    </div>
+  );
+}
+
+/**
+ * Inline chat chip for a finished save_document tool call (mirrors
+ * PreviewInlineChip). Auto-opens the panel once when it mounts, and stays
+ * clickable to re-open it. Rendered in message.tsx.
+ */
+export function DocumentInlineChip({ path, title }: { path: string; title: string }) {
+  const { open } = useKnowledgePanel();
+  const autoOpened = useRef(false);
+
+  useEffect(() => {
+    if (autoOpened.current) {
+      return;
+    }
+    autoOpened.current = true;
+    open({ path, title });
+  }, [path, title, open]);
+
+  const personal = spaceOfPath(path) === "personal";
+
+  return (
+    <button
+      className="inline-flex items-center gap-2 rounded-lg bg-card px-3 py-2 text-left text-sm shadow-[0_1px_2px_rgba(0,0,0,0.04),0_6px_16px_rgba(0,0,0,0.06)] ring-1 ring-foreground/[0.06] transition-[background-color,transform] duration-150 hover:bg-accent active:scale-[0.96]"
+      onClick={() => open({ path, title })}
+      type="button"
+    >
+      {personal ? (
+        <LockIcon className="size-4 shrink-0 text-amber-600 dark:text-amber-500" />
+      ) : (
+        <FileTextIcon className="size-4 shrink-0 text-muted-foreground" />
+      )}
+      <span className="font-medium text-foreground">{title}</span>
+      <span className="text-muted-foreground">· {personal ? "private note" : "open document"}</span>
+    </button>
+  );
+}
diff --git a/packages/web/src/components/chat/message.tsx b/packages/web/src/components/chat/message.tsx
index b15358ad..e47c6046 100644
--- a/packages/web/src/components/chat/message.tsx
+++ b/packages/web/src/components/chat/message.tsx
@@ -1,25 +1,69 @@
 "use client";
 import type { UseChatHelpers } from "@ai-sdk/react";
-import { Bot, User } from "lucide-react";
+import { Bot, Check, User } from "lucide-react";
 import { useEffect } from "react";
+import { initialsFrom, seedToGradient } from "@/lib/avatar";
 import type { Vote } from "@/lib/db/schema";
 import type { ChatMessage } from "@/lib/types";
 import { cn, sanitizeText } from "@/lib/utils";
 import { MessageContent, MessageResponse } from "../ai-elements/message";
 import { Tool, ToolContent, ToolHeader, ToolInput, ToolOutput } from "../ai-elements/tool";
+import { DashboardRenderer } from "../dashboard/dashboard-renderer";
+import { Alert, AlertDescription } from "../ui/alert";
+import { Avatar, AvatarFallback, AvatarImage } from "../ui/avatar";
+import { Button } from "../ui/button";
+import { Progress } from "../ui/progress";
 import { useDataStream } from "./data-stream-provider";
 import { DocumentToolResult } from "./document";
 import { DocumentPreview } from "./document-preview";
+import { DocumentInlineChip } from "./knowledge-panel";
 import { MessageActions } from "./message-actions";
 import { MessageReasoning } from "./message-reasoning";
 import { PreviewAttachment } from "./preview-attachment";
+import { PreviewInlineChip } from "./preview-panel";
 import { Weather } from "./weather";
 
-const MessageAvatar = ({ isUser }: { isUser: boolean }) => (
-  <div className="flex size-7 shrink-0 items-center justify-center rounded-full bg-secondary text-muted-foreground">
-    {isUser ? <User className="size-4" /> : <Bot className="size-4" />}
-  </div>
-);
+// Live preview build advances through these stages (preview-app.ts). Map each
+// to a cumulative % so the streamed feed can show one real progress bar
+// (foreman-97mv). `fix` is an in-place retry during the build phase.
+const PREVIEW_STAGE_PCT: Record<string, number> = { design: 25, build: 60, fix: 75, ready: 100 };
+
+const MessageAvatar = ({
+  isUser,
+  userImage,
+  userEmail,
+}: {
+  isUser: boolean;
+  userImage?: string | null;
+  userEmail?: string;
+}) => {
+  // Assistant: Foreman's bot mark. User: real avatar image when available,
+  // otherwise initials on an email-seeded gradient (foreman-3f1v).
+  if (!isUser) {
+    return (
+      <Avatar className="size-7 shrink-0">
+        <AvatarFallback className="bg-secondary text-muted-foreground">
+          <Bot className="size-4" />
+        </AvatarFallback>
+      </Avatar>
+    );
+  }
+  const email = userEmail ?? "";
+  return (
+    <Avatar className="size-7 shrink-0">
+      {userImage ? <AvatarImage alt="" src={userImage} /> : null}
+      <AvatarFallback
+        className={cn(
+          "text-[11px] font-medium",
+          email ? "text-white" : "bg-secondary text-muted-foreground",
+        )}
+        style={email ? { background: seedToGradient(email) } : undefined}
+      >
+        {email ? initialsFrom(email) : <User className="size-4" />}
+      </AvatarFallback>
+    </Avatar>
+  );
+};
 
 function getAlwaysAllowedTools(): Set<string> {
   try {
@@ -51,8 +95,7 @@ const ApprovalButtons = ({
     <span className="flex-1 text-[12px] text-muted-foreground">
       This action needs your approval before it runs.
     </span>
-    <button
-      className="rounded-md px-3 py-1 text-[13px] text-destructive transition-colors hover:bg-destructive/10"
+    <Button
       onClick={() => {
         addToolApprovalResponse({
           id: approvalId,
@@ -60,29 +103,33 @@ const ApprovalButtons = ({
           reason: "User denied this action",
         });
       }}
+      size="sm"
       type="button"
+      variant="destructive"
     >
       Decline
-    </button>
-    <button
-      className="rounded-md px-3 py-1 text-[13px] text-muted-foreground transition-colors hover:bg-muted"
+    </Button>
+    <Button
       onClick={() => {
         addAlwaysAllowedTool(toolName);
         addToolApprovalResponse({ id: approvalId, approved: true });
       }}
+      size="sm"
       type="button"
+      variant="ghost"
     >
       Always Allow
-    </button>
-    <button
-      className="rounded-md bg-primary px-3 py-1 text-[13px] text-primary-foreground transition-colors hover:bg-primary/80"
+    </Button>
+    <Button
       onClick={() => {
         addToolApprovalResponse({ id: approvalId, approved: true });
       }}
+      size="sm"
       type="button"
+      variant="default"
     >
       Approve
-    </button>
+    </Button>
   </div>
 );
 
@@ -158,6 +205,8 @@ const PurePreviewMessage = ({
   isReadonly,
   requiresScrollPadding: _requiresScrollPadding,
   onEdit,
+  userImage,
+  userEmail,
 }: {
   addToolApprovalResponse: UseChatHelpers<ChatMessage>["addToolApprovalResponse"];
   chatId: string;
@@ -169,6 +218,8 @@ const PurePreviewMessage = ({
   isReadonly: boolean;
   requiresScrollPadding: boolean;
   onEdit?: (message: ChatMessage) => void;
+  userImage?: string | null;
+  userEmail?: string;
 }) => {
   const attachmentsFromMessage = message.parts.filter((part) => part.type === "file");
 
@@ -214,6 +265,11 @@ const PurePreviewMessage = ({
     { text: "", isStreaming: false, rendered: false },
   ) ?? { text: "", isStreaming: false, rendered: false };
 
+  // Index of the newest preview-build step so only it carries the progress bar
+  // (earlier steps stay as plain ✓ lines rather than stacking bars).
+  const lastPreviewProgressIdx =
+    message.parts?.reduce((acc, p, i) => (p.type === "data-preview-progress" ? i : acc), -1) ?? -1;
+
   const parts = message.parts?.map((part: any, index: number) => {
     const { type } = part;
     const key = `message-${message.id}-part-${index}`;
@@ -237,10 +293,10 @@ const PurePreviewMessage = ({
       return (
         <MessageContent
           className={cn(
-            "text-[15px] leading-[1.5] text-foreground",
+            "text-[15px] leading-[1.5]",
             isUserMsg
-              ? "w-fit max-w-[min(85%,60ch)] overflow-hidden break-words rounded-lg bg-secondary px-4 py-2.5"
-              : "w-full max-w-full overflow-hidden break-words",
+              ? "w-fit max-w-[min(85%,60ch)] overflow-hidden break-words rounded-lg bg-primary px-4 py-2.5 text-primary-foreground"
+              : "w-full max-w-full overflow-hidden break-words text-foreground",
           )}
           data-testid="message-content"
           key={key}
@@ -250,6 +306,131 @@ const PurePreviewMessage = ({
       );
     }
 
+    if (type === "data-preview-progress") {
+      const d = (part.data ?? {}) as { stage?: string; label?: string };
+      const pct = d.stage ? PREVIEW_STAGE_PCT[d.stage] : undefined;
+      const showBar = index === lastPreviewProgressIdx && pct !== undefined;
+      return (
+        <div className="flex w-[min(100%,360px)] flex-col gap-1.5" key={key}>
+          <div className="flex items-center gap-2 text-muted-foreground text-sm">
+            <span className="flex size-4 shrink-0 items-center justify-center rounded-full bg-emerald-500/15 text-emerald-600">
+              <Check className="size-3" />
+            </span>
+            <span>{d.label ?? "Working…"}</span>
+          </div>
+          {showBar && <Progress className="h-1.5" value={pct} />}
+        </div>
+      );
+    }
+
+    if (type === "tool-create_dashboard") {
+      const { toolCallId, state } = part;
+
+      if (state === "output-available" && part.output && !("error" in part.output)) {
+        const out = part.output as {
+          title: string;
+          url: string;
+          rowCount: number;
+          spec: Parameters<typeof DashboardRenderer>[0]["spec"];
+          records: Parameters<typeof DashboardRenderer>[0]["data"];
+        };
+        return (
+          <div className="w-full max-w-full" key={toolCallId}>
+            <div className="mb-2 flex items-center justify-between gap-3">
+              <span className="text-sm font-medium text-foreground">{out.title}</span>
+              <a
+                className="shrink-0 text-xs font-medium hover:underline"
+                href={out.url}
+                rel="noreferrer"
+                style={{ color: "#FF4F00" }}
+                target="_blank"
+              >
+                Open full →
+              </a>
+            </div>
+            <DashboardRenderer data={out.records} spec={out.spec} />
+          </div>
+        );
+      }
+
+      if (state === "output-error" || (part.output && "error" in part.output)) {
+        return (
+          <Alert key={toolCallId} variant="destructive">
+            <AlertDescription>
+              Couldn't build app:{" "}
+              {String(
+                part.errorText ?? (part.output as { error?: unknown })?.error ?? "unknown error",
+              )}
+            </AlertDescription>
+          </Alert>
+        );
+      }
+
+      return (
+        <div className="text-muted-foreground text-sm" key={toolCallId}>
+          Building app…
+        </div>
+      );
+    }
+
+    if (type === "tool-save_document") {
+      const { toolCallId, state } = part;
+
+      if (state === "output-available" && part.output && !("error" in part.output)) {
+        const out = part.output as { path: string; title?: string };
+        return (
+          <div className="w-full max-w-full" key={toolCallId}>
+            <DocumentInlineChip path={out.path} title={out.title ?? "Document"} />
+          </div>
+        );
+      }
+    }
+
+    if (type === "tool-preview_app") {
+      const { toolCallId, state } = part;
+
+      if (state === "output-available" && part.output && !("error" in part.output)) {
+        const out = part.output as {
+          url: string;
+          title?: string;
+          source?: string;
+          log?: string;
+          ok?: boolean;
+        };
+        // Render in the side panel (auto-opened by the chip); the chat keeps a
+        // compact re-open chip instead of an inline iframe.
+        return (
+          <div className="w-full max-w-full" key={toolCallId}>
+            <PreviewInlineChip
+              log={out.log}
+              source={out.source}
+              title={out.title ?? "Preview"}
+              url={out.url}
+            />
+          </div>
+        );
+      }
+
+      if (state === "output-error" || (part.output && "error" in part.output)) {
+        return (
+          <Alert key={toolCallId} variant="destructive">
+            <AlertDescription>
+              Couldn't build the live preview:{" "}
+              {String(
+                part.errorText ?? (part.output as { error?: unknown })?.error ?? "unknown error",
+              )}
+            </AlertDescription>
+          </Alert>
+        );
+      }
+
+      return (
+        <div className="text-muted-foreground text-sm" key={toolCallId}>
+          Building live preview…
+        </div>
+      );
+    }
+
     if (type === "tool-getWeather") {
       const { toolCallId, state } = part;
       const approvalId = (part as { approval?: { id: string } }).approval?.id;
@@ -321,12 +502,11 @@ const PurePreviewMessage = ({
 
       if (part.output && "error" in part.output) {
         return (
-          <div
-            className="rounded-lg border border-red-200 bg-red-50 p-4 text-red-500 dark:bg-red-950/50"
-            key={toolCallId}
-          >
-            Error creating document: {String(part.output.error)}
-          </div>
+          <Alert key={toolCallId} variant="destructive">
+            <AlertDescription>
+              Error creating document: {String(part.output.error)}
+            </AlertDescription>
+          </Alert>
         );
       }
 
@@ -338,12 +518,11 @@ const PurePreviewMessage = ({
 
       if (part.output && "error" in part.output) {
         return (
-          <div
-            className="rounded-lg border border-red-200 bg-red-50 p-4 text-red-500 dark:bg-red-950/50"
-            key={toolCallId}
-          >
-            Error updating document: {String(part.output.error)}
-          </div>
+          <Alert key={toolCallId} variant="destructive">
+            <AlertDescription>
+              Error updating document: {String(part.output.error)}
+            </AlertDescription>
+          </Alert>
         );
       }
 
@@ -446,7 +625,7 @@ const PurePreviewMessage = ({
       data-testid={`message-${message.role}`}
     >
       <div className={cn("flex items-start gap-2.5", isUser && "flex-row-reverse")}>
-        <MessageAvatar isUser={isUser} />
+        <MessageAvatar isUser={isUser} userEmail={userEmail} userImage={userImage} />
         <div
           className={cn(
             "flex min-w-0 flex-1 flex-col gap-1.5",
diff --git a/packages/web/src/components/chat/messages.tsx b/packages/web/src/components/chat/messages.tsx
index 12f63e36..0561c2b3 100644
--- a/packages/web/src/components/chat/messages.tsx
+++ b/packages/web/src/components/chat/messages.tsx
@@ -1,4 +1,5 @@
 import type { UseChatHelpers } from "@ai-sdk/react";
+import { useSessionUser } from "@/hooks/use-session-user";
 import type { Vote } from "@/lib/db/schema";
 import type { ChatMessage } from "@/lib/types";
 import {
@@ -40,6 +41,7 @@ function PureMessages({
   onEditMessage,
 }: MessagesProps) {
   useDataStream();
+  const sessionUser = useSessionUser();
 
   return (
     // key={chatId} resets the stick-to-bottom scroll state when switching chats.
@@ -63,6 +65,8 @@ function PureMessages({
             regenerate={regenerate}
             requiresScrollPadding={false}
             setMessages={setMessages}
+            userEmail={sessionUser?.email}
+            userImage={sessionUser?.image}
             vote={votes ? votes.find((vote) => vote.messageId === message.id) : undefined}
           />
         ))}
diff --git a/packages/web/src/components/chat/multimodal-input.tsx b/packages/web/src/components/chat/multimodal-input.tsx
index a5f0d763..2c9bd898 100644
--- a/packages/web/src/components/chat/multimodal-input.tsx
+++ b/packages/web/src/components/chat/multimodal-input.tsx
@@ -17,6 +17,7 @@ import {
 } from "react";
 import { toast } from "sonner";
 import { useLocalStorage, useWindowSize } from "usehooks-ts";
+import { getContextWindow } from "@/lib/ai/models";
 import type { Attachment, ChatMessage } from "@/lib/types";
 import { cn } from "@/lib/utils";
 import {
@@ -26,6 +27,8 @@ import {
   PromptInputTextarea,
   PromptInputTools,
 } from "../ai-elements/prompt-input";
+import { Button } from "../ui/button";
+import { ContextUsage, type TokenUsage } from "./context-usage";
 import { AttachmentsButton } from "./multimodal/attachments-button";
 import { AttachmentsPreview } from "./multimodal/attachments-preview";
 import { useFileUpload } from "./multimodal/file-upload";
@@ -182,21 +185,35 @@ function PureMultimodalInput({
     chatId,
   ]);
 
+  // Most recent assistant turn's token usage (attached server-side as message
+  // metadata); drives the composer's context-usage gauge.
+  const latestUsage: TokenUsage | null = (() => {
+    for (let i = messages.length - 1; i >= 0; i--) {
+      const m = messages[i] as { role?: string; metadata?: { usage?: TokenUsage } };
+      if (m.role === "assistant" && m.metadata?.usage) {
+        return m.metadata.usage;
+      }
+    }
+    return null;
+  })();
+
   return (
     <div className={cn("relative flex w-full flex-col gap-4", className)}>
       {editingMessage && onCancelEdit && (
         <div className="flex items-center gap-2 text-[12px] text-muted-foreground">
           <span>Editing message</span>
-          <button
-            className="rounded px-1.5 py-0.5 text-muted-foreground/50 transition-colors hover:bg-muted hover:text-foreground"
+          <Button
+            className="text-[12px] text-muted-foreground/50 hover:text-foreground"
             onMouseDown={(e) => {
               e.preventDefault();
               onCancelEdit();
             }}
+            size="sm"
             type="button"
+            variant="ghost"
           >
             Cancel
-          </button>
+          </Button>
         </div>
       )}
 
@@ -233,7 +250,7 @@ function PureMultimodalInput({
       </div>
 
       <PromptInput
-        className="[&>div]:rounded-2xl [&>div]:border [&>div]:border-border/30 [&>div]:bg-card/70 [&>div]:shadow-[var(--shadow-composer)] [&>div]:transition-shadow [&>div]:duration-300 [&>div]:focus-within:shadow-[var(--shadow-composer-focus)]"
+        className="[&>div]:rounded-3xl [&>div]:border [&>div]:border-border/60 [&>div]:bg-card/80 [&>div]:shadow-[var(--shadow-composer)] [&>div]:transition-shadow [&>div]:duration-300 [&>div]:focus-within:border-border [&>div]:focus-within:shadow-[var(--shadow-composer-focus)]"
         onSubmit={() => {
           if (input.startsWith("/")) {
             const query = input.slice(1).trim();
@@ -312,6 +329,7 @@ function PureMultimodalInput({
               onTranscript={(text) => setInput((prev) => (prev ? `${prev} ${text}` : text))}
             />
             <ModelSelectorCompact onModelChange={onModelChange} selectedModelId={selectedModelId} />
+            <ContextUsage maxTokens={getContextWindow(selectedModelId)} usage={latestUsage} />
           </PromptInputTools>
 
           {status === "submitted" ? (
@@ -320,12 +338,12 @@ function PureMultimodalInput({
             <PromptInputSubmit
               className={cn(
                 "h-7 w-7 rounded-xl transition-all duration-200",
-                input.trim()
-                  ? "bg-foreground text-background hover:opacity-85 active:scale-95"
+                input.trim() || attachments.length > 0
+                  ? "bg-primary text-primary-foreground hover:opacity-85 active:scale-95"
                   : "bg-muted text-muted-foreground/25 cursor-not-allowed",
               )}
               data-testid="send-button"
-              disabled={!input.trim() || uploadQueue.length > 0}
+              disabled={(!input.trim() && attachments.length === 0) || uploadQueue.length > 0}
               status={status}
               variant="secondary"
             >
diff --git a/packages/web/src/components/chat/multimodal/attachments-button.tsx b/packages/web/src/components/chat/multimodal/attachments-button.tsx
index 7a4d11ec..04e4eae8 100644
--- a/packages/web/src/components/chat/multimodal/attachments-button.tsx
+++ b/packages/web/src/components/chat/multimodal/attachments-button.tsx
@@ -2,8 +2,7 @@
 
 import type { UseChatHelpers } from "@ai-sdk/react";
 import { memo } from "react";
-import useSWR from "swr";
-import type { ModelCapabilities } from "@/lib/ai/models";
+import { MODEL_CAPABILITIES } from "@/lib/ai/models";
 import type { ChatMessage } from "@/lib/types";
 import { cn } from "@/lib/utils";
 import { Button } from "../../ui/button";
@@ -18,15 +17,9 @@ function PureAttachmentsButton({
   status: UseChatHelpers<ChatMessage>["status"];
   selectedModelId: string;
 }) {
-  const { data: modelsResponse } = useSWR(
-    `${process.env.NEXT_PUBLIC_BASE_PATH ?? ""}/api/models`,
-    (url: string) => fetch(url).then((r) => r.json()),
-    { revalidateOnFocus: false, dedupingInterval: 3_600_000 },
-  );
-
-  const caps: Record<string, ModelCapabilities> | undefined =
-    modelsResponse?.capabilities ?? modelsResponse;
-  const hasVision = caps?.[selectedModelId]?.vision ?? false;
+  // Capabilities are static frontend config (models.ts) — read them directly
+  // instead of fetching a non-existent /api/models endpoint.
+  const hasVision = MODEL_CAPABILITIES[selectedModelId]?.vision ?? false;
 
   return (
     <Button
diff --git a/packages/web/src/components/chat/multimodal/file-upload.ts b/packages/web/src/components/chat/multimodal/file-upload.ts
index 7b7b0be1..1abd2493 100644
--- a/packages/web/src/components/chat/multimodal/file-upload.ts
+++ b/packages/web/src/components/chat/multimodal/file-upload.ts
@@ -10,6 +10,29 @@ import {
 import { toast } from "sonner";
 import type { Attachment } from "@/lib/types";
 
+// Attachments are sent to the model inline as AI SDK v6 `file` parts (data URLs)
+// — no upload endpoint or storage service required (same pattern as storycraft /
+// myrp-build). `submitForm` in multimodal-input.tsx maps these into file parts.
+const MAX_FILE_BYTES = 10 * 1024 * 1024; // 10MB — keeps base64 payloads sane.
+
+function fileToAttachment(file: File): Promise<Attachment | undefined> {
+  return new Promise((resolve) => {
+    if (file.size > MAX_FILE_BYTES) {
+      toast.error(`${file.name} is too large (max 10MB).`);
+      resolve(undefined);
+      return;
+    }
+    const reader = new FileReader();
+    reader.onload = () =>
+      resolve({ url: reader.result as string, name: file.name, contentType: file.type });
+    reader.onerror = () => {
+      toast.error(`Failed to read ${file.name}.`);
+      resolve(undefined);
+    };
+    reader.readAsDataURL(file);
+  });
+}
+
 export function useFileUpload({
   setAttachments,
   setUploadQueue,
@@ -19,57 +42,34 @@ export function useFileUpload({
   setUploadQueue: Dispatch<SetStateAction<string[]>>;
   textareaRef: React.RefObject<HTMLTextAreaElement | null>;
 }) {
-  const uploadFile = useCallback(async (file: File) => {
-    const formData = new FormData();
-    formData.append("file", file);
-
-    try {
-      const response = await fetch(`${process.env.NEXT_PUBLIC_BASE_PATH ?? ""}/api/files/upload`, {
-        method: "POST",
-        body: formData,
-      });
-
-      if (response.ok) {
-        const data = await response.json();
-        const { url, pathname, contentType } = data;
-
-        return {
-          url,
-          name: pathname,
-          contentType,
-        };
+  // Shared path used by the file picker, paste, and (later) drag-and-drop.
+  const addFiles = useCallback(
+    async (files: File[], queueLabels?: string[]) => {
+      if (files.length === 0) {
+        return;
       }
-      const { error } = await response.json();
-      toast.error(error);
-    } catch (_error) {
-      toast.error("Failed to upload file, please try again!");
-    }
-  }, []);
-
-  const handleFileChange = useCallback(
-    async (event: ChangeEvent<HTMLInputElement>) => {
-      const files = Array.from(event.target.files || []);
-
-      setUploadQueue(files.map((file) => file.name));
-
+      setUploadQueue(queueLabels ?? files.map((file) => file.name));
       try {
-        const uploadPromises = files.map((file) => uploadFile(file));
-        const uploadedAttachments = await Promise.all(uploadPromises);
-        const successfullyUploadedAttachments = uploadedAttachments.filter(
-          (attachment) => attachment !== undefined,
-        );
-
-        setAttachments((currentAttachments) => [
-          ...currentAttachments,
-          ...successfullyUploadedAttachments,
-        ]);
-      } catch (_error) {
-        toast.error("Failed to upload files");
+        const converted = await Promise.all(files.map(fileToAttachment));
+        const attachments = converted.filter((a): a is Attachment => a !== undefined);
+        if (attachments.length > 0) {
+          setAttachments((current) => [...current, ...attachments]);
+        }
       } finally {
         setUploadQueue([]);
       }
     },
-    [setAttachments, setUploadQueue, uploadFile],
+    [setAttachments, setUploadQueue],
+  );
+
+  const handleFileChange = useCallback(
+    async (event: ChangeEvent<HTMLInputElement>) => {
+      const files = Array.from(event.target.files || []);
+      await addFiles(files);
+      // Reset so selecting the same file again still fires onChange.
+      event.target.value = "";
+    },
+    [addFiles],
   );
 
   const handlePaste = useCallback(
@@ -78,39 +78,21 @@ export function useFileUpload({
       if (!items) {
         return;
       }
+      const imageFiles = Array.from(items)
+        .filter((item) => item.type.startsWith("image/"))
+        .map((item) => item.getAsFile())
+        .filter((file): file is File => file !== null);
 
-      const imageItems = Array.from(items).filter((item) => item.type.startsWith("image/"));
-
-      if (imageItems.length === 0) {
+      if (imageFiles.length === 0) {
         return;
       }
-
       event.preventDefault();
-
-      setUploadQueue((prev) => [...prev, "Pasted image"]);
-
-      try {
-        const uploadPromises = imageItems
-          .map((item) => item.getAsFile())
-          .filter((file): file is File => file !== null)
-          .map((file) => uploadFile(file));
-
-        const uploadedAttachments = await Promise.all(uploadPromises);
-        const successfullyUploadedAttachments = uploadedAttachments.filter(
-          (attachment) =>
-            attachment !== undefined &&
-            attachment.url !== undefined &&
-            attachment.contentType !== undefined,
-        );
-
-        setAttachments((curr) => [...curr, ...(successfullyUploadedAttachments as Attachment[])]);
-      } catch (_error) {
-        toast.error("Failed to upload pasted image(s)");
-      } finally {
-        setUploadQueue([]);
-      }
+      await addFiles(
+        imageFiles,
+        imageFiles.map(() => "Pasted image"),
+      );
     },
-    [setAttachments, setUploadQueue, uploadFile],
+    [addFiles],
   );
 
   useEffect(() => {
@@ -118,10 +100,9 @@ export function useFileUpload({
     if (!textarea) {
       return;
     }
-
     textarea.addEventListener("paste", handlePaste);
     return () => textarea.removeEventListener("paste", handlePaste);
   }, [handlePaste, textareaRef]);
 
-  return { uploadFile, handleFileChange };
+  return { addFiles, handleFileChange };
 }
diff --git a/packages/web/src/components/chat/multimodal/mic-button.tsx b/packages/web/src/components/chat/multimodal/mic-button.tsx
index 5bdde4b8..5b18700c 100644
--- a/packages/web/src/components/chat/multimodal/mic-button.tsx
+++ b/packages/web/src/components/chat/multimodal/mic-button.tsx
@@ -5,6 +5,7 @@ import { useCallback, useEffect, useRef, useState } from "react";
 import { toast } from "sonner";
 import { cn } from "@/lib/utils";
 import { Button } from "../../ui/button";
+import { Tooltip, TooltipContent, TooltipTrigger } from "../../ui/tooltip";
 
 interface MicButtonProps {
   onTranscript: (text: string) => void;
@@ -23,9 +24,14 @@ function getSR(): (new () => AnyRecognition) | undefined {
 
 export function MicButton({ onTranscript, disabled }: MicButtonProps) {
   const [isRecording, setIsRecording] = useState(false);
+  // Feature detection depends on `window`, which differs between SSR and the
+  // client. Gate on a post-mount flag so the server and the first client render
+  // agree (both render nothing) — otherwise the toolbar's button order mismatches
+  // and React throws a hydration error.
+  const [mounted, setMounted] = useState(false);
   const recognitionRef = useRef<AnyRecognition>(null);
 
-  const isSupported = !!getSR();
+  const isSupported = mounted && !!getSR();
 
   const stop = useCallback(() => {
     recognitionRef.current?.stop();
@@ -66,6 +72,7 @@ export function MicButton({ onTranscript, disabled }: MicButtonProps) {
   }, [onTranscript]);
 
   useEffect(() => {
+    setMounted(true);
     return () => {
       recognitionRef.current?.stop();
     };
@@ -74,24 +81,28 @@ export function MicButton({ onTranscript, disabled }: MicButtonProps) {
   if (!isSupported) return null;
 
   return (
-    <Button
-      className={cn(
-        "h-7 w-7 rounded-lg border border-border/40 p-1 transition-colors",
-        isRecording
-          ? "border-red-500/40 bg-red-500/10 text-red-500 animate-pulse hover:bg-red-500/20"
-          : "text-muted-foreground/50 hover:border-border hover:text-foreground",
-      )}
-      disabled={disabled}
-      onClick={isRecording ? stop : start}
-      title={isRecording ? "Stop recording" : "Voice input"}
-      type="button"
-      variant="ghost"
-    >
-      {isRecording ? (
-        <MicOffIcon style={{ width: 14, height: 14 }} />
-      ) : (
-        <MicIcon style={{ width: 14, height: 14 }} />
-      )}
-    </Button>
+    <Tooltip>
+      <TooltipTrigger asChild>
+        <Button
+          className={cn(
+            "h-7 w-7 rounded-lg border border-border/40 p-1 transition-colors",
+            isRecording
+              ? "border-red-500/40 bg-red-500/10 text-red-500 animate-pulse hover:bg-red-500/20"
+              : "text-muted-foreground/50 hover:border-border hover:text-foreground",
+          )}
+          disabled={disabled}
+          onClick={isRecording ? stop : start}
+          type="button"
+          variant="ghost"
+        >
+          {isRecording ? (
+            <MicOffIcon style={{ width: 14, height: 14 }} />
+          ) : (
+            <MicIcon style={{ width: 14, height: 14 }} />
+          )}
+        </Button>
+      </TooltipTrigger>
+      <TooltipContent>{isRecording ? "Stop recording" : "Voice input"}</TooltipContent>
+    </Tooltip>
   );
 }
diff --git a/packages/web/src/components/chat/multimodal/model-selector-compact.tsx b/packages/web/src/components/chat/multimodal/model-selector-compact.tsx
index 14c85a1c..075629b0 100644
--- a/packages/web/src/components/chat/multimodal/model-selector-compact.tsx
+++ b/packages/web/src/components/chat/multimodal/model-selector-compact.tsx
@@ -2,7 +2,6 @@
 
 import { BrainIcon, EyeIcon, LockIcon, WrenchIcon } from "lucide-react";
 import { memo, useState } from "react";
-import useSWR from "swr";
 import {
   ModelSelector,
   ModelSelectorContent,
@@ -18,7 +17,7 @@ import {
   type ChatModel,
   chatModels,
   DEFAULT_CHAT_MODEL,
-  type ModelCapabilities,
+  MODEL_CAPABILITIES,
 } from "@/lib/ai/models";
 import { cn } from "@/lib/utils";
 import { Button } from "../../ui/button";
@@ -37,22 +36,19 @@ function PureModelSelectorCompact({
   onModelChange?: (modelId: string) => void;
 }) {
   const [open, setOpen] = useState(false);
-  const { data: modelsData } = useSWR(
-    `${process.env.NEXT_PUBLIC_BASE_PATH ?? ""}/api/models`,
-    (url: string) => fetch(url).then((r) => r.json()),
-    { revalidateOnFocus: false, dedupingInterval: 3_600_000 },
-  );
 
-  const capabilities: Record<string, ModelCapabilities> | undefined =
-    modelsData?.capabilities ?? modelsData;
-  const dynamicModels: ChatModel[] | undefined = modelsData?.models;
-  const activeModels = dynamicModels ?? chatModels;
+  // Capabilities + model list are static frontend config (models.ts); there is
+  // no /api/models endpoint, so read them directly.
+  const capabilities = MODEL_CAPABILITIES;
+  const activeModels = chatModels;
 
   const selectedModel =
     activeModels.find((m: ChatModel) => m.id === selectedModelId) ??
     activeModels.find((m: ChatModel) => m.id === DEFAULT_CHAT_MODEL) ??
     activeModels[0];
-  const [provider] = selectedModel.id.split("/");
+  // Logo is keyed by the real provider (e.g. "anthropic" → models.dev/logos/anthropic.svg),
+  // NOT the model id ("foreman", which 404s and caused a hydration mismatch).
+  const provider = selectedModel.provider;
 
   return (
     <ModelSelector onOpenChange={setOpen} open={open}>
@@ -66,14 +62,12 @@ function PureModelSelectorCompact({
           <ModelSelectorName>{selectedModel.name}</ModelSelectorName>
         </Button>
       </ModelSelectorTrigger>
-      <ModelSelectorContent>
+      <ModelSelectorContent className="w-[320px] p-1.5">
         <ModelSelectorInput placeholder="Search models..." />
         <ModelSelectorList>
           {(() => {
             const curatedIds = new Set(chatModels.map((m) => m.id));
-            const allModels = dynamicModels
-              ? [...chatModels, ...dynamicModels.filter((m) => !curatedIds.has(m.id))]
-              : chatModels;
+            const allModels = chatModels;
 
             const grouped: Record<string, { model: ChatModel; curated: boolean }[]> = {};
             for (const model of allModels) {
@@ -121,17 +115,19 @@ function PureModelSelectorCompact({
 
             return sortedKeys.map((key) => (
               <ModelSelectorGroup
+                className="[&_[cmdk-group-items]]:flex [&_[cmdk-group-items]]:flex-col [&_[cmdk-group-items]]:gap-1"
                 heading={key === "_available" ? "Available" : (providerNames[key] ?? key)}
                 key={key}
               >
                 {grouped[key].map(({ model, curated }) => {
-                  const logoProvider = model.id.split("/")[0];
+                  const logoProvider = model.provider;
                   return (
                     <ModelSelectorItem
                       className={cn(
-                        "flex w-full",
-                        model.id === selectedModel.id &&
-                          "border-b border-dashed border-foreground/50",
+                        "flex w-full items-center gap-2.5 rounded-lg border border-border/50 px-2.5 py-2",
+                        model.id === selectedModel.id
+                          ? "border-accent/50 bg-accent/60"
+                          : "bg-card/40",
                         !curated && "opacity-40 cursor-default",
                       )}
                       key={model.id}
@@ -150,9 +146,16 @@ function PureModelSelectorCompact({
                       }}
                       value={model.id}
                     >
-                      <ModelSelectorLogo provider={logoProvider} />
-                      <ModelSelectorName>{model.name}</ModelSelectorName>
-                      <div className="ml-auto flex items-center gap-2 text-foreground/70">
+                      <ModelSelectorLogo className="shrink-0" provider={logoProvider} />
+                      <div className="flex min-w-0 flex-col gap-0.5">
+                        <ModelSelectorName className="font-medium">{model.name}</ModelSelectorName>
+                        {model.description && (
+                          <span className="truncate text-[11px] leading-tight text-muted-foreground">
+                            {model.description}
+                          </span>
+                        )}
+                      </div>
+                      <div className="ml-auto flex shrink-0 items-center gap-1.5 text-foreground/60">
                         {capabilities?.[model.id]?.tools && <WrenchIcon className="size-3.5" />}
                         {capabilities?.[model.id]?.vision && <EyeIcon className="size-3.5" />}
                         {capabilities?.[model.id]?.reasoning && <BrainIcon className="size-3.5" />}
diff --git a/packages/web/src/components/chat/preview-panel.tsx b/packages/web/src/components/chat/preview-panel.tsx
new file mode 100644
index 00000000..6aa595bd
--- /dev/null
+++ b/packages/web/src/components/chat/preview-panel.tsx
@@ -0,0 +1,144 @@
+"use client";
+
+import { ExternalLink, PanelRight, XIcon } from "lucide-react";
+import { useEffect, useRef } from "react";
+import { CodeBlock } from "@/components/ai-elements/code-block";
+import {
+  SandboxTabContent,
+  SandboxTabs,
+  SandboxTabsBar,
+  SandboxTabsList,
+  SandboxTabsTrigger,
+} from "@/components/ai-elements/sandbox";
+import {
+  Terminal,
+  TerminalContent,
+  TerminalHeader,
+  TerminalTitle,
+} from "@/components/ai-elements/terminal";
+import {
+  WebPreview,
+  WebPreviewBody,
+  WebPreviewNavigation,
+  WebPreviewNavigationButton,
+  WebPreviewUrl,
+} from "@/components/ai-elements/web-preview";
+import { Button } from "@/components/ui/button";
+import { usePreviewPanel } from "@/hooks/use-preview-panel";
+
+/**
+ * The live-preview side panel (foreman-q4kf / foreman-8nyg). A Sandbox-style
+ * tabbed view of what the agent built: Preview (the live WebPreview iframe),
+ * Code (the generated component source), and Terminal (the real build log,
+ * including the self-heal). Docked in the resizable chat split.
+ */
+export function PreviewPanel() {
+  const { url, title, source, log, isOpen, close } = usePreviewPanel();
+
+  if (!isOpen || !url) {
+    return null;
+  }
+
+  return (
+    <div className="m-2 flex flex-1 flex-col overflow-hidden rounded-xl border border-foreground/10 bg-card shadow-sm">
+      <div className="flex items-center justify-between border-foreground/10 border-b px-3 py-2">
+        <span className="font-medium text-foreground text-sm">{title}</span>
+        <Button className="size-7" onClick={close} size="icon" type="button" variant="ghost">
+          <XIcon className="size-4" />
+          <span className="sr-only">Close preview</span>
+        </Button>
+      </div>
+
+      <SandboxTabs className="flex min-h-0 flex-1 flex-col gap-0" defaultValue="preview">
+        <SandboxTabsBar className="border-foreground/10">
+          <SandboxTabsList>
+            <SandboxTabsTrigger value="preview">Preview</SandboxTabsTrigger>
+            <SandboxTabsTrigger value="code">Code</SandboxTabsTrigger>
+            <SandboxTabsTrigger value="terminal">Terminal</SandboxTabsTrigger>
+          </SandboxTabsList>
+        </SandboxTabsBar>
+
+        <SandboxTabContent className="min-h-0 flex-1" value="preview">
+          <WebPreview className="size-full rounded-none border-0" defaultUrl={url}>
+            <WebPreviewNavigation className="border-b-foreground/10">
+              <WebPreviewUrl readOnly value={url} />
+              <WebPreviewNavigationButton
+                onClick={() => window.open(url, "_blank", "noopener,noreferrer")}
+                tooltip="Open in new tab"
+              >
+                <ExternalLink className="h-4 w-4" />
+              </WebPreviewNavigationButton>
+            </WebPreviewNavigation>
+            <WebPreviewBody src={url} title={title} />
+          </WebPreview>
+        </SandboxTabContent>
+
+        <SandboxTabContent className="min-h-0 flex-1 overflow-auto" value="code">
+          {source ? (
+            <CodeBlock
+              className="rounded-none border-0"
+              code={source}
+              language="tsx"
+              showLineNumbers
+            />
+          ) : (
+            <div className="p-4 text-muted-foreground text-sm">No source available.</div>
+          )}
+        </SandboxTabContent>
+
+        <SandboxTabContent className="min-h-0 flex-1" value="terminal">
+          {log ? (
+            <Terminal className="size-full rounded-none border-0" output={log}>
+              <TerminalHeader>
+                <TerminalTitle />
+              </TerminalHeader>
+              <TerminalContent className="max-h-none min-h-0 flex-1" />
+            </Terminal>
+          ) : (
+            <div className="p-4 text-muted-foreground text-sm">No build log.</div>
+          )}
+        </SandboxTabContent>
+      </SandboxTabs>
+    </div>
+  );
+}
+
+/**
+ * Inline chat chip for a finished preview_app tool call. Auto-opens the side
+ * panel once when it first mounts (the live result), and stays clickable to
+ * re-open it after the user closes the panel. Rendered in message.tsx.
+ */
+export function PreviewInlineChip({
+  url,
+  title,
+  source,
+  log,
+}: {
+  url: string;
+  title: string;
+  source?: string;
+  log?: string;
+}) {
+  const { open } = usePreviewPanel();
+  const autoOpened = useRef(false);
+
+  useEffect(() => {
+    if (autoOpened.current) {
+      return;
+    }
+    autoOpened.current = true;
+    open({ url, title, source, log });
+  }, [url, title, source, log, open]);
+
+  return (
+    <button
+      className="inline-flex items-center gap-2 rounded-lg bg-card px-3 py-2 text-left text-sm shadow-[0_1px_2px_rgba(0,0,0,0.04),0_6px_16px_rgba(0,0,0,0.06)] ring-1 ring-foreground/[0.06] transition-[background-color,transform] duration-150 hover:bg-accent active:scale-[0.96]"
+      onClick={() => open({ url, title, source, log })}
+      type="button"
+    >
+      <PanelRight className="size-4 shrink-0 text-muted-foreground" />
+      <span className="font-medium text-foreground">{title}</span>
+      <span className="text-muted-foreground">· open preview</span>
+    </button>
+  );
+}
diff --git a/packages/web/src/components/chat/share-button.tsx b/packages/web/src/components/chat/share-button.tsx
new file mode 100644
index 00000000..eb18d4e8
--- /dev/null
+++ b/packages/web/src/components/chat/share-button.tsx
@@ -0,0 +1,128 @@
+"use client";
+
+import { CheckIcon, CopyIcon, Share2Icon } from "lucide-react";
+import { useState } from "react";
+import { type ChatShareLink, getChatShareLink, shareChat, unshareChat } from "@/app/chat/actions";
+import { Button } from "@/components/ui/button";
+import { Popover, PopoverContent, PopoverTrigger } from "@/components/ui/popover";
+
+/**
+ * Mint / copy / revoke a public (logged-out) share link for a chat (foreman-mk25).
+ * The token is the capability — anyone with the `/c/<token>` URL can read the chat
+ * read-only, no account. Owner-only; rendered in the chat header next to the
+ * Private/Team visibility selector.
+ */
+export function ShareButton({ chatId }: { chatId: string }) {
+  const [open, setOpen] = useState(false);
+  const [loaded, setLoaded] = useState(false);
+  const [link, setLink] = useState<ChatShareLink | null>(null);
+  const [busy, setBusy] = useState(false);
+  const [copied, setCopied] = useState(false);
+
+  const absolute = link ? `${window.location.origin}${link.url}` : null;
+
+  async function onOpenChange(next: boolean) {
+    setOpen(next);
+    if (next && !loaded) {
+      try {
+        setLink(await getChatShareLink(chatId));
+      } catch {
+        // leave link null; the create button still works
+      } finally {
+        setLoaded(true);
+      }
+    }
+  }
+
+  async function create() {
+    setBusy(true);
+    try {
+      const created = await shareChat(chatId);
+      setLink(created);
+      await copy(`${window.location.origin}${created.url}`);
+    } catch {
+      // surface nothing destructive; user can retry
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  async function revoke() {
+    if (!link) return;
+    setBusy(true);
+    try {
+      await unshareChat(link.token);
+      setLink(null);
+      setCopied(false);
+    } catch {
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  async function copy(value: string) {
+    try {
+      await navigator.clipboard.writeText(value);
+      setCopied(true);
+      setTimeout(() => setCopied(false), 1500);
+    } catch {
+      // clipboard blocked (insecure context) — the input still shows the link
+    }
+  }
+
+  return (
+    <Popover onOpenChange={onOpenChange} open={open}>
+      <PopoverTrigger asChild>
+        <Button
+          className="gap-1.5 rounded-lg border-border/50 text-muted-foreground shadow-none hover:text-foreground"
+          size="sm"
+          variant="outline"
+        >
+          <Share2Icon className="size-4" />
+          <span className="md:sr-only">Share</span>
+        </Button>
+      </PopoverTrigger>
+      <PopoverContent align="end" className="w-80 space-y-3">
+        <div>
+          <p className="font-medium text-sm">Public link</p>
+          <p className="text-muted-foreground text-xs">
+            Anyone with the link can view this chat read-only — no account needed.
+          </p>
+        </div>
+
+        {!loaded ? (
+          <p className="text-muted-foreground text-xs">Loading…</p>
+        ) : absolute ? (
+          <div className="space-y-2">
+            <div className="flex items-center gap-1.5">
+              <input
+                aria-label="Public share link"
+                className="min-w-0 flex-1 rounded-md border px-2 py-1 text-muted-foreground text-xs"
+                onFocus={(e) => e.currentTarget.select()}
+                readOnly
+                value={absolute}
+              />
+              <Button onClick={() => copy(absolute)} size="icon-sm" type="button" variant="outline">
+                {copied ? <CheckIcon className="size-4" /> : <CopyIcon className="size-4" />}
+              </Button>
+            </div>
+            <Button
+              className="text-destructive hover:text-destructive"
+              disabled={busy}
+              onClick={revoke}
+              size="sm"
+              type="button"
+              variant="ghost"
+            >
+              Revoke link
+            </Button>
+          </div>
+        ) : (
+          <Button className="w-full" disabled={busy} onClick={create} size="sm" type="button">
+            {busy ? "Creating…" : "Create public link"}
+          </Button>
+        )}
+      </PopoverContent>
+    </Popover>
+  );
+}
diff --git a/packages/web/src/components/chat/shell.tsx b/packages/web/src/components/chat/shell.tsx
index 844da6de..a259abe1 100644
--- a/packages/web/src/components/chat/shell.tsx
+++ b/packages/web/src/components/chat/shell.tsx
@@ -11,16 +11,20 @@ import {
   AlertDialogHeader,
   AlertDialogTitle,
 } from "@/components/ui/alert-dialog";
+import { ResizableHandle, ResizablePanel, ResizablePanelGroup } from "@/components/ui/resizable";
 import { useActiveChat } from "@/hooks/use-active-chat";
 import { initialArtifactData, useArtifact, useArtifactSelector } from "@/hooks/use-artifact";
+import { useKnowledgePanel, useKnowledgePanelSelector } from "@/hooks/use-knowledge-panel";
+import { usePreviewPanel, usePreviewPanelSelector } from "@/hooks/use-preview-panel";
 import type { Attachment, ChatMessage } from "@/lib/types";
-import { cn } from "@/lib/utils";
 import { Artifact } from "./artifact";
 import { ChatHeader } from "./chat-header";
 import { DataStreamHandler } from "./data-stream-handler";
+import { KnowledgePanel } from "./knowledge-panel";
 import { submitEditedMessage } from "./message-editor";
 import { Messages } from "./messages";
 import { MultimodalInput } from "./multimodal-input";
+import { PreviewPanel } from "./preview-panel";
 
 export function ChatShell() {
   const {
@@ -35,7 +39,9 @@ export function ChatShell() {
     input,
     setInput,
     visibilityType,
+    chatTitle,
     isReadonly,
+    isOwner,
     isLoading,
     votes,
     currentModelId,
@@ -48,6 +54,10 @@ export function ChatShell() {
   const [attachments, setAttachments] = useState<Attachment[]>([]);
   const isArtifactVisible = useArtifactSelector((state) => state.isVisible);
   const { setArtifact } = useArtifact();
+  const isPreviewOpen = usePreviewPanelSelector((state) => state.isOpen);
+  const { reset: resetPreviewPanel } = usePreviewPanel();
+  const isKnowledgeOpen = useKnowledgePanelSelector((state) => state.isOpen);
+  const { reset: resetKnowledgePanel } = useKnowledgePanel();
 
   const stopRef = useRef(stop);
   stopRef.current = stop;
@@ -58,90 +68,116 @@ export function ChatShell() {
       prevChatIdRef.current = chatId;
       stopRef.current();
       setArtifact(initialArtifactData);
+      resetPreviewPanel();
+      resetKnowledgePanel();
       setEditingMessage(null);
       setAttachments([]);
     }
-  }, [chatId, setArtifact]);
+  }, [chatId, setArtifact, resetPreviewPanel, resetKnowledgePanel]);
 
   return (
     <>
       <div className="flex h-dvh w-full flex-row overflow-hidden">
-        <div
-          className={cn(
-            "flex min-w-0 flex-col bg-sidebar transition-[width] duration-300 ease-[cubic-bezier(0.32,0.72,0,1)]",
-            isArtifactVisible ? "w-[40%]" : "w-full",
-          )}
-        >
-          <ChatHeader
-            chatId={chatId}
-            isReadonly={isReadonly}
-            selectedVisibilityType={visibilityType}
-          />
-
-          <div className="relative flex min-h-0 flex-1 flex-col overflow-hidden bg-background md:rounded-tl-[12px] md:border-t md:border-l md:border-border/40">
-            <Messages
-              addToolApprovalResponse={addToolApprovalResponse}
-              chatId={chatId}
-              isArtifactVisible={isArtifactVisible}
-              isLoading={isLoading}
-              isReadonly={isReadonly}
-              messages={messages}
-              onEditMessage={(msg) => {
-                const text = msg.parts
-                  ?.filter((p) => p.type === "text")
-                  .map((p) => p.text)
-                  .join("");
-                setInput(text ?? "");
-                setEditingMessage(msg);
-              }}
-              regenerate={regenerate}
-              selectedModelId={currentModelId}
-              setMessages={setMessages}
-              status={status}
-              votes={votes}
-            />
+        <ResizablePanelGroup className="flex-1" orientation="horizontal">
+          <ResizablePanel
+            className="flex min-w-0 flex-col bg-sidebar"
+            defaultSize={50}
+            id="chat-panel"
+            minSize={30}
+          >
+            <div className="m-2 flex min-h-0 flex-1 flex-col overflow-hidden rounded-xl border border-sidebar-border bg-background shadow-sm md:m-3">
+              <ChatHeader
+                chatId={chatId}
+                isOwner={isOwner}
+                selectedVisibilityType={visibilityType}
+                title={chatTitle}
+              />
 
-            <div className="sticky bottom-0 z-1 mx-auto flex w-full max-w-4xl gap-2 border-t-0 bg-background px-2 pb-3 md:px-4 md:pb-4">
-              {!isReadonly && (
-                <MultimodalInput
-                  attachments={attachments}
+              <div className="relative flex min-h-0 flex-1 flex-col overflow-hidden">
+                <Messages
+                  addToolApprovalResponse={addToolApprovalResponse}
                   chatId={chatId}
-                  editingMessage={editingMessage}
-                  input={input}
+                  isArtifactVisible={isArtifactVisible}
                   isLoading={isLoading}
+                  isReadonly={isReadonly}
                   messages={messages}
-                  onCancelEdit={() => {
-                    setEditingMessage(null);
-                    setInput("");
+                  onEditMessage={(msg) => {
+                    const text = msg.parts
+                      ?.filter((p) => p.type === "text")
+                      .map((p) => p.text)
+                      .join("");
+                    setInput(text ?? "");
+                    setEditingMessage(msg);
                   }}
-                  onModelChange={setCurrentModelId}
+                  regenerate={regenerate}
                   selectedModelId={currentModelId}
-                  selectedVisibilityType={visibilityType}
-                  sendMessage={
-                    editingMessage
-                      ? async () => {
-                          const msg = editingMessage;
-                          setEditingMessage(null);
-                          await submitEditedMessage({
-                            message: msg,
-                            text: input,
-                            setMessages,
-                            regenerate,
-                          });
-                          setInput("");
-                        }
-                      : sendMessage
-                  }
-                  setAttachments={setAttachments}
-                  setInput={setInput}
                   setMessages={setMessages}
                   status={status}
-                  stop={stop}
+                  votes={votes}
                 />
-              )}
+
+                <div className="sticky bottom-0 z-1 mx-auto flex w-full max-w-4xl gap-2 border-t-0 bg-background px-2 pb-3 md:px-4 md:pb-4">
+                  {!isReadonly && (
+                    <MultimodalInput
+                      attachments={attachments}
+                      chatId={chatId}
+                      editingMessage={editingMessage}
+                      input={input}
+                      isLoading={isLoading}
+                      messages={messages}
+                      onCancelEdit={() => {
+                        setEditingMessage(null);
+                        setInput("");
+                      }}
+                      onModelChange={setCurrentModelId}
+                      selectedModelId={currentModelId}
+                      selectedVisibilityType={visibilityType}
+                      sendMessage={
+                        editingMessage
+                          ? async () => {
+                              const msg = editingMessage;
+                              setEditingMessage(null);
+                              await submitEditedMessage({
+                                message: msg,
+                                text: input,
+                                setMessages,
+                                regenerate,
+                              });
+                              setInput("");
+                            }
+                          : sendMessage
+                      }
+                      setAttachments={setAttachments}
+                      setInput={setInput}
+                      setMessages={setMessages}
+                      status={status}
+                      stop={stop}
+                    />
+                  )}
+                </div>
+              </div>
             </div>
-          </div>
-        </div>
+          </ResizablePanel>
+
+          {(isKnowledgeOpen || isPreviewOpen) && (
+            <>
+              <ResizableHandle
+                className="bg-transparent hover:bg-foreground/10 [&>div]:bg-foreground/15"
+                withHandle
+              />
+              <ResizablePanel
+                className="flex min-w-0 flex-col"
+                defaultSize={50}
+                id="side-panel"
+                minSize={25}
+              >
+                {/* One side slot; a knowledge document takes precedence over a
+                    live preview when both happen to be open. */}
+                {isKnowledgeOpen ? <KnowledgePanel /> : <PreviewPanel />}
+              </ResizablePanel>
+            </>
+          )}
+        </ResizablePanelGroup>
 
         <Artifact
           addToolApprovalResponse={addToolApprovalResponse}
diff --git a/packages/web/src/components/chat/sidebar-history-item.tsx b/packages/web/src/components/chat/sidebar-history-item.tsx
index c81df15b..7331e729 100644
--- a/packages/web/src/components/chat/sidebar-history-item.tsx
+++ b/packages/web/src/components/chat/sidebar-history-item.tsx
@@ -1,3 +1,4 @@
+import { ArchiveIcon, ArchiveRestoreIcon } from "lucide-react";
 import Link from "next/link";
 import { memo, useRef, useState } from "react";
 import { useSWRConfig } from "swr";
@@ -5,6 +6,16 @@ import { unstable_serialize } from "swr/infinite";
 import { useChatVisibility } from "@/hooks/use-chat-visibility";
 import { createClient } from "@/lib/client";
 import type { Chat } from "@/lib/db/schema";
+import {
+  ContextMenu,
+  ContextMenuContent,
+  ContextMenuItem,
+  ContextMenuPortal,
+  ContextMenuSub,
+  ContextMenuSubContent,
+  ContextMenuSubTrigger,
+  ContextMenuTrigger,
+} from "../ui/context-menu";
 import {
   DropdownMenu,
   DropdownMenuContent,
@@ -15,6 +26,7 @@ import {
   DropdownMenuSubTrigger,
   DropdownMenuTrigger,
 } from "../ui/dropdown-menu";
+import { Input } from "../ui/input";
 import { SidebarMenuAction, SidebarMenuButton, SidebarMenuItem } from "../ui/sidebar";
 import {
   CheckCircleFillIcon,
@@ -31,13 +43,16 @@ const PureChatItem = ({
   chat,
   isActive,
   onDelete,
+  onArchiveToggle,
   setOpenMobile,
 }: {
   chat: Chat;
   isActive: boolean;
   onDelete: (chatId: string) => void;
+  onArchiveToggle?: (chatId: string, nextArchived: boolean) => void;
   setOpenMobile: (open: boolean) => void;
 }) => {
+  const isArchived = chat.archivedAt != null;
   const { visibilityType, setVisibilityType } = useChatVisibility({
     chatId: chat.id,
     initialVisibilityType: chat.visibility,
@@ -79,8 +94,9 @@ const PureChatItem = ({
   if (isRenaming) {
     return (
       <SidebarMenuItem>
-        <input
-          className="h-8 w-full rounded-none border-b border-dashed border-sidebar-foreground/50 bg-transparent px-2 text-[13px] text-sidebar-foreground outline-none"
+        <Input
+          aria-label="Rename chat"
+          className="h-8 rounded-none border-0 border-b border-dashed border-sidebar-foreground/50 bg-transparent px-2 text-[13px] text-sidebar-foreground focus-visible:border-sidebar-foreground/50 focus-visible:ring-0"
           onBlur={handleRename}
           onChange={(e) => setTitle(e.target.value)}
           onKeyDown={(e) => {
@@ -99,15 +115,68 @@ const PureChatItem = ({
 
   return (
     <SidebarMenuItem>
-      <SidebarMenuButton
-        asChild
-        className="h-8 rounded-none text-[13px] text-sidebar-foreground/50 transition-all duration-150 hover:bg-transparent hover:text-sidebar-foreground data-active:bg-transparent data-active:font-normal data-active:text-sidebar-foreground/50 data-[active=true]:text-sidebar-foreground data-[active=true]:font-medium data-[active=true]:border-b data-[active=true]:border-dashed data-[active=true]:border-sidebar-foreground/50"
-        isActive={isActive}
-      >
-        <Link href={`/chat/${chat.id}`} onClick={() => setOpenMobile(false)}>
-          <span className="truncate">{title}</span>
-        </Link>
-      </SidebarMenuButton>
+      <ContextMenu>
+        <ContextMenuTrigger asChild>
+          <SidebarMenuButton
+            asChild
+            className="h-8 rounded-md text-[13px] text-sidebar-foreground/50 transition-all duration-150 hover:bg-sidebar-accent/40 hover:text-sidebar-foreground data-active:bg-transparent data-active:font-normal data-active:text-sidebar-foreground/50 data-[active=true]:bg-primary/10 data-[active=true]:font-medium data-[active=true]:text-primary"
+            isActive={isActive}
+          >
+            <Link href={`/chat/${chat.id}`} onClick={() => setOpenMobile(false)}>
+              <span className="truncate">{title}</span>
+            </Link>
+          </SidebarMenuButton>
+        </ContextMenuTrigger>
+        <ContextMenuContent className="w-44">
+          <ContextMenuItem className="cursor-pointer" onSelect={() => setIsRenaming(true)}>
+            <PencilEditIcon size={12} />
+            <span>Rename</span>
+          </ContextMenuItem>
+          <ContextMenuSub>
+            <ContextMenuSubTrigger className="cursor-pointer">
+              <ShareIcon />
+              <span>Share</span>
+            </ContextMenuSubTrigger>
+            <ContextMenuPortal>
+              <ContextMenuSubContent>
+                <ContextMenuItem
+                  className="cursor-pointer flex-row justify-between"
+                  onClick={() => setVisibilityType("private")}
+                >
+                  <div className="flex flex-row items-center gap-2">
+                    <LockIcon size={12} />
+                    <span>Private</span>
+                  </div>
+                  {visibilityType === "private" ? <CheckCircleFillIcon /> : null}
+                </ContextMenuItem>
+                <ContextMenuItem
+                  className="cursor-pointer flex-row justify-between"
+                  onClick={() => setVisibilityType("public")}
+                >
+                  <div className="flex flex-row items-center gap-2">
+                    <GlobeIcon />
+                    <span>Public</span>
+                  </div>
+                  {visibilityType === "public" ? <CheckCircleFillIcon /> : null}
+                </ContextMenuItem>
+              </ContextMenuSubContent>
+            </ContextMenuPortal>
+          </ContextMenuSub>
+          {onArchiveToggle && (
+            <ContextMenuItem
+              className="cursor-pointer"
+              onSelect={() => onArchiveToggle(chat.id, !isArchived)}
+            >
+              {isArchived ? <ArchiveRestoreIcon size={14} /> : <ArchiveIcon size={14} />}
+              <span>{isArchived ? "Unarchive" : "Archive"}</span>
+            </ContextMenuItem>
+          )}
+          <ContextMenuItem onSelect={() => onDelete(chat.id)} variant="destructive">
+            <TrashIcon />
+            <span>Delete</span>
+          </ContextMenuItem>
+        </ContextMenuContent>
+      </ContextMenu>
 
       <DropdownMenu modal={true}>
         <DropdownMenuTrigger asChild>
@@ -166,6 +235,16 @@ const PureChatItem = ({
             </DropdownMenuPortal>
           </DropdownMenuSub>
 
+          {onArchiveToggle && (
+            <DropdownMenuItem
+              className="cursor-pointer"
+              onSelect={() => onArchiveToggle(chat.id, !isArchived)}
+            >
+              {isArchived ? <ArchiveRestoreIcon size={14} /> : <ArchiveIcon size={14} />}
+              <span>{isArchived ? "Unarchive" : "Archive"}</span>
+            </DropdownMenuItem>
+          )}
+
           <DropdownMenuItem onSelect={() => onDelete(chat.id)} variant="destructive">
             <TrashIcon />
             <span>Delete</span>
@@ -179,5 +258,6 @@ const PureChatItem = ({
 export const ChatItem = memo(PureChatItem, (prevProps, nextProps) => {
   if (prevProps.isActive !== nextProps.isActive) return false;
   if (prevProps.chat.title !== nextProps.chat.title) return false;
+  if (prevProps.chat.archivedAt !== nextProps.chat.archivedAt) return false;
   return true;
 });
diff --git a/packages/web/src/components/chat/sidebar-history.tsx b/packages/web/src/components/chat/sidebar-history.tsx
index c672049f..7bd090a2 100644
--- a/packages/web/src/components/chat/sidebar-history.tsx
+++ b/packages/web/src/components/chat/sidebar-history.tsx
@@ -2,10 +2,14 @@
 
 import { isToday, isYesterday, subMonths, subWeeks } from "date-fns";
 import { motion } from "framer-motion";
+import { ArchiveIcon, SearchIcon, XIcon } from "lucide-react";
+import Link from "next/link";
 import { usePathname, useRouter } from "next/navigation";
 import { useState } from "react";
 import { toast } from "sonner";
+import useSWR from "swr";
 import useSWRInfinite from "swr/infinite";
+import { useDebounceValue } from "usehooks-ts";
 import {
   AlertDialog,
   AlertDialogAction,
@@ -21,9 +25,13 @@ import {
   SidebarGroupContent,
   SidebarGroupLabel,
   SidebarMenu,
+  SidebarMenuButton,
+  SidebarMenuItem,
   useSidebar,
 } from "@/components/ui/sidebar";
+import { Skeleton } from "@/components/ui/skeleton";
 import type { SessionUser as User } from "@/lib/auth";
+import { createClient } from "@/lib/client";
 import type { Chat } from "@/lib/db/schema";
 import { fetcher } from "@/lib/utils";
 import { LoaderIcon } from "./icons";
@@ -42,6 +50,8 @@ export type ChatHistory = {
   hasMore: boolean;
 };
 
+type SearchResult = Chat & { snippet?: string | null };
+
 const PAGE_SIZE = 20;
 
 const groupChatsByDate = (chats: Chat[]): GroupedChats => {
@@ -114,6 +124,86 @@ export function SidebarHistory({ user }: { user: User | undefined }) {
   const router = useRouter();
   const [deleteId, setDeleteId] = useState<string | null>(null);
   const [showDeleteDialog, setShowDeleteDialog] = useState(false);
+  const [showArchived, setShowArchived] = useState(false);
+
+  // Archived conversations are loaded lazily (only when the section is expanded)
+  // from the same /api/history endpoint with ?archived=true.
+  const {
+    data: archivedData,
+    isLoading: archivedLoading,
+    mutate: mutateArchived,
+  } = useSWR<ChatHistory>(
+    showArchived && user
+      ? `${process.env.NEXT_PUBLIC_BASE_PATH ?? ""}/api/history?archived=true&limit=100`
+      : null,
+    fetcher,
+    { revalidateOnFocus: false },
+  );
+  const archivedChats = archivedData?.chats ?? [];
+
+  // Conversation search (titles + message content), server-side and debounced.
+  const [search, setSearch] = useState("");
+  const [debouncedSearch] = useDebounceValue(search, 250);
+  const searchQuery = debouncedSearch.trim();
+  const isSearching = searchQuery.length >= 2;
+  const { data: searchData, isLoading: searchLoading } = useSWR<{ chats: SearchResult[] }>(
+    isSearching && user
+      ? `${process.env.NEXT_PUBLIC_BASE_PATH ?? ""}/api/history/search?q=${encodeURIComponent(searchQuery)}`
+      : null,
+    fetcher,
+    { revalidateOnFocus: false, keepPreviousData: true },
+  );
+  const searchResults = searchData?.chats ?? [];
+
+  const handleArchiveToggle = async (chatId: string, nextArchived: boolean) => {
+    // Optimistically remove it from whichever list it currently sits in.
+    if (nextArchived) {
+      mutate(
+        (pages) =>
+          pages?.map((page) => ({
+            ...page,
+            chats: page.chats.filter((chat) => chat.id !== chatId),
+          })),
+        { revalidate: false },
+      );
+    } else {
+      mutateArchived(
+        (data) => (data ? { ...data, chats: data.chats.filter((c) => c.id !== chatId) } : data),
+        { revalidate: false },
+      );
+    }
+
+    try {
+      const {
+        data: { session },
+      } = await createClient().auth.getSession();
+      const token = session?.access_token ?? null;
+      const agentUrl = process.env.NEXT_PUBLIC_AGENT_SERVER_URL || "http://localhost:4111";
+      const res = await fetch(`${agentUrl}/conversations/${chatId}`, {
+        method: "PATCH",
+        headers: {
+          "Content-Type": "application/json",
+          ...(token ? { Authorization: `Bearer ${token}` } : {}),
+        },
+        body: JSON.stringify({ archived: nextArchived }),
+      });
+      if (!res.ok) throw new Error(`archive failed (${res.status})`);
+
+      if (nextArchived) {
+        toast.success("Chat archived", {
+          action: { label: "Undo", onClick: () => handleArchiveToggle(chatId, false) },
+        });
+        mutateArchived(); // pull it into the archived list
+      } else {
+        toast.success("Chat restored");
+        mutate(); // pull it back into the active list
+      }
+    } catch {
+      toast.error(nextArchived ? "Failed to archive chat" : "Failed to restore chat");
+      mutate();
+      mutateArchived();
+    }
+  };
 
   const hasReachedEnd = paginatedChatHistories
     ? paginatedChatHistories.some((page) => page.hasMore === false)
@@ -123,30 +213,47 @@ export function SidebarHistory({ user }: { user: User | undefined }) {
     ? paginatedChatHistories.every((page) => page.chats.length === 0)
     : false;
 
-  const handleDelete = () => {
+  const handleDelete = async () => {
     const chatToDelete = deleteId;
+    if (!chatToDelete) return;
     const isCurrentChat = pathname === `/chat/${chatToDelete}`;
 
     setShowDeleteDialog(false);
 
-    if (isCurrentChat) {
-      router.replace("/");
-    }
-
-    mutate((chatHistories) => {
-      if (chatHistories) {
-        return chatHistories.map((chatHistory) => ({
+    // Optimistically remove it from the list and suppress revalidation until the
+    // real delete confirms — otherwise the next /api/history refetch brings it
+    // back before the DELETE lands.
+    mutate(
+      (chatHistories) =>
+        chatHistories?.map((chatHistory) => ({
           ...chatHistory,
           chats: chatHistory.chats.filter((chat) => chat.id !== chatToDelete),
-        }));
-      }
-    });
-
-    fetch(`${process.env.NEXT_PUBLIC_BASE_PATH ?? ""}/api/chat?id=${chatToDelete}`, {
-      method: "DELETE",
-    });
+        })),
+      { revalidate: false },
+    );
 
-    toast.success("Chat deleted");
+    try {
+      // Hit the agents server directly (with auth), exactly like Rename does.
+      // The old `/api/chat?id=` route does not exist (404), so deletes never
+      // persisted and reappeared on revalidation.
+      const {
+        data: { session },
+      } = await createClient().auth.getSession();
+      const token = session?.access_token ?? null;
+      const agentUrl = process.env.NEXT_PUBLIC_AGENT_SERVER_URL || "http://localhost:4111";
+      const res = await fetch(`${agentUrl}/conversations/${chatToDelete}`, {
+        method: "DELETE",
+        headers: token ? { Authorization: `Bearer ${token}` } : {},
+      });
+      if (!res.ok) throw new Error(`delete failed (${res.status})`);
+      toast.success("Chat deleted");
+      mutateArchived(); // in case the deleted chat was an archived one
+      // Stay inside the chat app (new chat) instead of the marketing homepage.
+      if (isCurrentChat) router.replace("/chat");
+    } catch {
+      toast.error("Failed to delete chat");
+      mutate(); // revalidate to restore the true list
+    }
   };
 
   if (!user) {
@@ -171,8 +278,8 @@ export function SidebarHistory({ user }: { user: User | undefined }) {
           <div className="flex flex-col gap-0.5 px-1">
             {[44, 32, 28, 64, 52].map((item) => (
               <div className="flex h-8 items-center gap-2 rounded-lg px-2" key={item}>
-                <div
-                  className="h-3 max-w-(--skeleton-width) flex-1 animate-pulse rounded-md bg-sidebar-foreground/[0.06]"
+                <Skeleton
+                  className="h-3 max-w-(--skeleton-width) flex-1 rounded-md bg-sidebar-foreground/[0.06]"
                   style={
                     {
                       "--skeleton-width": `${item}%`,
@@ -187,161 +294,265 @@ export function SidebarHistory({ user }: { user: User | undefined }) {
     );
   }
 
-  if (hasEmptyChatHistory) {
-    return (
-      <SidebarGroup className="group-data-[collapsible=icon]:hidden">
-        <SidebarGroupLabel className="text-[10px] font-semibold uppercase tracking-[0.12em] text-sidebar-foreground/70">
-          History
-        </SidebarGroupLabel>
+  return (
+    <>
+      {/* Search box — searches conversation titles + message content. */}
+      <SidebarGroup className="group-data-[collapsible=icon]:hidden py-1">
         <SidebarGroupContent>
-          <div className="flex w-full flex-row items-center justify-center gap-2 px-2 text-[13px] text-sidebar-foreground/60">
-            Your conversations will appear here once you start chatting!
+          <div className="relative px-1">
+            <SearchIcon className="pointer-events-none absolute top-1/2 left-3 size-3.5 -translate-y-1/2 text-sidebar-foreground/40" />
+            <input
+              aria-label="Search conversations"
+              className="h-8 w-full rounded-md border border-sidebar-border/60 bg-sidebar-accent/30 pr-7 pl-8 text-[13px] text-sidebar-foreground outline-none placeholder:text-sidebar-foreground/40 focus:border-sidebar-border"
+              onChange={(e) => setSearch(e.target.value)}
+              placeholder="Search chats…"
+              value={search}
+            />
+            {search && (
+              <button
+                aria-label="Clear search"
+                className="absolute top-1/2 right-2 -translate-y-1/2 text-sidebar-foreground/40 transition-colors hover:text-sidebar-foreground"
+                onClick={() => setSearch("")}
+                type="button"
+              >
+                <XIcon className="size-3.5" />
+              </button>
+            )}
           </div>
         </SidebarGroupContent>
       </SidebarGroup>
-    );
-  }
 
-  return (
-    <>
-      <SidebarGroup className="group-data-[collapsible=icon]:hidden">
-        <SidebarGroupLabel className="text-[10px] font-semibold uppercase tracking-[0.12em] text-sidebar-foreground/70">
-          History
-        </SidebarGroupLabel>
-        <SidebarGroupContent>
-          <SidebarMenu>
-            {paginatedChatHistories &&
-              (() => {
-                const chatsFromHistory = paginatedChatHistories.flatMap(
-                  (paginatedChatHistory) => paginatedChatHistory.chats,
-                );
-
-                const groupedChats = groupChatsByDate(chatsFromHistory);
-
-                return (
-                  <div className="flex flex-col gap-4">
-                    {groupedChats.today.length > 0 && (
-                      <div>
-                        <div className="px-2 py-1 text-[10px] font-semibold uppercase tracking-[0.12em] text-sidebar-foreground/70">
-                          Today
-                        </div>
-                        {groupedChats.today.map((chat) => (
-                          <ChatItem
-                            chat={chat}
-                            isActive={chat.id === id}
-                            key={chat.id}
-                            onDelete={(chatId) => {
-                              setDeleteId(chatId);
-                              setShowDeleteDialog(true);
-                            }}
-                            setOpenMobile={setOpenMobile}
-                          />
-                        ))}
-                      </div>
-                    )}
-
-                    {groupedChats.yesterday.length > 0 && (
-                      <div>
-                        <div className="px-2 py-1 text-[10px] font-semibold uppercase tracking-[0.12em] text-sidebar-foreground/70">
-                          Yesterday
-                        </div>
-                        {groupedChats.yesterday.map((chat) => (
-                          <ChatItem
-                            chat={chat}
-                            isActive={chat.id === id}
-                            key={chat.id}
-                            onDelete={(chatId) => {
-                              setDeleteId(chatId);
-                              setShowDeleteDialog(true);
-                            }}
-                            setOpenMobile={setOpenMobile}
-                          />
-                        ))}
-                      </div>
-                    )}
-
-                    {groupedChats.lastWeek.length > 0 && (
-                      <div>
-                        <div className="px-2 py-1 text-[10px] font-semibold uppercase tracking-[0.12em] text-sidebar-foreground/70">
-                          Last 7 days
-                        </div>
-                        {groupedChats.lastWeek.map((chat) => (
-                          <ChatItem
-                            chat={chat}
-                            isActive={chat.id === id}
-                            key={chat.id}
-                            onDelete={(chatId) => {
-                              setDeleteId(chatId);
-                              setShowDeleteDialog(true);
-                            }}
-                            setOpenMobile={setOpenMobile}
-                          />
-                        ))}
-                      </div>
-                    )}
-
-                    {groupedChats.lastMonth.length > 0 && (
-                      <div>
-                        <div className="px-2 py-1 text-[10px] font-semibold uppercase tracking-[0.12em] text-sidebar-foreground/70">
-                          Last 30 days
-                        </div>
-                        {groupedChats.lastMonth.map((chat) => (
-                          <ChatItem
-                            chat={chat}
-                            isActive={chat.id === id}
-                            key={chat.id}
-                            onDelete={(chatId) => {
-                              setDeleteId(chatId);
-                              setShowDeleteDialog(true);
-                            }}
-                            setOpenMobile={setOpenMobile}
-                          />
-                        ))}
-                      </div>
-                    )}
-
-                    {groupedChats.older.length > 0 && (
-                      <div>
-                        <div className="px-2 py-1 text-[10px] font-semibold uppercase tracking-[0.12em] text-sidebar-foreground/70">
-                          Older
-                        </div>
-                        {groupedChats.older.map((chat) => (
-                          <ChatItem
-                            chat={chat}
-                            isActive={chat.id === id}
-                            key={chat.id}
-                            onDelete={(chatId) => {
-                              setDeleteId(chatId);
-                              setShowDeleteDialog(true);
-                            }}
-                            setOpenMobile={setOpenMobile}
-                          />
-                        ))}
+      {isSearching ? (
+        <SidebarGroup className="group-data-[collapsible=icon]:hidden">
+          <SidebarGroupLabel className="text-[10px] font-semibold uppercase tracking-[0.12em] text-sidebar-foreground/70">
+            Results
+          </SidebarGroupLabel>
+          <SidebarGroupContent>
+            {searchLoading && searchResults.length === 0 ? (
+              <div className="px-2 py-1.5 text-[12px] text-sidebar-foreground/50">Searching…</div>
+            ) : searchResults.length === 0 ? (
+              <div className="px-2 py-1.5 text-[12px] text-sidebar-foreground/50">
+                No matches for “{searchQuery}”
+              </div>
+            ) : (
+              <SidebarMenu>
+                {searchResults.map((chat) => (
+                  <SidebarMenuItem key={chat.id}>
+                    <SidebarMenuButton
+                      asChild
+                      className="h-auto flex-col items-start gap-0.5 rounded-md py-1.5 text-[13px] text-sidebar-foreground/70 data-[active=true]:bg-primary/10 data-[active=true]:text-primary"
+                      isActive={chat.id === id}
+                    >
+                      <Link href={`/chat/${chat.id}`} onClick={() => setOpenMobile(false)}>
+                        <span className="w-full truncate">{chat.title}</span>
+                        {chat.snippet && (
+                          <span className="w-full truncate text-[11px] text-sidebar-foreground/45">
+                            {chat.snippet}
+                          </span>
+                        )}
+                      </Link>
+                    </SidebarMenuButton>
+                  </SidebarMenuItem>
+                ))}
+              </SidebarMenu>
+            )}
+          </SidebarGroupContent>
+        </SidebarGroup>
+      ) : (
+        <>
+          <SidebarGroup className="group-data-[collapsible=icon]:hidden">
+            <SidebarGroupLabel className="text-[10px] font-semibold uppercase tracking-[0.12em] text-sidebar-foreground/70">
+              History
+            </SidebarGroupLabel>
+            <SidebarGroupContent>
+              {hasEmptyChatHistory && (
+                <div className="flex w-full flex-row items-center justify-center gap-2 px-2 text-[13px] text-sidebar-foreground/60">
+                  Your conversations will appear here once you start chatting!
+                </div>
+              )}
+              <SidebarMenu>
+                {paginatedChatHistories &&
+                  (() => {
+                    const chatsFromHistory = paginatedChatHistories.flatMap(
+                      (paginatedChatHistory) => paginatedChatHistory.chats,
+                    );
+
+                    const groupedChats = groupChatsByDate(chatsFromHistory);
+
+                    return (
+                      <div className="flex flex-col gap-4">
+                        {groupedChats.today.length > 0 && (
+                          <div>
+                            <div className="px-2 py-1 text-[10px] font-semibold uppercase tracking-[0.12em] text-sidebar-foreground/70">
+                              Today
+                            </div>
+                            {groupedChats.today.map((chat) => (
+                              <ChatItem
+                                chat={chat}
+                                isActive={chat.id === id}
+                                key={chat.id}
+                                onArchiveToggle={handleArchiveToggle}
+                                onDelete={(chatId) => {
+                                  setDeleteId(chatId);
+                                  setShowDeleteDialog(true);
+                                }}
+                                setOpenMobile={setOpenMobile}
+                              />
+                            ))}
+                          </div>
+                        )}
+
+                        {groupedChats.yesterday.length > 0 && (
+                          <div>
+                            <div className="px-2 py-1 text-[10px] font-semibold uppercase tracking-[0.12em] text-sidebar-foreground/70">
+                              Yesterday
+                            </div>
+                            {groupedChats.yesterday.map((chat) => (
+                              <ChatItem
+                                chat={chat}
+                                isActive={chat.id === id}
+                                key={chat.id}
+                                onArchiveToggle={handleArchiveToggle}
+                                onDelete={(chatId) => {
+                                  setDeleteId(chatId);
+                                  setShowDeleteDialog(true);
+                                }}
+                                setOpenMobile={setOpenMobile}
+                              />
+                            ))}
+                          </div>
+                        )}
+
+                        {groupedChats.lastWeek.length > 0 && (
+                          <div>
+                            <div className="px-2 py-1 text-[10px] font-semibold uppercase tracking-[0.12em] text-sidebar-foreground/70">
+                              Last 7 days
+                            </div>
+                            {groupedChats.lastWeek.map((chat) => (
+                              <ChatItem
+                                chat={chat}
+                                isActive={chat.id === id}
+                                key={chat.id}
+                                onArchiveToggle={handleArchiveToggle}
+                                onDelete={(chatId) => {
+                                  setDeleteId(chatId);
+                                  setShowDeleteDialog(true);
+                                }}
+                                setOpenMobile={setOpenMobile}
+                              />
+                            ))}
+                          </div>
+                        )}
+
+                        {groupedChats.lastMonth.length > 0 && (
+                          <div>
+                            <div className="px-2 py-1 text-[10px] font-semibold uppercase tracking-[0.12em] text-sidebar-foreground/70">
+                              Last 30 days
+                            </div>
+                            {groupedChats.lastMonth.map((chat) => (
+                              <ChatItem
+                                chat={chat}
+                                isActive={chat.id === id}
+                                key={chat.id}
+                                onArchiveToggle={handleArchiveToggle}
+                                onDelete={(chatId) => {
+                                  setDeleteId(chatId);
+                                  setShowDeleteDialog(true);
+                                }}
+                                setOpenMobile={setOpenMobile}
+                              />
+                            ))}
+                          </div>
+                        )}
+
+                        {groupedChats.older.length > 0 && (
+                          <div>
+                            <div className="px-2 py-1 text-[10px] font-semibold uppercase tracking-[0.12em] text-sidebar-foreground/70">
+                              Older
+                            </div>
+                            {groupedChats.older.map((chat) => (
+                              <ChatItem
+                                chat={chat}
+                                isActive={chat.id === id}
+                                key={chat.id}
+                                onArchiveToggle={handleArchiveToggle}
+                                onDelete={(chatId) => {
+                                  setDeleteId(chatId);
+                                  setShowDeleteDialog(true);
+                                }}
+                                setOpenMobile={setOpenMobile}
+                              />
+                            ))}
+                          </div>
+                        )}
                       </div>
-                    )}
+                    );
+                  })()}
+              </SidebarMenu>
+
+              <motion.div
+                onViewportEnter={() => {
+                  if (!isValidating && !hasReachedEnd) {
+                    setSize((size) => size + 1);
+                  }
+                }}
+              />
+
+              {hasReachedEnd ? null : (
+                <div className="mt-1 flex flex-row items-center gap-2 px-4 py-2 text-sidebar-foreground/50">
+                  <div className="animate-spin">
+                    <LoaderIcon />
                   </div>
-                );
-              })()}
-          </SidebarMenu>
-
-          <motion.div
-            onViewportEnter={() => {
-              if (!isValidating && !hasReachedEnd) {
-                setSize((size) => size + 1);
-              }
-            }}
-          />
-
-          {hasReachedEnd ? null : (
-            <div className="mt-1 flex flex-row items-center gap-2 px-4 py-2 text-sidebar-foreground/50">
-              <div className="animate-spin">
-                <LoaderIcon />
-              </div>
-              <div className="text-[11px]">Loading...</div>
-            </div>
-          )}
-        </SidebarGroupContent>
-      </SidebarGroup>
+                  <div className="text-[11px]">Loading...</div>
+                </div>
+              )}
+            </SidebarGroupContent>
+          </SidebarGroup>
+
+          {/* Archived — collapsed by default, loaded on demand. Always reachable so a
+          user whose chats are all archived can still find and restore them. */}
+          <SidebarGroup className="group-data-[collapsible=icon]:hidden">
+            <SidebarGroupContent>
+              <button
+                className="flex w-full items-center gap-2 rounded-md px-2 py-1.5 text-[11px] font-semibold uppercase tracking-[0.12em] text-sidebar-foreground/60 transition-colors hover:text-sidebar-foreground"
+                onClick={() => setShowArchived((v) => !v)}
+                type="button"
+              >
+                <ArchiveIcon size={13} />
+                <span>{showArchived ? "Hide archived" : "Archived"}</span>
+              </button>
+
+              {showArchived && (
+                <SidebarMenu className="mt-1">
+                  {archivedLoading ? (
+                    <div className="px-2 py-1.5 text-[12px] text-sidebar-foreground/50">
+                      Loading…
+                    </div>
+                  ) : archivedChats.length === 0 ? (
+                    <div className="px-2 py-1.5 text-[12px] text-sidebar-foreground/50">
+                      No archived chats
+                    </div>
+                  ) : (
+                    archivedChats.map((chat) => (
+                      <ChatItem
+                        chat={chat}
+                        isActive={chat.id === id}
+                        key={chat.id}
+                        onArchiveToggle={handleArchiveToggle}
+                        onDelete={(chatId) => {
+                          setDeleteId(chatId);
+                          setShowDeleteDialog(true);
+                        }}
+                        setOpenMobile={setOpenMobile}
+                      />
+                    ))
+                  )}
+                </SidebarMenu>
+              )}
+            </SidebarGroupContent>
+          </SidebarGroup>
+        </>
+      )}
 
       <AlertDialog onOpenChange={setShowDeleteDialog} open={showDeleteDialog}>
         <AlertDialogContent>
diff --git a/packages/web/src/components/chat/sidebar-user-nav.tsx b/packages/web/src/components/chat/sidebar-user-nav.tsx
index ece9b2dc..f98c1996 100644
--- a/packages/web/src/components/chat/sidebar-user-nav.tsx
+++ b/packages/web/src/components/chat/sidebar-user-nav.tsx
@@ -1,13 +1,15 @@
 "use client";
 
-import { Check, ChevronUp } from "lucide-react";
+import { Check, ChevronUp, LogOut, Moon, Palette, Settings2, Sun } from "lucide-react";
 import { useRouter } from "next/navigation";
 import { useTheme } from "next-themes";
 import { useEffect, useState } from "react";
+import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
 import {
   DropdownMenu,
   DropdownMenuContent,
   DropdownMenuItem,
+  DropdownMenuLabel,
   DropdownMenuSeparator,
   DropdownMenuSub,
   DropdownMenuSubContent,
@@ -16,17 +18,10 @@ import {
 } from "@/components/ui/dropdown-menu";
 import { SidebarMenu, SidebarMenuButton, SidebarMenuItem } from "@/components/ui/sidebar";
 import type { SessionUser } from "@/lib/auth";
+import { initialsFrom, seedToGradient } from "@/lib/avatar";
 import { createClient } from "@/lib/client";
 import { applyThemePreset, getStoredThemePreset, THEME_PRESETS } from "@/lib/theme-presets";
 
-function emailToHue(email: string): number {
-  let hash = 0;
-  for (const char of email) {
-    hash = char.charCodeAt(0) + ((hash << 5) - hash);
-  }
-  return Math.abs(hash) % 360;
-}
-
 export function SidebarUserNav({ user }: { user: SessionUser }) {
   const router = useRouter();
   const { setTheme, resolvedTheme } = useTheme();
@@ -46,6 +41,10 @@ export function SidebarUserNav({ user }: { user: SessionUser }) {
     router.push("/");
   };
 
+  const email = user.email ?? "";
+  const gradient = seedToGradient(email);
+  const initials = initialsFrom(email);
+
   return (
     <SidebarMenu>
       <SidebarMenuItem>
@@ -55,12 +54,15 @@ export function SidebarUserNav({ user }: { user: SessionUser }) {
               className="h-8 px-2 rounded-lg bg-transparent text-sidebar-foreground/70 transition-colors duration-150 hover:text-sidebar-foreground data-[state=open]:bg-sidebar-accent data-[state=open]:text-sidebar-accent-foreground"
               data-testid="user-nav-button"
             >
-              <div
-                className="size-5 shrink-0 rounded-full ring-1 ring-sidebar-border/50"
-                style={{
-                  background: `linear-gradient(135deg, oklch(0.35 0.08 ${emailToHue(user.email ?? "")}), oklch(0.25 0.05 ${emailToHue(user.email ?? "") + 40}))`,
-                }}
-              />
+              <Avatar className="size-5 shrink-0 ring-1 ring-sidebar-border/50">
+                {user.image ? <AvatarImage alt="" src={user.image} /> : null}
+                <AvatarFallback
+                  className="text-[9px] font-medium text-white"
+                  style={{ background: gradient }}
+                >
+                  {initials}
+                </AvatarFallback>
+              </Avatar>
               <span className="truncate text-[13px]" data-testid="user-email">
                 {user?.email}
               </span>
@@ -68,22 +70,59 @@ export function SidebarUserNav({ user }: { user: SessionUser }) {
             </SidebarMenuButton>
           </DropdownMenuTrigger>
           <DropdownMenuContent
-            className="w-(--radix-popper-anchor-width) rounded-lg border border-border/60 bg-card/95 backdrop-blur-xl shadow-[var(--shadow-float)]"
+            align="start"
+            className="w-60 rounded-xl border border-border/60 bg-card/95 p-1.5 backdrop-blur-xl shadow-[var(--shadow-float)]"
             data-testid="user-nav-menu"
             side="top"
+            sideOffset={8}
           >
+            <DropdownMenuLabel className="flex items-center gap-2.5 px-2 py-1.5 font-normal">
+              <Avatar className="size-7 shrink-0 ring-1 ring-sidebar-border/50">
+                {user.image ? <AvatarImage alt="" src={user.image} /> : null}
+                <AvatarFallback
+                  className="text-[11px] font-medium text-white"
+                  style={{ background: gradient }}
+                >
+                  {initials}
+                </AvatarFallback>
+              </Avatar>
+              <div className="flex min-w-0 flex-col">
+                <span className="truncate text-[13px] font-medium text-foreground">
+                  {user?.email}
+                </span>
+                <span className="text-[11px] text-muted-foreground">Signed in</span>
+              </div>
+            </DropdownMenuLabel>
+            <DropdownMenuSeparator />
+            <DropdownMenuItem
+              className="cursor-pointer gap-2 text-[13px]"
+              data-testid="user-nav-item-settings"
+              onSelect={() => router.push("/settings/integrations")}
+            >
+              <Settings2 className="size-4 text-muted-foreground" />
+              Settings
+            </DropdownMenuItem>
             <DropdownMenuItem
-              className="cursor-pointer text-[13px]"
+              className="cursor-pointer gap-2 text-[13px]"
               data-testid="user-nav-item-theme"
               onSelect={() => setTheme(resolvedTheme === "dark" ? "light" : "dark")}
             >
+              {resolvedTheme === "light" ? (
+                <Moon className="size-4 text-muted-foreground" />
+              ) : (
+                <Sun className="size-4 text-muted-foreground" />
+              )}
               {`Toggle ${resolvedTheme === "light" ? "dark" : "light"} mode`}
             </DropdownMenuItem>
             <DropdownMenuSub>
-              <DropdownMenuSubTrigger className="text-[13px]" data-testid="user-nav-item-preset">
+              <DropdownMenuSubTrigger
+                className="gap-2 text-[13px]"
+                data-testid="user-nav-item-preset"
+              >
+                <Palette className="size-4 text-muted-foreground" />
                 Color theme
               </DropdownMenuSubTrigger>
-              <DropdownMenuSubContent className="rounded-lg border border-border/60 bg-card/95 backdrop-blur-xl">
+              <DropdownMenuSubContent className="w-48 rounded-lg border border-border/60 bg-card/95 backdrop-blur-xl">
                 {THEME_PRESETS.map((p) => (
                   <DropdownMenuItem
                     className="cursor-pointer gap-2 text-[13px]"
@@ -91,7 +130,7 @@ export function SidebarUserNav({ user }: { user: SessionUser }) {
                     onSelect={() => handleSelectPreset(p.value)}
                   >
                     <span
-                      className="size-3 shrink-0 rounded-full ring-1 ring-border/60"
+                      className="size-3.5 shrink-0 rounded-full ring-1 ring-black/15 dark:ring-white/25"
                       style={{ background: p.swatch }}
                     />
                     <span className="flex-1 truncate">{p.name}</span>
@@ -102,10 +141,11 @@ export function SidebarUserNav({ user }: { user: SessionUser }) {
             </DropdownMenuSub>
             <DropdownMenuSeparator />
             <DropdownMenuItem
-              className="cursor-pointer text-[13px]"
+              className="cursor-pointer gap-2 text-[13px] text-destructive focus:text-destructive"
               data-testid="user-nav-item-auth"
               onSelect={handleSignOut}
             >
+              <LogOut className="size-4" />
               Sign out
             </DropdownMenuItem>
           </DropdownMenuContent>
diff --git a/packages/web/src/components/chat/slash-commands.tsx b/packages/web/src/components/chat/slash-commands.tsx
index d485b605..7b1c2cf9 100644
--- a/packages/web/src/components/chat/slash-commands.tsx
+++ b/packages/web/src/components/chat/slash-commands.tsx
@@ -9,8 +9,8 @@ import {
   Trash2Icon,
   XIcon,
 } from "lucide-react";
-import { type ReactNode, useEffect, useRef } from "react";
-import { cn } from "@/lib/utils";
+import type { ReactNode } from "react";
+import { Command, CommandGroup, CommandItem, CommandList } from "@/components/ui/command";
 
 export type SlashCommand = {
   name: string;
@@ -78,52 +78,54 @@ export function SlashCommandMenu({
   onClose: _onClose,
   selectedIndex,
 }: SlashCommandMenuProps) {
-  const menuRef = useRef<HTMLDivElement>(null);
   const filtered = slashCommands.filter((cmd) => cmd.name.startsWith(query.toLowerCase()));
 
-  useEffect(() => {
-    const selected = menuRef.current?.querySelector("[data-selected='true']");
-    if (selected) {
-      selected.scrollIntoView({ block: "nearest" });
-    }
-  }, []);
-
   if (filtered.length === 0) {
     return null;
   }
 
+  // The composer textarea above this menu owns keyboard navigation and selection
+  // (ArrowUp/Down/Enter/Escape) and feeds the active row in via `selectedIndex`.
+  // We disable cmdk's own filtering and drive its highlight from that index so the
+  // parent contract is preserved while still getting role=listbox/option + aria-selected.
+  const activeValue = filtered[selectedIndex]?.name ?? filtered[0]?.name;
+
   return (
-    <div
-      className="absolute bottom-full left-0 right-0 z-50 mb-2 overflow-hidden rounded-xl border border-border/50 bg-card/95 shadow-[var(--shadow-float)] backdrop-blur-xl"
-      ref={menuRef}
-    >
-      <div className="px-4 py-2.5 text-[10px] font-medium uppercase tracking-wider text-muted-foreground/40">
-        Commands
-      </div>
-      <div className="max-h-64 overflow-y-auto pb-1 no-scrollbar">
-        {filtered.map((cmd, index) => (
-          <button
-            className={cn(
-              "flex w-full items-center gap-3 px-4 py-2.5 text-left transition-colors",
-              index === selectedIndex ? "bg-muted/70" : "hover:bg-muted/40",
-            )}
-            data-selected={index === selectedIndex}
-            key={cmd.name}
-            onClick={() => onSelect(cmd)}
-            onMouseDown={(e) => e.preventDefault()}
-            type="button"
+    <div className="absolute bottom-full left-0 right-0 z-50 mb-2 overflow-hidden rounded-xl border border-border/50 bg-card/95 shadow-[var(--shadow-float)] backdrop-blur-xl">
+      <Command
+        className="rounded-none bg-transparent p-0 text-popover-foreground"
+        loop
+        shouldFilter={false}
+        value={activeValue}
+      >
+        <CommandList className="max-h-64 pb-1">
+          <CommandGroup
+            className="p-0 **:[[cmdk-group-heading]]:px-4 **:[[cmdk-group-heading]]:py-2.5 **:[[cmdk-group-heading]]:text-[10px] **:[[cmdk-group-heading]]:font-medium **:[[cmdk-group-heading]]:uppercase **:[[cmdk-group-heading]]:tracking-wider **:[[cmdk-group-heading]]:text-muted-foreground/40"
+            heading="Commands"
           >
-            <div className="flex size-6 shrink-0 items-center justify-center text-muted-foreground/60">
-              {cmd.icon}
-            </div>
-            <span className="font-mono text-[13px] text-foreground">/{cmd.name}</span>
-            <span className="text-[12px] text-muted-foreground/50">{cmd.description}</span>
-            {cmd.shortcut && (
-              <span className="ml-auto text-[11px] text-muted-foreground/30">{cmd.shortcut}</span>
-            )}
-          </button>
-        ))}
-      </div>
+            {filtered.map((cmd) => (
+              <CommandItem
+                className="gap-3 rounded-none px-4 py-2.5"
+                key={cmd.name}
+                onMouseDown={(e) => e.preventDefault()}
+                onSelect={() => onSelect(cmd)}
+                value={cmd.name}
+              >
+                <div className="flex size-6 shrink-0 items-center justify-center text-muted-foreground/60">
+                  {cmd.icon}
+                </div>
+                <span className="font-mono text-[13px] text-foreground">/{cmd.name}</span>
+                <span className="text-[12px] text-muted-foreground/50">{cmd.description}</span>
+                {cmd.shortcut && (
+                  <span className="ml-auto text-[11px] text-muted-foreground/30">
+                    {cmd.shortcut}
+                  </span>
+                )}
+              </CommandItem>
+            ))}
+          </CommandGroup>
+        </CommandList>
+      </Command>
     </div>
   );
 }
diff --git a/packages/web/src/components/chat/suggested-actions.tsx b/packages/web/src/components/chat/suggested-actions.tsx
index 7884dc73..0f950db0 100644
--- a/packages/web/src/components/chat/suggested-actions.tsx
+++ b/packages/web/src/components/chat/suggested-actions.tsx
@@ -41,7 +41,7 @@ function PureSuggestedActions({ chatId, sendMessage }: SuggestedActionsProps) {
           }}
         >
           <Suggestion
-            className="h-auto w-full whitespace-nowrap rounded-xl border border-border/50 bg-card/30 px-4 py-3 text-left text-[12px] leading-relaxed text-muted-foreground transition-all duration-200 sm:whitespace-normal sm:p-4 sm:text-[13px] hover:-translate-y-0.5 hover:bg-card/60 hover:text-foreground hover:shadow-[var(--shadow-card)]"
+            className="h-auto w-full whitespace-nowrap rounded-xl border border-border/50 bg-card/30 px-4 py-3 text-left text-[12px] leading-relaxed text-muted-foreground transition-all duration-200 sm:whitespace-normal sm:p-4 sm:text-[13px] hover:-translate-y-0.5 hover:border-primary/40 hover:bg-card/60 hover:text-foreground hover:shadow-[var(--shadow-card)]"
             onClick={(suggestion) => {
               window.history.pushState(
                 {},
diff --git a/packages/web/src/components/chat/suggestion.tsx b/packages/web/src/components/chat/suggestion.tsx
index 9c4ae162..edfd85df 100644
--- a/packages/web/src/components/chat/suggestion.tsx
+++ b/packages/web/src/components/chat/suggestion.tsx
@@ -1,10 +1,16 @@
 "use client";
 
-import { AnimatePresence, motion } from "framer-motion";
-
 import type { UISuggestion } from "@/lib/editor/suggestions";
 import { Button } from "../ui/button";
-import { CrossIcon, SparklesIcon } from "./icons";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from "../ui/dialog";
+import { SparklesIcon } from "./icons";
 
 export const SuggestionDialog = ({
   suggestion,
@@ -16,53 +22,32 @@ export const SuggestionDialog = ({
   onClose: () => void;
 }) => {
   return (
-    <AnimatePresence>
-      <div className="sticky inset-0 z-40 h-full w-full">
-        <div
-          aria-hidden="true"
-          className="absolute inset-0 bg-black/20 backdrop-blur-[2px]"
-          onClick={onClose}
-          onKeyDown={(e) => {
-            if (e.key === "Escape") {
-              onClose();
-            }
-          }}
-          role="presentation"
-        />
-        <motion.div
-          animate={{ opacity: 1, scale: 1 }}
-          className="absolute left-1/2 top-1/2 z-50 flex w-[min(20rem,calc(100%-2rem))] -translate-x-1/2 -translate-y-1/2 flex-col gap-3 rounded-2xl border bg-background p-4 font-sans text-sm shadow-xl"
-          exit={{ opacity: 0, scale: 0.95 }}
-          initial={{ opacity: 0, scale: 0.95 }}
-          key={suggestion.id}
-          transition={{ duration: 0.15 }}
-        >
-          <div className="flex flex-row items-center justify-between">
-            <div className="flex flex-row items-center gap-2">
-              <div className="flex size-5 items-center justify-center rounded-md bg-muted/60 text-muted-foreground ring-1 ring-border/50">
-                <SparklesIcon size={10} />
-              </div>
-              <div className="font-medium">Suggestion</div>
-            </div>
-            <button
-              className="flex size-6 cursor-pointer items-center justify-center rounded-md text-muted-foreground transition-colors hover:bg-muted hover:text-foreground"
-              onClick={onClose}
-              type="button"
-            >
-              <CrossIcon size={12} />
-            </button>
-          </div>
-          <div className="text-muted-foreground leading-relaxed">{suggestion.description}</div>
-          <div className="flex gap-2">
-            <Button className="w-fit rounded-full px-3 py-1.5" onClick={onApply} variant="outline">
-              Apply
-            </Button>
-            <Button className="w-fit rounded-full px-3 py-1.5" onClick={onClose} variant="ghost">
-              Dismiss
-            </Button>
+    <Dialog
+      key={suggestion.id}
+      onOpenChange={(open) => {
+        if (!open) {
+          onClose();
+        }
+      }}
+      open
+    >
+      <DialogContent className="w-[min(20rem,calc(100%-2rem))] gap-3 font-sans">
+        <DialogHeader className="flex-row items-center gap-2 space-y-0">
+          <div className="flex size-5 items-center justify-center rounded-md bg-muted/60 text-muted-foreground ring-1 ring-border/50">
+            <SparklesIcon size={10} />
           </div>
-        </motion.div>
-      </div>
-    </AnimatePresence>
+          <DialogTitle>Suggestion</DialogTitle>
+        </DialogHeader>
+        <DialogDescription className="leading-relaxed">{suggestion.description}</DialogDescription>
+        <DialogFooter className="gap-2 sm:justify-start">
+          <Button className="w-fit rounded-full px-3 py-1.5" onClick={onApply} variant="outline">
+            Apply
+          </Button>
+          <Button className="w-fit rounded-full px-3 py-1.5" onClick={onClose} variant="ghost">
+            Dismiss
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
   );
 };
diff --git a/packages/web/src/components/chat/version-footer.tsx b/packages/web/src/components/chat/version-footer.tsx
index 2cd72f0f..1b7e1c29 100644
--- a/packages/web/src/components/chat/version-footer.tsx
+++ b/packages/web/src/components/chat/version-footer.tsx
@@ -9,6 +9,7 @@ import { useSWRConfig } from "swr";
 import { useArtifact } from "@/hooks/use-artifact";
 import type { Document } from "@/lib/db/schema";
 import { cn, getDocumentTimestampByIndex } from "@/lib/utils";
+import { Button } from "../ui/button";
 import { LoaderIcon } from "./icons";
 
 type VersionFooterProps = {
@@ -48,43 +49,43 @@ export const VersionFooter = ({
     >
       <div className="flex items-center gap-3">
         <div className="flex items-center gap-1">
-          <button
-            className="flex size-7 items-center justify-center rounded-md text-muted-foreground transition-colors hover:bg-muted hover:text-foreground disabled:pointer-events-none disabled:opacity-30"
+          <Button
             disabled={isFirst}
             onClick={() => handleVersionChange("prev")}
+            size="icon-sm"
             type="button"
+            variant="ghost"
           >
             <ChevronLeftIcon className="size-4" />
-          </button>
+          </Button>
           <span className="min-w-[4rem] text-center text-xs tabular-nums text-muted-foreground">
             {currentVersionIndex + 1} of {documents.length}
           </span>
-          <button
-            className="flex size-7 items-center justify-center rounded-md text-muted-foreground transition-colors hover:bg-muted hover:text-foreground disabled:pointer-events-none disabled:opacity-30"
+          <Button
             disabled={isLast}
             onClick={() => handleVersionChange("next")}
+            size="icon-sm"
             type="button"
+            variant="ghost"
           >
             <ChevronRightIcon className="size-4" />
-          </button>
+          </Button>
         </div>
 
-        <button
-          className={cn(
-            "flex size-7 items-center justify-center rounded-md text-muted-foreground transition-colors hover:bg-muted hover:text-foreground",
-            mode === "diff" && "bg-muted text-foreground",
-          )}
+        <Button
+          className={cn(mode === "diff" && "bg-muted text-foreground")}
           onClick={() => setMode(mode === "diff" ? "edit" : "diff")}
+          size="icon-sm"
           title="Show changes"
           type="button"
+          variant="ghost"
         >
           <DiffIcon className="size-4" />
-        </button>
+        </Button>
       </div>
 
       <div className="flex flex-row gap-2">
-        <button
-          className="inline-flex items-center justify-center gap-2 rounded-lg bg-foreground px-3 py-1.5 text-sm font-medium text-background transition-all duration-150 hover:opacity-90 active:scale-[0.98] disabled:pointer-events-none disabled:opacity-50"
+        <Button
           disabled={isMutating}
           onClick={async () => {
             setIsMutating(true);
@@ -119,6 +120,7 @@ export const VersionFooter = ({
             }
           }}
           type="button"
+          variant="default"
         >
           Restore
           {isMutating && (
@@ -126,17 +128,17 @@ export const VersionFooter = ({
               <LoaderIcon size={14} />
             </div>
           )}
-        </button>
-        <button
-          className="inline-flex items-center justify-center rounded-lg border border-border px-3 py-1.5 text-sm font-medium transition-all duration-150 hover:bg-muted active:scale-[0.98]"
+        </Button>
+        <Button
           onClick={() => {
             setMode("edit");
             handleVersionChange("latest");
           }}
           type="button"
+          variant="outline"
         >
           Latest
-        </button>
+        </Button>
       </div>
     </motion.div>
   );
diff --git a/packages/web/src/components/chat/visibility-selector.tsx b/packages/web/src/components/chat/visibility-selector.tsx
index 9014f065..f4965945 100644
--- a/packages/web/src/components/chat/visibility-selector.tsx
+++ b/packages/web/src/components/chat/visibility-selector.tsx
@@ -1,5 +1,6 @@
 "use client";
 
+import { UsersIcon } from "lucide-react";
 import { type ReactNode, useMemo, useState } from "react";
 import { Button } from "@/components/ui/button";
 import {
@@ -12,27 +13,34 @@ import { useChatVisibility } from "@/hooks/use-chat-visibility";
 import { cn } from "@/lib/utils";
 import { CheckCircleFillIcon, ChevronDownIcon, GlobeIcon, LockIcon } from "./icons";
 
-export type VisibilityType = "private" | "public";
+export type VisibilityType = "private" | "workspace" | "public";
 
-const visibilities: Array<{
-  id: VisibilityType;
-  label: string;
-  description: string;
-  icon: ReactNode;
-}> = [
-  {
+type VisibilityMeta = { id: VisibilityType; label: string; description: string; icon: ReactNode };
+
+// All three are valid values; "public" (a logged-out share link for chats) isn't
+// built yet, so it's not offered in the menu — only as a fallback for display.
+const VISIBILITY_META: Record<VisibilityType, VisibilityMeta> = {
+  private: {
     id: "private",
     label: "Private",
-    description: "Only you can access this chat",
+    description: "Only you can see this chat",
     icon: <LockIcon />,
   },
-  {
+  workspace: {
+    id: "workspace",
+    label: "Team",
+    description: "Everyone in your workspace can view this chat (read-only)",
+    icon: <UsersIcon className="size-4" />,
+  },
+  public: {
     id: "public",
     label: "Public",
     description: "Anyone with the link can access this chat",
     icon: <GlobeIcon />,
   },
-];
+};
+
+const visibilities: VisibilityMeta[] = [VISIBILITY_META.private, VISIBILITY_META.workspace];
 
 export function VisibilitySelector({
   chatId,
@@ -50,7 +58,7 @@ export function VisibilitySelector({
   });
 
   const selectedVisibility = useMemo(
-    () => visibilities.find((visibility) => visibility.id === visibilityType),
+    () => VISIBILITY_META[visibilityType as VisibilityType] ?? VISIBILITY_META.private,
     [visibilityType],
   );
 
diff --git a/packages/web/src/components/command-palette.tsx b/packages/web/src/components/command-palette.tsx
new file mode 100644
index 00000000..ba72fefc
--- /dev/null
+++ b/packages/web/src/components/command-palette.tsx
@@ -0,0 +1,91 @@
+"use client";
+
+import {
+  FileTextIcon,
+  InboxIcon,
+  LayoutDashboardIcon,
+  PenSquareIcon,
+  SettingsIcon,
+  UsersIcon,
+  ZapIcon,
+} from "lucide-react";
+import { useRouter } from "next/navigation";
+import { useEffect, useState } from "react";
+import {
+  CommandDialog,
+  CommandEmpty,
+  CommandGroup,
+  CommandInput,
+  CommandItem,
+  CommandList,
+  CommandSeparator,
+} from "@/components/ui/command";
+
+/** Other components open the palette by dispatching this event (e.g. a sidebar button). */
+export const OPEN_COMMAND_PALETTE_EVENT = "foreman:command-palette";
+
+const GO_TO = [
+  { label: "Automations", href: "/automations", Icon: ZapIcon },
+  { label: "Inbox", href: "/inbox", Icon: InboxIcon },
+  { label: "Apps", href: "/apps", Icon: LayoutDashboardIcon },
+  { label: "Documents", href: "/documents", Icon: FileTextIcon },
+  { label: "Workspaces", href: "/workspaces", Icon: UsersIcon },
+  { label: "Settings", href: "/settings", Icon: SettingsIcon },
+];
+
+/**
+ * Global Cmd/Ctrl+K command palette (foreman-iznn-style UX). Mounted once in the
+ * app sidebar so it's available on every authed page. Opens on Cmd/Ctrl+K or when
+ * any component dispatches OPEN_COMMAND_PALETTE_EVENT.
+ */
+export function CommandPalette() {
+  const router = useRouter();
+  const [open, setOpen] = useState(false);
+
+  useEffect(() => {
+    function onKey(e: KeyboardEvent) {
+      if (e.key.toLowerCase() === "k" && (e.metaKey || e.ctrlKey)) {
+        e.preventDefault();
+        setOpen((o) => !o);
+      }
+    }
+    function onOpen() {
+      setOpen(true);
+    }
+    document.addEventListener("keydown", onKey);
+    window.addEventListener(OPEN_COMMAND_PALETTE_EVENT, onOpen);
+    return () => {
+      document.removeEventListener("keydown", onKey);
+      window.removeEventListener(OPEN_COMMAND_PALETTE_EVENT, onOpen);
+    };
+  }, []);
+
+  function go(href: string) {
+    setOpen(false);
+    router.push(href);
+  }
+
+  return (
+    <CommandDialog onOpenChange={setOpen} open={open}>
+      <CommandInput placeholder="Type a command or search…" />
+      <CommandList>
+        <CommandEmpty>No results found.</CommandEmpty>
+        <CommandGroup heading="Actions">
+          <CommandItem onSelect={() => go("/chat")}>
+            <PenSquareIcon className="size-4" />
+            New chat
+          </CommandItem>
+        </CommandGroup>
+        <CommandSeparator />
+        <CommandGroup heading="Go to">
+          {GO_TO.map(({ label, href, Icon }) => (
+            <CommandItem key={href} onSelect={() => go(href)}>
+              <Icon className="size-4" />
+              {label}
+            </CommandItem>
+          ))}
+        </CommandGroup>
+      </CommandList>
+    </CommandDialog>
+  );
+}
diff --git a/packages/web/src/components/copy-button.tsx b/packages/web/src/components/copy-button.tsx
new file mode 100644
index 00000000..c41d9a4f
--- /dev/null
+++ b/packages/web/src/components/copy-button.tsx
@@ -0,0 +1,37 @@
+"use client";
+
+import { useCallback, useState } from "react";
+import { Button } from "@/components/ui/button";
+
+interface CopyButtonProps {
+  /** The text written to the clipboard when clicked. */
+  value: string;
+  /** Label shown in the idle state (defaults to "Copy"). */
+  label?: string;
+  size?: React.ComponentProps<typeof Button>["size"];
+  variant?: React.ComponentProps<typeof Button>["variant"];
+}
+
+/**
+ * Shared copy-to-clipboard button. Writes `value` to the clipboard and shows a
+ * transient "Copied!" confirmation that resets after 2s.
+ */
+export function CopyButton({
+  value,
+  label = "Copy",
+  size = "xs",
+  variant = "secondary",
+}: CopyButtonProps) {
+  const [copied, setCopied] = useState(false);
+  const copy = useCallback(() => {
+    navigator.clipboard.writeText(value);
+    setCopied(true);
+    setTimeout(() => setCopied(false), 2000);
+  }, [value]);
+
+  return (
+    <Button type="button" size={size} variant={variant} onClick={copy}>
+      {copied ? "Copied!" : label}
+    </Button>
+  );
+}
diff --git a/packages/web/src/components/dashboard/dashboard-renderer.tsx b/packages/web/src/components/dashboard/dashboard-renderer.tsx
new file mode 100644
index 00000000..fa2cdfae
--- /dev/null
+++ b/packages/web/src/components/dashboard/dashboard-renderer.tsx
@@ -0,0 +1,223 @@
+"use client";
+
+import { useMemo } from "react";
+import DataGrid from "react-data-grid";
+import "react-data-grid/lib/styles.css";
+import { Bar, BarChart, CartesianGrid, XAxis, YAxis } from "recharts";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import {
+  type ChartConfig,
+  ChartContainer,
+  ChartTooltip,
+  ChartTooltipContent,
+} from "@/components/ui/chart";
+import type { Aggregation, DashboardBlock, DashboardSpec, SnapshotRecord } from "@/lib/apps-client";
+
+const MAX_CHART_CATEGORIES = 12;
+
+function num(v: unknown): number | null {
+  if (typeof v === "number" && Number.isFinite(v)) return v;
+  if (typeof v === "string" && v.trim() !== "" && Number.isFinite(Number(v))) return Number(v);
+  return null;
+}
+
+function aggregate(records: SnapshotRecord[], field: string | undefined, agg: Aggregation): number {
+  if (agg === "count" || !field) return records.length;
+  const values = records.map((r) => num(r[field])).filter((v): v is number => v !== null);
+  if (values.length === 0) return 0;
+  switch (agg) {
+    case "sum":
+      return values.reduce((a, b) => a + b, 0);
+    case "avg":
+      return values.reduce((a, b) => a + b, 0) / values.length;
+    case "min":
+      return Math.min(...values);
+    case "max":
+      return Math.max(...values);
+    default:
+      return 0;
+  }
+}
+
+function formatNumber(n: number): string {
+  if (Number.isInteger(n)) return n.toLocaleString();
+  return n.toLocaleString(undefined, { maximumFractionDigits: 2 });
+}
+
+function KpiBlock({
+  block,
+  records,
+}: {
+  block: Extract<DashboardBlock, { type: "kpi" }>;
+  records: SnapshotRecord[];
+}) {
+  const value = aggregate(records, block.field, block.agg);
+  return (
+    <Card>
+      <CardHeader className="pb-2">
+        <CardTitle
+          className="text-xs font-medium uppercase tracking-wide"
+          style={{ color: "#7A6A5C" }}
+        >
+          {block.label}
+        </CardTitle>
+      </CardHeader>
+      <CardContent>
+        <div className="text-2xl font-semibold tabular-nums" style={{ color: "#201515" }}>
+          {formatNumber(value)}
+        </div>
+      </CardContent>
+    </Card>
+  );
+}
+
+function ChartBlock({
+  block,
+  records,
+}: {
+  block: Extract<DashboardBlock, { type: "chart" }>;
+  records: SnapshotRecord[];
+}) {
+  const data = useMemo(() => {
+    const groups = new Map<string, number>();
+    for (const r of records) {
+      const key = String(r[block.xField] ?? "—");
+      const add = block.agg === "count" ? 1 : (num(block.yField ? r[block.yField] : null) ?? 0);
+      groups.set(key, (groups.get(key) ?? 0) + add);
+    }
+    return [...groups.entries()]
+      .map(([label, value]) => ({ label, value }))
+      .sort((a, b) => b.value - a.value)
+      .slice(0, MAX_CHART_CATEGORIES);
+  }, [records, block.xField, block.yField, block.agg]);
+
+  const config: ChartConfig = {
+    value: { label: block.agg === "count" ? "Count" : block.yField, color: "#FF4F00" },
+  };
+
+  return (
+    <Card>
+      <CardHeader className="pb-2">
+        <CardTitle className="text-sm font-medium" style={{ color: "#201515" }}>
+          {block.label}
+        </CardTitle>
+      </CardHeader>
+      <CardContent>
+        {data.length === 0 ? (
+          <div className="text-sm" style={{ color: "#7A6A5C" }}>
+            No data to chart.
+          </div>
+        ) : (
+          <ChartContainer config={config} className="aspect-auto h-[280px] w-full">
+            <BarChart accessibilityLayer data={data} margin={{ left: 8, right: 8, top: 8 }}>
+              <CartesianGrid vertical={false} stroke="#FFE8D6" />
+              <XAxis
+                dataKey="label"
+                tickLine={false}
+                axisLine={false}
+                tickMargin={8}
+                tick={{ fontSize: 11, fill: "#7A6A5C" }}
+              />
+              <YAxis
+                tickLine={false}
+                axisLine={false}
+                width={36}
+                tick={{ fontSize: 11, fill: "#7A6A5C" }}
+              />
+              <ChartTooltip content={<ChartTooltipContent />} />
+              <Bar dataKey="value" fill="#FF4F00" radius={[4, 4, 0, 0]} isAnimationActive={false} />
+            </BarChart>
+          </ChartContainer>
+        )}
+      </CardContent>
+    </Card>
+  );
+}
+
+function TableBlock({
+  block,
+  records,
+}: {
+  block: Extract<DashboardBlock, { type: "table" }>;
+  records: SnapshotRecord[];
+}) {
+  const columns = useMemo(() => block.columns.map((c) => ({ key: c, name: c })), [block.columns]);
+  const rows = useMemo(
+    () =>
+      records.map((r, i) => {
+        const row: Record<string, string> = { __id: String(i) };
+        for (const c of block.columns) {
+          const v = r[c];
+          row[c] =
+            v === null || v === undefined
+              ? ""
+              : typeof v === "object"
+                ? JSON.stringify(v)
+                : String(v);
+        }
+        return row;
+      }),
+    [records, block.columns],
+  );
+
+  return (
+    <Card>
+      <CardHeader className="pb-2">
+        <CardTitle className="text-sm font-medium" style={{ color: "#201515" }}>
+          {block.label ?? "Records"}
+        </CardTitle>
+      </CardHeader>
+      <CardContent>
+        {rows.length === 0 ? (
+          <div className="text-sm" style={{ color: "#7A6A5C" }}>
+            No records.
+          </div>
+        ) : (
+          <div className="rounded-md border" style={{ borderColor: "#FFF3E6" }}>
+            <DataGrid
+              columns={columns}
+              rows={rows}
+              rowKeyGetter={(r) => r.__id}
+              rowHeight={35}
+              headerRowHeight={35}
+              defaultColumnOptions={{ resizable: true, minWidth: 140 }}
+              className="rdg-light"
+              style={{ blockSize: Math.min(460, 35 + (rows.length + 1) * 35) }}
+            />
+          </div>
+        )}
+      </CardContent>
+    </Card>
+  );
+}
+
+/** Content-stable key for a block (avoids index-as-key; blocks don't reorder). */
+function blockKey(b: DashboardBlock): string {
+  if (b.type === "kpi") return `kpi-${b.agg}-${b.field ?? "count"}-${b.label}`;
+  if (b.type === "chart") return `chart-${b.xField}-${b.yField ?? "count"}-${b.agg}`;
+  return `table-${b.columns.join(",")}`;
+}
+
+export function DashboardRenderer({ spec, data }: { spec: DashboardSpec; data: SnapshotRecord[] }) {
+  const kpis = spec.blocks.filter(
+    (b): b is Extract<DashboardBlock, { type: "kpi" }> => b.type === "kpi",
+  );
+  const rest = spec.blocks.filter((b) => b.type !== "kpi");
+
+  return (
+    <div className="space-y-6">
+      {kpis.length > 0 && (
+        <div className="grid grid-cols-2 gap-4 sm:grid-cols-3 lg:grid-cols-4">
+          {kpis.map((b) => (
+            <KpiBlock key={blockKey(b)} block={b} records={data} />
+          ))}
+        </div>
+      )}
+      {rest.map((b) => {
+        if (b.type === "chart") return <ChartBlock key={blockKey(b)} block={b} records={data} />;
+        if (b.type === "table") return <TableBlock key={blockKey(b)} block={b} records={data} />;
+        return null;
+      })}
+    </div>
+  );
+}
diff --git a/packages/web/src/components/dashboard/share-button.tsx b/packages/web/src/components/dashboard/share-button.tsx
new file mode 100644
index 00000000..5b57a4ab
--- /dev/null
+++ b/packages/web/src/components/dashboard/share-button.tsx
@@ -0,0 +1,67 @@
+"use client";
+
+import { useState } from "react";
+import { Button } from "@/components/ui/button";
+
+/**
+ * Mint (and copy) a public share link for a dashboard. POSTs through the
+ * `/api/apps/*` proxy, which injects the owner's Supabase JWT; the agent
+ * returns a token + the `/d/<token>` path that the public page serves.
+ */
+export function ShareButton({ artifactId }: { artifactId: string }) {
+  const [state, setState] = useState<"idle" | "loading" | "copied" | "error">("idle");
+  const [url, setUrl] = useState<string | null>(null);
+
+  async function share() {
+    setState("loading");
+    try {
+      const res = await fetch(`/api/apps/artifacts/${encodeURIComponent(artifactId)}/share`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: "{}",
+      });
+      if (!res.ok) throw new Error(`share → ${res.status}`);
+      const { url: path } = (await res.json()) as { url: string };
+      const absolute = `${window.location.origin}${path}`;
+      setUrl(absolute);
+      try {
+        await navigator.clipboard.writeText(absolute);
+        setState("copied");
+      } catch {
+        // Clipboard blocked (e.g. insecure context) — still surface the link.
+        setState("idle");
+      }
+    } catch {
+      setState("error");
+    }
+  }
+
+  return (
+    <div className="flex items-center gap-2">
+      <Button
+        type="button"
+        onClick={share}
+        disabled={state === "loading"}
+        variant="outline"
+        size="sm"
+      >
+        {state === "loading"
+          ? "Creating…"
+          : state === "copied"
+            ? "Link copied ✓"
+            : state === "error"
+              ? "Failed — retry"
+              : "Share"}
+      </Button>
+      {url && (
+        <input
+          readOnly
+          value={url}
+          onFocus={(e) => e.currentTarget.select()}
+          aria-label="Public share link"
+          className="w-72 max-w-full rounded-md border px-2 py-1 text-xs text-muted-foreground"
+        />
+      )}
+    </div>
+  );
+}
diff --git a/packages/web/src/components/docs-banner.tsx b/packages/web/src/components/docs-banner.tsx
index 75a1e585..6e69d713 100644
--- a/packages/web/src/components/docs-banner.tsx
+++ b/packages/web/src/components/docs-banner.tsx
@@ -48,7 +48,7 @@ export function DocsBanner() {
           filter: "saturate(2)",
         }}
       />
-      Foreman is in alpha — self-hostable today, cloud in beta.
+      Foreman is self-hostable today — cloud hosting in beta.
       <button
         type="button"
         aria-label="Dismiss banner"
diff --git a/packages/web/src/components/documents/documents-browser.tsx b/packages/web/src/components/documents/documents-browser.tsx
new file mode 100644
index 00000000..16373b38
--- /dev/null
+++ b/packages/web/src/components/documents/documents-browser.tsx
@@ -0,0 +1,226 @@
+"use client";
+
+import { CopyIcon, FileTextIcon, UploadIcon } from "lucide-react";
+import { useEffect, useRef, useState } from "react";
+import { MessageResponse } from "@/components/ai-elements/message";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import {
+  ContextMenu,
+  ContextMenuContent,
+  ContextMenuItem,
+  ContextMenuTrigger,
+} from "@/components/ui/context-menu";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import { Progress } from "@/components/ui/progress";
+import { Skeleton } from "@/components/ui/skeleton";
+import {
+  type DocumentMeta,
+  getDocument,
+  importDocument,
+  listDocuments,
+  spaceOfPath,
+} from "@/lib/documents-client";
+
+/** documents/q3-launch-plan.md → "Q3 Launch Plan" for display. */
+function docTitle(name: string): string {
+  return name
+    .replace(/\.md$/i, "")
+    .split("-")
+    .filter(Boolean)
+    .map((w) => w.charAt(0).toUpperCase() + w.slice(1))
+    .join(" ");
+}
+
+/**
+ * Browse the knowledge documents in the caller's ACTIVE workspace (foreman-iznn).
+ * listDocuments() resolves the active workspace server-side from the auth token,
+ * so this reflects whichever workspace you're currently in. Click a doc to read
+ * it. Shared docs are visible to the whole team; private docs are only yours.
+ */
+export function DocumentsBrowser() {
+  const [docs, setDocs] = useState<DocumentMeta[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState(false);
+  const [open, setOpen] = useState<{ path: string; title: string } | null>(null);
+  const [content, setContent] = useState<string | null>(null);
+  const [importing, setImporting] = useState(false);
+  const [importProgress, setImportProgress] = useState(0);
+  const [importErr, setImportErr] = useState<string | null>(null);
+  const fileInput = useRef<HTMLInputElement>(null);
+
+  // The import is a single request with no byte-level progress, so ease a bar
+  // toward ~90% while it's in flight; onPickFile snaps it to 100 on success
+  // (foreman-97mv).
+  useEffect(() => {
+    if (!importing) return;
+    setImportProgress((p) => (p < 10 ? 10 : p));
+    const id = setInterval(() => {
+      setImportProgress((p) => (p < 90 ? p + Math.max(1, (90 - p) * 0.12) : p));
+    }, 200);
+    return () => clearInterval(id);
+  }, [importing]);
+
+  function load() {
+    setLoading(true);
+    setError(false);
+    listDocuments()
+      .then(setDocs)
+      .catch(() => setError(true))
+      .finally(() => setLoading(false));
+  }
+
+  useEffect(() => {
+    load();
+  }, []);
+
+  function openDoc(doc: DocumentMeta) {
+    setOpen({ path: doc.path, title: docTitle(doc.name) });
+    setContent(null);
+    getDocument(doc.path)
+      .then((d) => setContent(d.content))
+      .catch(() => setContent("_Couldn't load this document._"));
+  }
+
+  async function onPickFile(e: React.ChangeEvent<HTMLInputElement>) {
+    const file = e.target.files?.[0];
+    e.target.value = ""; // allow re-importing the same filename
+    if (!file) return;
+    setImportErr(null);
+    if (file.size > 1_000_000) {
+      setImportErr("That file is too large (max ~1MB of text).");
+      return;
+    }
+    setImportProgress(0);
+    setImporting(true);
+    try {
+      const text = await file.text();
+      await importDocument(file.name, text);
+      setImportProgress(100);
+      load();
+    } catch {
+      setImportErr("Couldn't import that file. Make sure it's a text or markdown file.");
+    } finally {
+      setImporting(false);
+    }
+  }
+
+  const importControls = (
+    <div className="mb-3 flex flex-col gap-2">
+      <div className="flex items-center gap-3">
+        <Button disabled={importing} onClick={() => fileInput.current?.click()} size="sm">
+          <UploadIcon className="size-4" />
+          {importing ? "Importing…" : "Import file"}
+        </Button>
+        <span className="text-muted-foreground text-xs">Markdown or text files (.md, .txt)</span>
+        <input
+          accept=".md,.markdown,.txt,.text,text/markdown,text/plain"
+          className="hidden"
+          onChange={onPickFile}
+          ref={fileInput}
+          type="file"
+        />
+      </div>
+      {importing && <Progress className="h-1.5 max-w-xs" value={importProgress} />}
+    </div>
+  );
+
+  if (loading)
+    return (
+      <>
+        {importControls}
+        <div className="flex flex-col gap-1">
+          {[0, 1, 2, 3].map((i) => (
+            <Skeleton className="h-[42px] rounded-md" key={i} />
+          ))}
+        </div>
+      </>
+    );
+  if (error)
+    return <p className="text-destructive text-sm">Couldn't load your documents. Try again.</p>;
+
+  if (docs.length === 0) {
+    return (
+      <>
+        {importControls}
+        {importErr && <p className="mb-3 text-destructive text-sm">{importErr}</p>}
+        <div className="rounded-lg border border-dashed p-8 text-center">
+          <FileTextIcon className="mx-auto mb-2 size-6 text-muted-foreground" />
+          <p className="font-medium text-sm">No documents yet</p>
+          <p className="mt-1 text-muted-foreground text-sm">
+            Import a markdown/text file above, or in a chat ask Foreman to save one — e.g. “save a
+            document titled Onboarding with these notes…”.
+          </p>
+        </div>
+      </>
+    );
+  }
+
+  return (
+    <>
+      {importControls}
+      {importErr && <p className="mb-3 text-destructive text-sm">{importErr}</p>}
+      <div className="flex flex-col gap-1">
+        {docs.map((doc) => (
+          <ContextMenu key={doc.path}>
+            <ContextMenuTrigger asChild>
+              <button
+                className="flex items-center justify-between gap-3 rounded-md border px-3 py-2.5 text-left text-sm transition-colors hover:bg-accent"
+                onClick={() => openDoc(doc)}
+                type="button"
+              >
+                <span className="flex min-w-0 items-center gap-2">
+                  <FileTextIcon className="size-4 shrink-0 text-muted-foreground" />
+                  <span className="truncate font-medium">{docTitle(doc.name)}</span>
+                </span>
+                <Badge variant={spaceOfPath(doc.path) === "personal" ? "outline" : "secondary"}>
+                  {spaceOfPath(doc.path) === "personal" ? "Private" : "Shared"}
+                </Badge>
+              </button>
+            </ContextMenuTrigger>
+            <ContextMenuContent className="w-40">
+              <ContextMenuItem className="cursor-pointer" onSelect={() => openDoc(doc)}>
+                <FileTextIcon className="size-4" />
+                <span>Open</span>
+              </ContextMenuItem>
+              <ContextMenuItem
+                className="cursor-pointer"
+                onSelect={() => navigator.clipboard?.writeText(doc.path)}
+              >
+                <CopyIcon className="size-4" />
+                <span>Copy path</span>
+              </ContextMenuItem>
+            </ContextMenuContent>
+          </ContextMenu>
+        ))}
+      </div>
+
+      <Dialog onOpenChange={(o) => !o && setOpen(null)} open={open !== null}>
+        <DialogContent className="max-h-[80vh] overflow-y-auto sm:max-w-2xl">
+          <DialogHeader>
+            <DialogTitle>{open?.title}</DialogTitle>
+            <DialogDescription className="sr-only">Document contents</DialogDescription>
+          </DialogHeader>
+          {content === null ? (
+            <div className="flex flex-col gap-2">
+              <Skeleton className="h-4 w-2/3" />
+              <Skeleton className="h-4 w-full" />
+              <Skeleton className="h-4 w-full" />
+              <Skeleton className="h-4 w-4/5" />
+            </div>
+          ) : (
+            <div className="prose-sm max-w-none">
+              <MessageResponse>{content}</MessageResponse>
+            </div>
+          )}
+        </DialogContent>
+      </Dialog>
+    </>
+  );
+}
diff --git a/packages/web/src/components/editor/agent-list-view.tsx b/packages/web/src/components/editor/agent-list-view.tsx
index 3ce8a765..13f8a65a 100644
--- a/packages/web/src/components/editor/agent-list-view.tsx
+++ b/packages/web/src/components/editor/agent-list-view.tsx
@@ -15,6 +15,14 @@ import {
   DialogHeader,
   DialogTitle,
 } from "@/components/ui/dialog";
+import {
+  Empty,
+  EmptyContent,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyMedia,
+  EmptyTitle,
+} from "@/components/ui/empty";
 import { Input } from "@/components/ui/input";
 import { Textarea } from "@/components/ui/textarea";
 import { createClient } from "@/lib/client";
@@ -100,18 +108,24 @@ export function AgentListView() {
 
 function EmptyState({ onCreate }: { onCreate: () => void }) {
   return (
-    <div className="rounded-xl border border-dashed border-border p-12 text-center">
-      <BotIcon className="mx-auto mb-3 size-8 text-muted-foreground" />
-      <h2 className="text-base font-medium">No agents yet</h2>
-      <p className="mx-auto mt-1 max-w-sm text-sm text-muted-foreground">
-        Create your first agent to define instructions, pick tools, and publish versions you can
-        reference elsewhere.
-      </p>
-      <Button variant="accent" onClick={onCreate} className="mt-4 gap-2">
-        <PlusIcon className="size-4" />
-        New agent
-      </Button>
-    </div>
+    <Empty className="border border-border">
+      <EmptyHeader>
+        <EmptyMedia variant="icon">
+          <BotIcon />
+        </EmptyMedia>
+        <EmptyTitle>No agents yet</EmptyTitle>
+        <EmptyDescription>
+          Create your first agent to define instructions, pick tools, and publish versions you can
+          reference elsewhere.
+        </EmptyDescription>
+      </EmptyHeader>
+      <EmptyContent>
+        <Button variant="accent" onClick={onCreate} className="gap-2">
+          <PlusIcon className="size-4" />
+          New agent
+        </Button>
+      </EmptyContent>
+    </Empty>
   );
 }
 
diff --git a/packages/web/src/components/editor/editor-shell.tsx b/packages/web/src/components/editor/editor-shell.tsx
index cdc85700..f8f172c0 100644
--- a/packages/web/src/components/editor/editor-shell.tsx
+++ b/packages/web/src/components/editor/editor-shell.tsx
@@ -21,7 +21,7 @@ export function EditorShell({
   };
 
   return (
-    <div className="flex h-dvh w-full bg-background text-foreground">
+    <div className="flex h-full min-h-0 w-full flex-1 bg-background text-foreground">
       <aside className="hidden w-64 shrink-0 flex-col border-r border-border bg-surface md:flex">
         <div className="flex items-center justify-between border-b border-border px-4 py-3">
           <Link href="/editor" className="flex items-center gap-2 text-sm font-semibold">
diff --git a/packages/web/src/components/editor/editor-sidebar-agents.tsx b/packages/web/src/components/editor/editor-sidebar-agents.tsx
index 680f5c9f..197147b2 100644
--- a/packages/web/src/components/editor/editor-sidebar-agents.tsx
+++ b/packages/web/src/components/editor/editor-sidebar-agents.tsx
@@ -3,6 +3,7 @@
 import Link from "next/link";
 import { useParams } from "next/navigation";
 import useSWR from "swr";
+import { Badge } from "@/components/ui/badge";
 import { createClient } from "@/lib/client";
 import { type StoredAgent, storedAgentsApi } from "@/lib/stored-agents-client";
 import { cn } from "@/lib/utils";
@@ -60,10 +61,14 @@ function AgentBadge({ agent }: { agent: StoredAgent }) {
   if (!latest) return null;
   if (latest.is_draft) {
     return (
-      <span className="ml-2 shrink-0 rounded border border-border px-1.5 py-0.5 text-[10px] text-muted-foreground">
+      <Badge variant="outline" className="ml-2">
         draft
-      </span>
+      </Badge>
     );
   }
-  return <span className="ml-2 shrink-0 text-[10px] text-muted-foreground">v{latest.version}</span>;
+  return (
+    <Badge variant="outline" className="ml-2">
+      v{latest.version}
+    </Badge>
+  );
 }
diff --git a/packages/web/src/components/editor/tools-picker.tsx b/packages/web/src/components/editor/tools-picker.tsx
index 061577cd..8a9877b4 100644
--- a/packages/web/src/components/editor/tools-picker.tsx
+++ b/packages/web/src/components/editor/tools-picker.tsx
@@ -1,9 +1,11 @@
 "use client";
 
-import { SearchIcon, ShieldAlertIcon, ShieldCheckIcon, WrenchIcon } from "lucide-react";
+import { SearchIcon, ShieldAlertIcon, ShieldCheckIcon, WrenchIcon, XIcon } from "lucide-react";
 import { useMemo, useState } from "react";
 import useSWR from "swr";
 import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import { Checkbox } from "@/components/ui/checkbox";
 import { Input } from "@/components/ui/input";
 import { createClient } from "@/lib/client";
 import { type CatalogTool, storedAgentsApi } from "@/lib/stored-agents-client";
@@ -129,16 +131,18 @@ export function ToolsPicker({ selected, onChange, disabled }: ToolsPickerProps)
                 </p>
                 <div className="flex flex-wrap gap-2">
                   {orphans.map((id) => (
-                    <button
+                    <Button
                       key={id}
                       type="button"
+                      variant="outline"
+                      size="xs"
                       onClick={() => toggle(id)}
                       disabled={disabled}
-                      className="inline-flex items-center gap-1 rounded-full border border-border px-2 py-0.5 text-xs hover:border-destructive hover:text-destructive disabled:opacity-50"
+                      className="hover:border-destructive hover:text-destructive"
                     >
                       {id}
-                      <span aria-hidden>×</span>
-                    </button>
+                      <XIcon aria-hidden />
+                    </Button>
                   ))}
                 </div>
               </div>
@@ -189,18 +193,19 @@ function Group({
           return (
             <li key={t.id}>
               <label
+                htmlFor={`tool-${t.id}`}
                 className={cn(
                   "flex cursor-pointer items-start gap-2.5 rounded-md px-2 py-1.5 transition-colors",
                   checked ? "bg-accent/5" : "hover:bg-surface",
                   disabled && "cursor-not-allowed opacity-60",
                 )}
               >
-                <input
-                  type="checkbox"
+                <Checkbox
+                  id={`tool-${t.id}`}
                   checked={checked}
                   disabled={disabled}
-                  onChange={() => onToggle(t.id)}
-                  className="mt-0.5 size-3.5 accent-accent"
+                  onCheckedChange={() => onToggle(t.id)}
+                  className="mt-0.5"
                 />
                 <div className="min-w-0 flex-1">
                   <div className="flex items-center gap-1.5">
diff --git a/packages/web/src/components/editor/version-history-panel.tsx b/packages/web/src/components/editor/version-history-panel.tsx
index c457eb43..e1254658 100644
--- a/packages/web/src/components/editor/version-history-panel.tsx
+++ b/packages/web/src/components/editor/version-history-panel.tsx
@@ -1,6 +1,7 @@
 "use client";
 
 import { RotateCcwIcon } from "lucide-react";
+import { Badge } from "@/components/ui/badge";
 import type { StoredAgentVersion } from "@/lib/stored-agents-client";
 import { cn } from "@/lib/utils";
 
@@ -49,17 +50,11 @@ export function VersionHistoryPanel({
                   <div className="flex items-center gap-1.5">
                     <span className="font-mono text-xs font-semibold">v{v.version}</span>
                     {v.is_draft ? (
-                      <span className="rounded-sm bg-muted/20 px-1 py-0.5 text-[10px] text-muted-foreground">
-                        draft
-                      </span>
+                      <Badge variant="outline">draft</Badge>
                     ) : isCurrent ? (
-                      <span className="rounded-sm bg-accent/10 px-1 py-0.5 text-[10px] text-accent">
-                        published
-                      </span>
+                      <Badge variant="accent">published</Badge>
                     ) : (
-                      <span className="rounded-sm bg-muted/10 px-1 py-0.5 text-[10px] text-muted-foreground">
-                        archived
-                      </span>
+                      <Badge variant="outline">archived</Badge>
                     )}
                   </div>
                   <div className="mt-0.5 truncate text-[11px] text-muted-foreground">
diff --git a/packages/web/src/components/forgot-password-form.tsx b/packages/web/src/components/forgot-password-form.tsx
index b41ff439..4465723d 100644
--- a/packages/web/src/components/forgot-password-form.tsx
+++ b/packages/web/src/components/forgot-password-form.tsx
@@ -2,9 +2,10 @@
 
 import Link from "next/link";
 import { useState } from "react";
+import { Alert, AlertDescription } from "@/components/ui/alert";
 import { Button } from "@/components/ui/button";
+import { Field, FieldLabel } from "@/components/ui/field";
 import { Input } from "@/components/ui/input";
-import { Label } from "@/components/ui/label";
 import { createClient } from "@/lib/client";
 
 export function ForgotPasswordForm() {
@@ -62,10 +63,10 @@ export function ForgotPasswordForm() {
       </div>
 
       <form onSubmit={handleForgotPassword} className="space-y-5">
-        <div className="space-y-1.5">
-          <Label htmlFor="email" className="text-sm font-medium">
+        <Field>
+          <FieldLabel htmlFor="email" className="text-sm font-medium">
             Email
-          </Label>
+          </FieldLabel>
           <Input
             id="email"
             type="email"
@@ -76,12 +77,12 @@ export function ForgotPasswordForm() {
             onChange={(e) => setEmail(e.target.value)}
             className="h-10 rounded-md"
           />
-        </div>
+        </Field>
 
         {error && (
-          <p className="text-sm text-red-500 bg-red-500/5 border border-red-500/20 rounded-md px-3 py-2">
-            {error}
-          </p>
+          <Alert variant="destructive">
+            <AlertDescription>{error}</AlertDescription>
+          </Alert>
         )}
 
         <Button
diff --git a/packages/web/src/components/landing/demos/automations-demo.tsx b/packages/web/src/components/landing/demos/automations-demo.tsx
new file mode 100644
index 00000000..e98560ee
--- /dev/null
+++ b/packages/web/src/components/landing/demos/automations-demo.tsx
@@ -0,0 +1,180 @@
+"use client";
+
+import { AnimatePresence, motion, useInView } from "motion/react";
+import { useEffect, useRef, useState } from "react";
+import { Check, Sparkles } from "@/components/icons/hi";
+
+type RunStatus = "started" | "finished" | "failed";
+
+const STATIC_RUNS: Array<{
+  id: string;
+  label: string;
+  when: string;
+  status: RunStatus;
+  detail: string;
+}> = [
+  {
+    id: "r2",
+    label: "Stripe payment → Slack + Sheet",
+    when: "2m ago",
+    status: "finished",
+    detail: '{ "posted": "#finance", "row": 1182 }',
+  },
+  {
+    id: "r3",
+    label: "New GitHub issue → Linear + #bugs",
+    when: "6m ago",
+    status: "finished",
+    detail: '{ "ticket": "ENG-412", "posted": true }',
+  },
+  {
+    id: "r4",
+    label: "Failed charge → dunning email",
+    when: "11m ago",
+    status: "failed",
+    detail: 'Step "charge" exhausted all retries',
+  },
+  {
+    id: "r5",
+    label: "Typeform lead → Airtable + welcome",
+    when: "18m ago",
+    status: "finished",
+    detail: '{ "record": "recA9f2", "email": "sent" }',
+  },
+  {
+    id: "r6",
+    label: "Calendar invite → prep brief in Notion",
+    when: "32m ago",
+    status: "finished",
+    detail: '{ "page": "Prep · Q3 review" }',
+  },
+];
+
+function StatusBadge({ status }: { status: RunStatus }) {
+  if (status === "finished") {
+    return (
+      <span className="inline-flex items-center gap-1 rounded-full border border-green-500/20 bg-green-500/10 px-2 py-0.5 text-[10px] font-medium text-green-700 dark:text-green-400">
+        <Check className="h-2.5 w-2.5" /> finished
+      </span>
+    );
+  }
+  if (status === "failed") {
+    return (
+      <span className="inline-flex items-center rounded-full border border-destructive/20 bg-destructive/10 px-2 py-0.5 text-[10px] font-medium text-destructive">
+        failed
+      </span>
+    );
+  }
+  return (
+    <span className="inline-flex items-center gap-1 rounded-full border border-accent/20 bg-accent/10 px-2 py-0.5 text-[10px] font-medium text-accent">
+      <span className="h-1.5 w-1.5 rounded-full bg-accent animate-pulse" /> started
+    </span>
+  );
+}
+
+export function AutomationsDemo() {
+  const ref = useRef<HTMLDivElement>(null);
+  const inView = useInView(ref, { amount: 0.4, once: false });
+  const [live, setLive] = useState<RunStatus>("started");
+  const [elapsed, setElapsed] = useState(0.4);
+
+  // Loop the top run started -> finished so the "live" reconcile is visible,
+  // mirroring the real /automations poll (foreman-j3um). Pauses off-screen.
+  useEffect(() => {
+    if (!inView) return;
+    let t = 0; // ms into the cycle
+    const id = setInterval(() => {
+      t += 100;
+      if (t <= 2600) {
+        setLive("started");
+        setElapsed(t / 1000);
+      } else if (t < 5200) {
+        setLive("finished");
+      } else {
+        t = 0;
+        setElapsed(0);
+      }
+    }, 100);
+    return () => clearInterval(id);
+  }, [inView]);
+
+  return (
+    <div ref={ref} className="overflow-hidden rounded-xl border border-border bg-surface shadow-sm">
+      {/* Header */}
+      <div className="flex items-center justify-between gap-3 border-b border-border px-4 py-2.5">
+        <div className="flex items-center gap-2">
+          <Sparkles className="h-3.5 w-3.5 text-accent" />
+          <span className="text-xs font-semibold">Automations</span>
+        </div>
+        <span className="rounded-full border border-border px-2 py-0.5 text-[10px] uppercase tracking-wider text-muted-foreground">
+          6 active
+        </span>
+      </div>
+
+      {/* Runs */}
+      <div className="space-y-2 p-3">
+        <AnimatePresence initial={false} mode="wait">
+          {live === "started" && (
+            <motion.p
+              key="live-hint"
+              initial={{ opacity: 0 }}
+              animate={{ opacity: 1 }}
+              exit={{ opacity: 0 }}
+              className="flex items-center gap-1.5 px-1 text-[11px] text-muted-foreground"
+            >
+              <span className="h-2.5 w-2.5 rounded-full border-2 border-accent/30 border-t-accent animate-spin" />
+              Live — updating as runs complete…
+            </motion.p>
+          )}
+        </AnimatePresence>
+
+        {/* Live run row */}
+        <div className="rounded-lg border border-border bg-background px-3 py-2">
+          <div className="flex items-center justify-between gap-2">
+            <span className="truncate text-xs font-medium">Form → HubSpot + welcome email</span>
+            <div className="flex items-center gap-2">
+              <span className="font-mono text-[10px] tabular-nums text-muted-foreground">
+                {elapsed.toFixed(1)}s
+              </span>
+              <StatusBadge status={live} />
+            </div>
+          </div>
+          <AnimatePresence initial={false}>
+            {live === "finished" && (
+              <motion.pre
+                key="out"
+                initial={{ opacity: 0, height: 0 }}
+                animate={{ opacity: 1, height: "auto" }}
+                exit={{ opacity: 0, height: 0 }}
+                transition={{ duration: 0.25, ease: [0.2, 0, 0, 1] }}
+                className="mt-2 overflow-hidden rounded-md bg-muted px-2.5 py-1.5 font-mono text-[10px] leading-relaxed text-muted-foreground"
+              >
+                {'{ "contact": "created", "email": "sent" }'}
+              </motion.pre>
+            )}
+          </AnimatePresence>
+        </div>
+
+        {/* Static context rows */}
+        {STATIC_RUNS.map((r) => (
+          <div key={r.id} className="rounded-lg border border-border/70 bg-background px-3 py-2">
+            <div className="flex items-center justify-between gap-2">
+              <span className="truncate text-xs font-medium">{r.label}</span>
+              <div className="flex items-center gap-2">
+                <span className="text-[10px] text-muted-foreground">{r.when}</span>
+                <StatusBadge status={r.status} />
+              </div>
+            </div>
+            <p
+              className={`mt-1 truncate font-mono text-[10px] ${
+                r.status === "failed" ? "text-destructive/80" : "text-muted-foreground"
+              }`}
+            >
+              {r.detail}
+            </p>
+          </div>
+        ))}
+      </div>
+    </div>
+  );
+}
diff --git a/packages/web/src/components/landing/demos/five-things.tsx b/packages/web/src/components/landing/demos/five-things.tsx
index df46a135..153cea86 100644
--- a/packages/web/src/components/landing/demos/five-things.tsx
+++ b/packages/web/src/components/landing/demos/five-things.tsx
@@ -202,6 +202,7 @@ export function FiveThingsReplay() {
             <button
               key={s.id}
               type="button"
+              aria-pressed={selected}
               onClick={() => setActiveId(s.id)}
               className={`w-full text-left px-4 py-3.5 flex items-start gap-3 border-b border-border last:border-b-0 transition-colors min-h-[44px] ${
                 selected ? "bg-accent/5" : "hover:bg-background"
@@ -291,9 +292,14 @@ export function FiveThingsReplay() {
                   )}
                   {msg.role === "thinking" && (
                     <div className="flex items-center gap-2">
-                      <div className="h-7 w-7 rounded-full bg-accent/15 text-accent flex items-center justify-center text-xs font-bold">
-                        F
-                      </div>
+                      {/* biome-ignore lint/performance/noImgElement: small static brand asset, next/image is overkill */}
+                      <img
+                        alt="Foreman"
+                        className="h-7 w-7 object-contain"
+                        height={28}
+                        src="/zapier.svg"
+                        width={28}
+                      />
                       <div className="rounded-2xl rounded-bl-sm bg-background border border-border px-4 py-2.5 flex items-center gap-1">
                         <span className="typing-dot h-1.5 w-1.5 rounded-full bg-muted" />
                         <span className="typing-dot h-1.5 w-1.5 rounded-full bg-muted" />
@@ -343,9 +349,14 @@ export function FiveThingsReplay() {
                   )}
                   {msg.role === "sent" && (
                     <div className="flex items-center gap-2">
-                      <div className="h-7 w-7 rounded-full bg-accent/15 text-accent flex items-center justify-center text-xs font-bold">
-                        F
-                      </div>
+                      {/* biome-ignore lint/performance/noImgElement: small static brand asset, next/image is overkill */}
+                      <img
+                        alt="Foreman"
+                        className="h-7 w-7 object-contain"
+                        height={28}
+                        src="/zapier.svg"
+                        width={28}
+                      />
                       <div className="rounded-2xl rounded-bl-sm bg-green-500/10 text-green-700 dark:text-green-400 border border-green-500/20 px-4 py-2 text-sm flex items-center gap-2">
                         <Check className="h-4 w-4" />
                         {msg.text}
diff --git a/packages/web/src/components/landing/demos/guardrail-cards.tsx b/packages/web/src/components/landing/demos/guardrail-cards.tsx
index f2f878a0..a8ba97d1 100644
--- a/packages/web/src/components/landing/demos/guardrail-cards.tsx
+++ b/packages/web/src/components/landing/demos/guardrail-cards.tsx
@@ -137,6 +137,7 @@ export function GuardrailCards() {
               >
                 <button
                   type="button"
+                  aria-pressed={selected}
                   onClick={() => setActiveId(g.id)}
                   className={`w-full h-full text-left rounded-xl border p-4 transition-all duration-200 ${
                     selected
diff --git a/packages/web/src/components/landing/demos/reasoning-trace.tsx b/packages/web/src/components/landing/demos/reasoning-trace.tsx
index b2549a26..b81925fa 100644
--- a/packages/web/src/components/landing/demos/reasoning-trace.tsx
+++ b/packages/web/src/components/landing/demos/reasoning-trace.tsx
@@ -30,7 +30,7 @@ const SCENES: Scene[] = [
       { tool: "search-history", args: '"priya email"', result: "priya@acme.com", elapsedMs: 140 },
       { tool: "search-actions", args: '"email"', result: "gmail · send-email", elapsedMs: 96 },
       {
-        tool: "list-input-fields",
+        tool: "list-action-input-fields",
         args: "send-email",
         result: "to · cc · subject · body · attachment",
         elapsedMs: 71,
@@ -62,19 +62,19 @@ const SCENES: Scene[] = [
         elapsedMs: 88,
       },
       {
-        tool: "list-input-fields",
+        tool: "list-action-input-fields",
         args: "create-card",
         result: "board · list · name · description",
         elapsedMs: 60,
       },
       {
-        tool: "list-input-field-choices",
+        tool: "list-action-input-field-choices",
         args: "board",
         result: "Personal · Engineering · Roadmap",
         elapsedMs: 134,
       },
       {
-        tool: "list-input-field-choices",
+        tool: "list-action-input-field-choices",
         args: 'list (board="Engineering")',
         result: "Inbox · In Progress · Done",
         elapsedMs: 102,
@@ -96,7 +96,7 @@ const SCENES: Scene[] = [
         elapsedMs: 312,
       },
       {
-        tool: "list-input-field-choices",
+        tool: "list-action-input-field-choices",
         args: "expand",
         result: "line_items (2), customer, charge",
         elapsedMs: 68,
diff --git a/packages/web/src/components/landing/demos/tilt-card.tsx b/packages/web/src/components/landing/demos/tilt-card.tsx
deleted file mode 100644
index 29282d28..00000000
--- a/packages/web/src/components/landing/demos/tilt-card.tsx
+++ /dev/null
@@ -1,74 +0,0 @@
-"use client";
-
-import {
-  motion,
-  useMotionTemplate,
-  useMotionValue,
-  useReducedMotion,
-  useSpring,
-  useTransform,
-} from "motion/react";
-import type { MouseEvent, ReactNode } from "react";
-import { useRef } from "react";
-
-export function TiltCard({
-  children,
-  className = "",
-  max = 6,
-}: {
-  children: ReactNode;
-  className?: string;
-  max?: number;
-}) {
-  const ref = useRef<HTMLDivElement>(null);
-  const reduce = useReducedMotion();
-  const rotateX = useMotionValue(0);
-  const rotateY = useMotionValue(0);
-  const springX = useSpring(rotateX, { stiffness: 200, damping: 20 });
-  const springY = useSpring(rotateY, { stiffness: 200, damping: 20 });
-  const glareX = useTransform(springY, [-max, max], [0, 100]);
-  const glareY = useTransform(springX, [max, -max], [100, 0]);
-  const glareBg = useMotionTemplate`radial-gradient(circle at ${glareX}% ${glareY}%, rgba(255,255,255,0.12), transparent 50%)`;
-
-  function handleMouseMove(e: MouseEvent<HTMLDivElement>) {
-    if (reduce || !ref.current) return;
-    const rect = ref.current.getBoundingClientRect();
-    const px = (e.clientX - rect.left) / rect.width;
-    const py = (e.clientY - rect.top) / rect.height;
-    rotateY.set((px - 0.5) * 2 * max);
-    rotateX.set(-(py - 0.5) * 2 * max);
-  }
-
-  function reset() {
-    rotateX.set(0);
-    rotateY.set(0);
-  }
-
-  return (
-    <motion.div
-      ref={ref}
-      onMouseMove={handleMouseMove}
-      onMouseLeave={reset}
-      style={
-        reduce
-          ? {}
-          : {
-              rotateX: springX,
-              rotateY: springY,
-              transformStyle: "preserve-3d",
-              transformPerspective: 1000,
-            }
-      }
-      className={`relative ${className}`}
-    >
-      {children}
-      {!reduce && (
-        <motion.div
-          aria-hidden
-          style={{ background: glareBg }}
-          className="absolute inset-0 pointer-events-none rounded-[inherit]"
-        />
-      )}
-    </motion.div>
-  );
-}
diff --git a/packages/web/src/components/landing/demos/tool-discovery.tsx b/packages/web/src/components/landing/demos/tool-discovery.tsx
index 7cece49f..688ec7a6 100644
--- a/packages/web/src/components/landing/demos/tool-discovery.tsx
+++ b/packages/web/src/components/landing/demos/tool-discovery.tsx
@@ -166,7 +166,7 @@ export function ToolDiscovery() {
 
       {/* Tool chips */}
       <div className="p-4 sm:p-5 border-t border-border bg-background/50">
-        <div className="grid grid-cols-3 sm:grid-cols-4 md:grid-cols-5 lg:grid-cols-6 gap-1.5">
+        <div className="grid grid-cols-2 sm:grid-cols-4 md:grid-cols-5 lg:grid-cols-6 gap-1.5">
           {ALL_TOOLS.map((tool) => {
             const matched = prompt.matches.includes(tool);
             const visible = phase !== "typing" && matched;
@@ -174,7 +174,7 @@ export function ToolDiscovery() {
               <motion.div
                 key={tool}
                 animate={{
-                  opacity: phase === "typing" ? 0.45 : visible ? 1 : 0.35,
+                  opacity: phase === "typing" ? 0.65 : visible ? 1 : 0.6,
                   scale: visible && phase === "loaded" ? 1 : 0.96,
                 }}
                 transition={{
@@ -184,7 +184,7 @@ export function ToolDiscovery() {
                 className={`relative rounded-md px-2 py-1.5 text-[10px] sm:text-[11px] font-mono border truncate cursor-default transition-colors hover:border-accent/40 hover:text-accent ${
                   visible
                     ? "bg-accent/10 border-accent/30 text-accent font-medium"
-                    : "bg-background border-border/60 text-foreground/50"
+                    : "bg-background border-border text-foreground/70"
                 }`}
               >
                 {tool}
diff --git a/packages/web/src/components/landing/demos/workflow-extraction.tsx b/packages/web/src/components/landing/demos/workflow-extraction.tsx
deleted file mode 100644
index 0ce8cb89..00000000
--- a/packages/web/src/components/landing/demos/workflow-extraction.tsx
+++ /dev/null
@@ -1,374 +0,0 @@
-"use client";
-
-import { AnimatePresence, motion, useInView } from "motion/react";
-import { useEffect, useRef, useState } from "react";
-import { Check, ChevronRight, GitBranch, Play, Sparkles } from "@/components/icons/hi";
-import { TiltedSpotlight } from "@/components/landing/tilted-spotlight";
-
-type Phase = "chat" | "highlight" | "extracting" | "extracted" | "running" | "done";
-
-type Scenario = {
-  id: string;
-  convoId: string;
-  name: string;
-  chat: Array<{ role: "user" | "agent"; text: string }>;
-  steps: Array<{ app: string; action: string }>;
-  runTime: string;
-};
-
-const SCENARIOS: Scenario[] = [
-  {
-    id: "standup",
-    convoId: "#4,821",
-    name: "Monday standup",
-    chat: [
-      {
-        role: "user",
-        text: "Every Monday, email the team standup link and create a Linear issue for blockers.",
-      },
-      { role: "agent", text: "Got it. Sending the standup email now…" },
-      { role: "agent", text: "Sent. And created LIN-4821 for blockers." },
-    ],
-    steps: [
-      { app: "Gmail", action: "Send email · Team standup link" },
-      { app: "Linear", action: "Create issue · Blockers" },
-    ],
-    runTime: "4.2s",
-  },
-  {
-    id: "onboard",
-    convoId: "#4,862",
-    name: "New customer onboarding",
-    chat: [
-      {
-        role: "user",
-        text: "When a customer signs up in Stripe, add them to Notion CRM and send the welcome email.",
-      },
-      { role: "agent", text: "Watching Stripe for new customers…" },
-      { role: "agent", text: "Added Acme Corp to CRM. Welcome email sent." },
-    ],
-    steps: [
-      { app: "Stripe", action: "Watch · New customer" },
-      { app: "Notion", action: "Create page · CRM entry" },
-      { app: "Gmail", action: "Send email · Welcome template" },
-    ],
-    runTime: "3.1s",
-  },
-  {
-    id: "sprint-end",
-    convoId: "#4,903",
-    name: "Sprint cleanup",
-    chat: [
-      {
-        role: "user",
-        text: "End of sprint: close done Linear tickets, post a summary to #general, schedule the retro.",
-      },
-      { role: "agent", text: "Closing 14 tickets marked Done…" },
-      { role: "agent", text: "Posted summary to #general. Retro scheduled Friday 2pm." },
-    ],
-    steps: [
-      { app: "Linear", action: "Close · 14 done tickets" },
-      { app: "Slack", action: "Post · #general summary" },
-      { app: "Google Calendar", action: "Schedule · Sprint retro" },
-    ],
-    runTime: "5.8s",
-  },
-  {
-    id: "weekly-wins",
-    convoId: "#4,947",
-    name: "Friday wins report",
-    chat: [
-      {
-        role: "user",
-        text: "Every Friday afternoon, post this week's wins to Slack and export the metrics to Google Sheets.",
-      },
-      { role: "agent", text: "Pulling this week's wins from Linear and GitHub…" },
-      { role: "agent", text: "Posted to #wins. Metrics exported to the Q3 sheet." },
-    ],
-    steps: [
-      { app: "Linear", action: "Query · Done this week" },
-      { app: "GitHub", action: "Query · Merged PRs" },
-      { app: "Slack", action: "Post · #wins summary" },
-      { app: "Google Sheets", action: "Append rows · Metrics" },
-    ],
-    runTime: "7.4s",
-  },
-];
-
-export function WorkflowExtraction() {
-  const ref = useRef<HTMLDivElement>(null);
-  const inView = useInView(ref, { amount: 0.3, once: false });
-  const [scenarioIdx, setScenarioIdx] = useState(0);
-  const [phase, setPhase] = useState<Phase>("chat");
-  const [runStep, setRunStep] = useState(-1);
-
-  const scenario = SCENARIOS[scenarioIdx];
-
-  useEffect(() => {
-    if (!inView) return;
-
-    const sequence: { phase: Phase; delay: number }[] = [
-      { phase: "chat", delay: 2400 },
-      { phase: "highlight", delay: 1400 },
-      { phase: "extracting", delay: 1100 },
-      { phase: "extracted", delay: 1400 },
-      { phase: "running", delay: 2600 + scenario.steps.length * 200 },
-      { phase: "done", delay: 1800 },
-    ];
-
-    let i = 0;
-    let timeout: ReturnType<typeof setTimeout>;
-    const runTimers: ReturnType<typeof setTimeout>[] = [];
-
-    const advance = () => {
-      const step = sequence[i];
-      setPhase(step.phase);
-
-      if (step.phase === "running") {
-        setRunStep(-1);
-        for (let s = 0; s < scenario.steps.length; s++) {
-          runTimers.push(setTimeout(() => setRunStep(s), 300 + s * 800));
-        }
-        runTimers.push(
-          setTimeout(() => setRunStep(scenario.steps.length), 300 + scenario.steps.length * 800),
-        );
-      }
-      if (step.phase === "chat") setRunStep(-1);
-
-      timeout = setTimeout(() => {
-        i++;
-        if (i >= sequence.length) {
-          // cycle to the next scenario after the full loop
-          i = 0;
-          setScenarioIdx((idx) => (idx + 1) % SCENARIOS.length);
-        }
-        advance();
-      }, step.delay);
-    };
-
-    advance();
-    return () => {
-      clearTimeout(timeout);
-      runTimers.forEach(clearTimeout);
-    };
-  }, [inView, scenarioIdx, scenario.steps.length]);
-
-  const highlighted = phase === "highlight" || phase === "extracting";
-
-  return (
-    <div ref={ref} className="grid md:grid-cols-2 gap-4">
-      {/* Chat column */}
-      <TiltedSpotlight>
-        <div className="rounded-2xl border border-border bg-surface overflow-hidden">
-          <div className="px-4 py-3 border-b border-border flex items-center justify-between gap-2">
-            <AnimatePresence mode="wait">
-              <motion.span
-                key={scenario.convoId}
-                initial={{ opacity: 0 }}
-                animate={{ opacity: 1 }}
-                exit={{ opacity: 0 }}
-                transition={{ duration: 0.2 }}
-                className="text-xs font-mono text-muted-foreground truncate"
-              >
-                conversation {scenario.convoId}
-              </motion.span>
-            </AnimatePresence>
-            <AnimatePresence>
-              {phase === "highlight" && (
-                <motion.span
-                  initial={{ opacity: 0, scale: 0.9 }}
-                  animate={{ opacity: 1, scale: 1 }}
-                  exit={{ opacity: 0 }}
-                  className="text-[10px] uppercase tracking-wider text-accent flex items-center gap-1 shrink-0"
-                >
-                  <Sparkles className="h-3 w-3" />
-                  pattern detected
-                </motion.span>
-              )}
-            </AnimatePresence>
-          </div>
-          <div className="p-4 space-y-3 min-h-[280px]">
-            <AnimatePresence mode="wait">
-              <motion.div
-                key={scenario.id}
-                initial={{ opacity: 0 }}
-                animate={{ opacity: 1 }}
-                exit={{ opacity: 0 }}
-                transition={{ duration: 0.3 }}
-                className="space-y-3"
-              >
-                {scenario.chat.map((msg, i) => (
-                  <div
-                    key={i}
-                    className={`flex ${msg.role === "user" ? "justify-end" : "justify-start"}`}
-                  >
-                    <motion.div
-                      animate={{
-                        boxShadow: highlighted
-                          ? "0 0 0 2px var(--accent)"
-                          : "0 0 0 0px transparent",
-                      }}
-                      transition={{ duration: 0.3 }}
-                      className={`max-w-[90%] rounded-2xl px-3 py-2 text-sm ${
-                        msg.role === "user"
-                          ? "bg-foreground text-background rounded-br-sm"
-                          : "bg-background border border-border rounded-bl-sm"
-                      }`}
-                    >
-                      {msg.text}
-                    </motion.div>
-                  </div>
-                ))}
-              </motion.div>
-            </AnimatePresence>
-          </div>
-        </div>
-      </TiltedSpotlight>
-
-      {/* Workflow column */}
-      <TiltedSpotlight>
-        <div className="rounded-2xl border border-border bg-surface overflow-hidden">
-          <div className="px-4 py-3 border-b border-border flex items-center justify-between">
-            <div className="flex items-center gap-2 min-w-0">
-              <GitBranch className="h-3.5 w-3.5 text-accent shrink-0" />
-              <span className="text-xs font-medium text-muted-foreground truncate">Workflow</span>
-            </div>
-            <AnimatePresence>
-              {phase === "done" && (
-                <motion.span
-                  initial={{ opacity: 0 }}
-                  animate={{ opacity: 1 }}
-                  exit={{ opacity: 0 }}
-                  className="text-[10px] uppercase tracking-wider text-accent shrink-0"
-                >
-                  ran in {scenario.runTime}
-                </motion.span>
-              )}
-            </AnimatePresence>
-          </div>
-          <div className="p-4 min-h-[280px]">
-            <AnimatePresence mode="wait">
-              {phase === "chat" || phase === "highlight" ? (
-                <motion.div
-                  key="empty"
-                  initial={{ opacity: 0 }}
-                  animate={{ opacity: 1 }}
-                  exit={{ opacity: 0 }}
-                  className="h-full min-h-[240px] flex items-center justify-center text-sm text-muted-foreground"
-                >
-                  No workflow yet.
-                </motion.div>
-              ) : phase === "extracting" ? (
-                <motion.div
-                  key="extracting"
-                  initial={{ opacity: 0 }}
-                  animate={{ opacity: 1 }}
-                  exit={{ opacity: 0 }}
-                  className="h-full min-h-[240px] flex flex-col items-center justify-center gap-3 text-sm text-muted-foreground"
-                >
-                  <motion.div
-                    animate={{ rotate: 360 }}
-                    transition={{ duration: 1.2, repeat: Infinity, ease: "linear" }}
-                  >
-                    <Sparkles className="h-6 w-6 text-accent" />
-                  </motion.div>
-                  Extracting steps…
-                </motion.div>
-              ) : (
-                <motion.div
-                  key={`steps-${scenario.id}`}
-                  initial={{ opacity: 0 }}
-                  animate={{ opacity: 1 }}
-                  exit={{ opacity: 0 }}
-                  className="space-y-2"
-                >
-                  <div className="flex items-center justify-between mb-3">
-                    <div className="text-sm font-semibold truncate pr-2">{scenario.name}</div>
-                    {phase === "extracted" && (
-                      <motion.button
-                        initial={{ opacity: 0, scale: 0.9 }}
-                        animate={{ opacity: 1, scale: 1 }}
-                        type="button"
-                        className="flex items-center gap-1 rounded-md bg-accent text-accent-foreground px-2.5 py-1 text-[11px] font-medium shrink-0"
-                      >
-                        <Play className="h-3 w-3" />
-                        Run
-                      </motion.button>
-                    )}
-                    {phase === "running" && (
-                      <motion.span
-                        initial={{ opacity: 0 }}
-                        animate={{ opacity: 1 }}
-                        className="text-[11px] text-accent font-medium flex items-center gap-1 shrink-0"
-                      >
-                        <motion.span
-                          animate={{ opacity: [1, 0.4, 1] }}
-                          transition={{ duration: 0.8, repeat: Infinity }}
-                        >
-                          running…
-                        </motion.span>
-                      </motion.span>
-                    )}
-                    {phase === "done" && (
-                      <motion.span
-                        initial={{ opacity: 0, scale: 0.8 }}
-                        animate={{ opacity: 1, scale: 1 }}
-                        className="text-[11px] text-accent font-medium flex items-center gap-1 shrink-0"
-                      >
-                        <Check className="h-3 w-3" /> done
-                      </motion.span>
-                    )}
-                  </div>
-                  {scenario.steps.map((step, i) => {
-                    const running = phase === "running" && runStep === i;
-                    const complete = (phase === "running" && runStep > i) || phase === "done";
-                    return (
-                      <motion.div
-                        key={`${scenario.id}-${i}`}
-                        initial={{ opacity: 0, x: -8 }}
-                        animate={{ opacity: 1, x: 0 }}
-                        transition={{ delay: i * 0.1 }}
-                        className="rounded-lg bg-background border border-border p-3 flex items-center gap-3"
-                      >
-                        <motion.div
-                          animate={{
-                            backgroundColor: complete
-                              ? "var(--accent)"
-                              : running
-                                ? "var(--accent)"
-                                : "transparent",
-                            borderColor: complete || running ? "var(--accent)" : "var(--border)",
-                          }}
-                          className="h-6 w-6 rounded-full border flex items-center justify-center text-[10px] font-mono shrink-0"
-                        >
-                          {complete ? (
-                            <Check className="h-3 w-3 text-white" />
-                          ) : running ? (
-                            <motion.div
-                              className="h-2 w-2 rounded-full bg-white"
-                              animate={{ scale: [1, 0.6, 1] }}
-                              transition={{ duration: 0.9, repeat: Infinity }}
-                            />
-                          ) : (
-                            <span className="text-muted-foreground">{i + 1}</span>
-                          )}
-                        </motion.div>
-                        <div className="flex-1 min-w-0">
-                          <div className="text-xs font-semibold">{step.app}</div>
-                          <div className="text-xs text-muted-foreground truncate">
-                            {step.action}
-                          </div>
-                        </div>
-                        <ChevronRight className="h-3.5 w-3.5 text-muted-foreground shrink-0" />
-                      </motion.div>
-                    );
-                  })}
-                </motion.div>
-              )}
-            </AnimatePresence>
-          </div>
-        </div>
-      </TiltedSpotlight>
-    </div>
-  );
-}
diff --git a/packages/web/src/components/landing/demos/zap-race.tsx b/packages/web/src/components/landing/demos/zap-race.tsx
index 464c8797..c368f220 100644
--- a/packages/web/src/components/landing/demos/zap-race.tsx
+++ b/packages/web/src/components/landing/demos/zap-race.tsx
@@ -57,7 +57,11 @@ const SCENES: Scene[] = [
         result: "all 5 connected",
       },
       { tool: "search-actions", args: '"add row"', result: "sheets · create-spreadsheet-row" },
-      { tool: "list-input-fields", args: "add-subscriber", result: "email · merge_fields · tags" },
+      {
+        tool: "list-action-input-fields",
+        args: "add-subscriber",
+        result: "email · merge_fields · tags",
+      },
       { tool: "search-actions", args: '"draft email"', result: "gmail · create-draft" },
       { tool: "search-history", args: '"#new-signups channel"', result: "slack · #new-signups" },
     ],
@@ -178,10 +182,14 @@ const SCENES: Scene[] = [
     ],
     trace: [
       { tool: "search-actions", args: '"enrich person"', result: "clearbit · enrich-person" },
-      { tool: "list-input-fields", args: "enrich-person", result: "email · company · score" },
+      {
+        tool: "list-action-input-fields",
+        args: "enrich-person",
+        result: "email · company · score",
+      },
       { tool: "search-actions", args: '"create deal"', result: "pipedrive · create-deal" },
       {
-        tool: "list-input-field-choices",
+        tool: "list-action-input-field-choices",
         args: "pipeline",
         result: "Inbound · Outbound · Partner",
       },
@@ -304,10 +312,14 @@ const SCENES: Scene[] = [
     trace: [
       { tool: "search-actions", args: '"github issue"', result: "github · find-issue" },
       { tool: "search-actions", args: '"linear create"', result: "linear · create-issue" },
-      { tool: "list-input-field-choices", args: "linear.team", result: "Eng · Web · Mobile" },
+      {
+        tool: "list-action-input-field-choices",
+        args: "linear.team",
+        result: "Eng · Web · Mobile",
+      },
       { tool: "search-history", args: '"#bugs slack channel"', result: "slack · #bugs" },
       {
-        tool: "list-input-fields",
+        tool: "list-action-input-fields",
         args: "pagerduty.create-incident",
         result: "service · urgency · title",
       },
diff --git a/packages/web/src/components/landing/hero-demo.tsx b/packages/web/src/components/landing/hero-demo.tsx
index 8ada40e1..0433c0dc 100644
--- a/packages/web/src/components/landing/hero-demo.tsx
+++ b/packages/web/src/components/landing/hero-demo.tsx
@@ -9,25 +9,113 @@ import {
   useTransform,
 } from "motion/react";
 import { type MouseEvent, useEffect, useRef, useState } from "react";
-import { Check } from "@/components/icons/hi";
+import { Ban, Check } from "@/components/icons/hi";
 
 type Step =
   | { kind: "user"; text: string }
   | { kind: "thinking" }
   | { kind: "proposal" }
-  | { kind: "sent" };
+  | { kind: "outcome" };
 
-const SCRIPT: Step[] = [
-  { kind: "user", text: "Email Jake the Q3 deck and cc Priya." },
-  { kind: "thinking" },
-  { kind: "proposal" },
-  { kind: "sent" },
+type Field = { label: string; value: string };
+
+type Scenario = {
+  user: string;
+  app: string;
+  action: string;
+  badge: string;
+  /** Tailwind bg + text classes for the little app chip. */
+  badgeClass: string;
+  fields: Field[];
+  /** Whether the human approves the proposed action or declines it. */
+  outcome: "approved" | "declined";
+  result: string;
+};
+
+/**
+ * The hero plays through these one after another, so the demo shows the breadth
+ * of what Foreman can drive across the 10,000+ Zapier connections — not a single
+ * canned example. Each is one realistic, approval-gated action in a different app,
+ * and one (the refund) is *declined* so the approval gate is visible both ways.
+ */
+const SCENARIOS: Scenario[] = [
+  {
+    user: "Post in #launch that the new build is live.",
+    app: "Slack",
+    action: "Send Channel Message",
+    badge: "S",
+    badgeClass: "bg-[#4a154b] text-white",
+    fields: [
+      { label: "Channel", value: "#launch" },
+      { label: "Message", value: "🚀 v2.4 is live" },
+    ],
+    outcome: "approved",
+    result: "Posted to Slack.",
+  },
+  {
+    user: "Add Acme as a new deal worth $24k.",
+    app: "HubSpot",
+    action: "Create Deal",
+    badge: "H",
+    badgeClass: "bg-[#ff7a59] text-white",
+    fields: [
+      { label: "Deal", value: "Acme Corp" },
+      { label: "Amount", value: "$24,000" },
+      { label: "Stage", value: "Qualified" },
+    ],
+    outcome: "approved",
+    result: "Deal created in HubSpot.",
+  },
+  {
+    user: "Refund the duplicate charge on order 4821.",
+    app: "Stripe",
+    action: "Create Refund",
+    badge: "S",
+    badgeClass: "bg-[#635bff] text-white",
+    fields: [
+      { label: "Charge", value: "ch_3PQ8…" },
+      { label: "Amount", value: "$149.00" },
+      { label: "Reason", value: "duplicate" },
+    ],
+    outcome: "declined",
+    result: "Declined — nothing ran.",
+  },
+  {
+    user: "Book a 30-min intro with Sam on Thursday.",
+    app: "Google Calendar",
+    action: "Create Event",
+    badge: "C",
+    badgeClass: "bg-[#4285f4] text-white",
+    fields: [
+      { label: "Title", value: "Intro — Sam" },
+      { label: "When", value: "Thu, 2:00 PM" },
+      { label: "Length", value: "30 min" },
+    ],
+    outcome: "approved",
+    result: "Event added to Calendar.",
+  },
+  {
+    user: "Log these notes in the project tracker.",
+    app: "Notion",
+    action: "Create Page",
+    badge: "N",
+    badgeClass: "bg-foreground text-background",
+    fields: [
+      { label: "Database", value: "Projects" },
+      { label: "Title", value: "Kickoff notes" },
+      { label: "Status", value: "In progress" },
+    ],
+    outcome: "approved",
+    result: "Page added to Notion.",
+  },
 ];
 
-const STEP_DELAYS = [1400, 1800, 3400, 3500];
+const STEPS_PER_SCENARIO = 4;
+const STEP_DELAYS = [1400, 1800, 3400, 3600];
 
 export function HeroDemo() {
-  const [index, setIndex] = useState(0);
+  const [scenarioIndex, setScenarioIndex] = useState(0);
+  const [step, setStep] = useState(0);
   const reduce = useReducedMotion();
   const ref = useRef<HTMLDivElement>(null);
 
@@ -40,12 +128,17 @@ export function HeroDemo() {
   const rotateX = useTransform(springY, [-1, 1], [-3, 3]);
 
   useEffect(() => {
-    const id = setTimeout(
-      () => setIndex((i) => (i + 1) % SCRIPT.length),
-      STEP_DELAYS[index] ?? 2000,
-    );
+    const id = setTimeout(() => {
+      setStep((s) => {
+        if (s + 1 >= STEPS_PER_SCENARIO) {
+          setScenarioIndex((sc) => (sc + 1) % SCENARIOS.length);
+          return 0;
+        }
+        return s + 1;
+      });
+    }, STEP_DELAYS[step] ?? 2000);
     return () => clearTimeout(id);
-  }, [index]);
+  }, [step]);
 
   function handleMouse(e: MouseEvent<HTMLDivElement>) {
     if (reduce || !ref.current) return;
@@ -61,8 +154,16 @@ export function HeroDemo() {
     mouseY.set(0);
   }
 
-  const visible = SCRIPT.slice(0, index + 1).filter((step, i, arr) => {
-    if (step.kind !== "thinking") return true;
+  const scenario = SCENARIOS[scenarioIndex];
+  const steps: Step[] = [
+    { kind: "user", text: scenario.user },
+    { kind: "thinking" },
+    { kind: "proposal" },
+    { kind: "outcome" },
+  ];
+
+  const visible = steps.slice(0, step + 1).filter((item, i, arr) => {
+    if (item.kind !== "thinking") return true;
     const next = arr[i + 1];
     return !next || next.kind === "thinking";
   });
@@ -90,22 +191,38 @@ export function HeroDemo() {
         <span className="h-2.5 w-2.5 rounded-full bg-green-400/80" />
         <span className="ml-3 text-xs text-muted-foreground font-mono">foreman · slack</span>
       </div>
-      <div className="p-4 sm:p-6 space-y-3 min-h-[340px] sm:min-h-[380px] text-sm">
-        <AnimatePresence>
-          {visible.map((step, i) => (
-            <motion.div
-              key={i}
-              initial={{ opacity: 0, y: 10 }}
-              animate={{ opacity: 1, y: 0 }}
-              exit={{ opacity: 0 }}
-              transition={{ duration: 0.5, ease: [0.16, 1, 0.3, 1] }}
-            >
-              {step.kind === "user" && <UserBubble text={step.text} />}
-              {step.kind === "thinking" && <ThinkingBubble />}
-              {step.kind === "proposal" && <ProposalCard />}
-              {step.kind === "sent" && <SentBubble />}
-            </motion.div>
-          ))}
+      <div className="p-4 sm:p-6 min-h-[340px] sm:min-h-[380px] text-sm">
+        {/* Keyed by scenario so the previous conversation fully clears before the
+            next one enters — otherwise the new message mounts below the exiting
+            bubbles and snaps to the top. */}
+        <AnimatePresence mode="wait">
+          <motion.div
+            key={scenarioIndex}
+            initial={{ opacity: 0 }}
+            animate={{ opacity: 1 }}
+            exit={{ opacity: 0 }}
+            transition={{ duration: 0.3 }}
+            className="space-y-3"
+          >
+            {visible.map((item, i) => (
+              <motion.div
+                key={i}
+                initial={{ opacity: 0, y: 10 }}
+                animate={{ opacity: 1, y: 0 }}
+                transition={{ duration: 0.45, ease: [0.16, 1, 0.3, 1] }}
+              >
+                {item.kind === "user" && <UserBubble text={item.text} />}
+                {item.kind === "thinking" && <ThinkingBubble />}
+                {item.kind === "proposal" && <ProposalCard scenario={scenario} />}
+                {item.kind === "outcome" && (
+                  <OutcomeBubble
+                    approved={scenario.outcome === "approved"}
+                    text={scenario.result}
+                  />
+                )}
+              </motion.div>
+            ))}
+          </motion.div>
         </AnimatePresence>
       </div>
     </motion.div>
@@ -125,9 +242,14 @@ function UserBubble({ text }: { text: string }) {
 function ThinkingBubble() {
   return (
     <div className="flex items-center gap-2">
-      <div className="h-7 w-7 rounded-full bg-accent/15 text-accent flex items-center justify-center text-xs font-bold">
-        F
-      </div>
+      {/* biome-ignore lint/performance/noImgElement: small static brand asset, next/image is overkill */}
+      <img
+        alt="Foreman"
+        className="h-7 w-7 object-contain"
+        height={28}
+        src="/zapier.svg"
+        width={28}
+      />
       <div className="rounded-2xl rounded-bl-sm bg-background border border-border px-4 py-2.5 flex items-center gap-1">
         <span className="typing-dot h-1.5 w-1.5 rounded-full bg-muted" />
         <span className="typing-dot h-1.5 w-1.5 rounded-full bg-muted" />
@@ -137,46 +259,63 @@ function ThinkingBubble() {
   );
 }
 
-function ProposalCard() {
+function ProposalCard({ scenario }: { scenario: Scenario }) {
+  const declined = scenario.outcome === "declined";
   return (
     <motion.div
       animate={{ scale: [1, 1.015, 1] }}
       transition={{ duration: 2.4, repeat: Infinity, ease: "easeInOut" }}
       className="flex items-start gap-2"
     >
-      <div className="h-7 w-7 rounded-full bg-accent/15 text-accent flex items-center justify-center text-xs font-bold shrink-0">
-        F
-      </div>
+      {/* biome-ignore lint/performance/noImgElement: small static brand asset, next/image is overkill */}
+      <img
+        alt="Foreman"
+        className="h-7 w-7 shrink-0 object-contain"
+        height={28}
+        src="/zapier.svg"
+        width={28}
+      />
       <div className="flex-1 min-w-0 rounded-2xl rounded-bl-sm bg-background border border-accent/30 overflow-hidden shadow-sm shadow-accent/10">
         <div className="px-4 py-2 border-b border-border flex items-center justify-between">
           <div className="flex items-center gap-2 min-w-0">
-            <span className="inline-flex h-5 w-5 items-center justify-center rounded bg-red-500 text-white text-[10px] font-bold shrink-0">
-              G
+            <span
+              className={`inline-flex h-5 w-5 items-center justify-center rounded text-[10px] font-bold shrink-0 ${scenario.badgeClass}`}
+            >
+              {scenario.badge}
+            </span>
+            <span className="text-xs font-medium truncate">
+              {scenario.app} · {scenario.action}
             </span>
-            <span className="text-xs font-medium truncate">Gmail · Send Email</span>
           </div>
           <span className="text-[10px] uppercase tracking-wider text-accent font-medium shrink-0 ml-2">
             approval
           </span>
         </div>
         <div className="px-4 py-3 space-y-1.5 text-xs">
-          <Row label="To" value="jake@acme.com" />
-          <Row label="Cc" value="priya@acme.com" />
-          <Row label="Subject" value="Q3 deck" />
-          <Row label="Attach" value="Q3-Review.pdf" />
+          {scenario.fields.map((field) => (
+            <Row key={field.label} label={field.label} value={field.value} />
+          ))}
         </div>
         <div className="px-4 py-2.5 border-t border-border flex items-center gap-2">
           <button
             type="button"
-            className="rounded-md bg-foreground text-background px-3 py-1 text-xs font-medium"
+            className={
+              declined
+                ? "rounded-md border border-border px-3 py-1 text-xs text-muted-foreground"
+                : "rounded-md bg-foreground text-background px-3 py-1 text-xs font-medium"
+            }
           >
-            Approve & send
+            Approve &amp; run
           </button>
           <button
             type="button"
-            className="rounded-md border border-border px-3 py-1 text-xs text-muted-foreground"
+            className={
+              declined
+                ? "rounded-md border border-red-500/40 bg-red-500/5 px-3 py-1 text-xs font-medium text-red-600 dark:text-red-400"
+                : "rounded-md border border-border px-3 py-1 text-xs text-muted-foreground"
+            }
           >
-            Edit
+            Decline
           </button>
         </div>
       </div>
@@ -193,19 +332,28 @@ function Row({ label, value }: { label: string; value: string }) {
   );
 }
 
-function SentBubble() {
+function OutcomeBubble({ approved, text }: { approved: boolean; text: string }) {
   return (
     <div className="flex items-center gap-2">
-      <div className="h-7 w-7 rounded-full bg-accent/15 text-accent flex items-center justify-center text-xs font-bold">
-        F
-      </div>
+      {/* biome-ignore lint/performance/noImgElement: small static brand asset, next/image is overkill */}
+      <img
+        alt="Foreman"
+        className="h-7 w-7 object-contain"
+        height={28}
+        src="/zapier.svg"
+        width={28}
+      />
       <motion.div
         initial={{ scale: 0.9 }}
         animate={{ scale: 1 }}
-        className="rounded-2xl rounded-bl-sm bg-green-500/10 text-green-700 dark:text-green-400 border border-green-500/20 px-4 py-2 text-sm flex items-center gap-2"
+        className={
+          approved
+            ? "rounded-2xl rounded-bl-sm bg-green-500/10 text-green-700 dark:text-green-400 border border-green-500/20 px-4 py-2 text-sm flex items-center gap-2"
+            : "rounded-2xl rounded-bl-sm bg-muted/40 text-muted-foreground border border-border px-4 py-2 text-sm flex items-center gap-2"
+        }
       >
-        <Check className="h-4 w-4" />
-        Sent via Gmail.
+        {approved ? <Check className="h-4 w-4" /> : <Ban className="h-4 w-4" />}
+        {text}
       </motion.div>
     </div>
   );
diff --git a/packages/web/src/components/landing/sections/automations.tsx b/packages/web/src/components/landing/sections/automations.tsx
new file mode 100644
index 00000000..590784d8
--- /dev/null
+++ b/packages/web/src/components/landing/sections/automations.tsx
@@ -0,0 +1,52 @@
+import { AutomationsDemo } from "@/components/landing/demos/automations-demo";
+import { Reveal } from "@/components/landing/reveal";
+import { TiltedSpotlight } from "@/components/landing/tilted-spotlight";
+import { Badge } from "@/components/ui/badge";
+
+export function Automations() {
+  return (
+    <section id="automations" className="py-14 sm:py-20 md:py-24">
+      <div className="max-w-6xl mx-auto px-4 sm:px-6">
+        <div className="grid md:grid-cols-2 gap-10 md:gap-12 items-center">
+          <Reveal>
+            <Badge variant="accent" className="mb-4">
+              Durable automations
+            </Badge>
+            <h2 className="text-3xl sm:text-4xl font-semibold tracking-[-0.02em] text-balance">
+              Build automations by chatting. Watch them run.
+            </h2>
+            <p className="text-muted-foreground mt-4 text-base sm:text-lg leading-relaxed text-pretty">
+              Describe what you want in plain English — Foreman drafts a durable automation, you
+              approve it, and it runs on a durable engine that survives restarts and retries on its
+              own. No flowchart builder, no canvas.
+            </p>
+            <p className="text-muted-foreground mt-3 text-base sm:text-lg leading-relaxed text-pretty">
+              Every run is tracked end to end: <span className="text-foreground">started</span> →{" "}
+              <span className="text-foreground">finished</span> or{" "}
+              <span className="text-foreground">failed</span>, with the output and errors right
+              there — updating live as they complete.
+            </p>
+            <ul className="mt-6 space-y-2 text-sm">
+              {[
+                "Authored from chat — no separate builder",
+                "Approval-gated before anything runs",
+                "Durable execution: retries, waits, and resumes",
+                "Live run history with output + error detail",
+              ].map((line) => (
+                <li key={line} className="flex items-center gap-2.5">
+                  <span className="h-1.5 w-1.5 shrink-0 rounded-full bg-accent" />
+                  <span>{line}</span>
+                </li>
+              ))}
+            </ul>
+          </Reveal>
+          <Reveal delay={0.1} direction="right">
+            <TiltedSpotlight>
+              <AutomationsDemo />
+            </TiltedSpotlight>
+          </Reveal>
+        </div>
+      </div>
+    </section>
+  );
+}
diff --git a/packages/web/src/components/landing/sections/channels.tsx b/packages/web/src/components/landing/sections/channels.tsx
index 511cd9fc..18320c2b 100644
--- a/packages/web/src/components/landing/sections/channels.tsx
+++ b/packages/web/src/components/landing/sections/channels.tsx
@@ -55,7 +55,7 @@ export function Channels() {
           </Reveal>
 
           <Reveal delay={0.1} className="flex">
-            <div className="grid grid-cols-3 gap-2 sm:gap-3 auto-rows-fr w-full">
+            <div className="grid grid-cols-2 sm:grid-cols-3 gap-2 sm:gap-3 auto-rows-fr w-full">
               {CHANNELS.map((c) => (
                 <TiltedSpotlight
                   key={c.name}
diff --git a/packages/web/src/components/landing/sections/closing-cta.tsx b/packages/web/src/components/landing/sections/closing-cta.tsx
index 396ea37e..59022849 100644
--- a/packages/web/src/components/landing/sections/closing-cta.tsx
+++ b/packages/web/src/components/landing/sections/closing-cta.tsx
@@ -25,7 +25,7 @@ export function ClosingCta() {
               </h2>
               <p className="text-muted-foreground mt-4 sm:mt-5 text-base sm:text-lg max-w-xl mx-auto">
                 Connect your Zapier account once. Then talk to it from any chat app you already use.
-                Approval-gated, audit-logged, open source. Free while we&apos;re in alpha.
+                Approval-gated, audit-logged, open source. Free to start.
               </p>
               <div className="flex flex-wrap justify-center gap-3 mt-6 sm:mt-8">
                 <MagneticButton strength={0.25}>
diff --git a/packages/web/src/components/landing/sections/hero.tsx b/packages/web/src/components/landing/sections/hero.tsx
index 0d4174f6..5a925192 100644
--- a/packages/web/src/components/landing/sections/hero.tsx
+++ b/packages/web/src/components/landing/sections/hero.tsx
@@ -28,8 +28,8 @@ export function Hero() {
           </h1>
 
           <p className="text-base sm:text-lg text-muted-foreground max-w-lg leading-relaxed">
-            Your Zapier account already has 9,000+ app connections. Foreman drives them from chat —
-            Slack, Discord, Telegram, MCP — with approval gates and an audit trail. No agent
+            Your Zapier account already has 10,000+ app connections. Foreman drives them from chat —
+            Slack, Discord, Telegram, and more — with approval gates and an audit trail. No agent
             builder, no knowledge base to maintain, no per-agent config.
           </p>
 
@@ -45,7 +45,7 @@ export function Hero() {
 
           <div className="flex flex-wrap items-center gap-x-5 gap-y-2 text-xs text-muted-foreground pt-1">
             <span className="flex items-center gap-1.5">
-              <Zap className="h-3.5 w-3.5 text-accent" /> 9,000+ apps
+              <Zap className="h-3.5 w-3.5 text-accent" /> 10,000+ apps
             </span>
             <span className="flex items-center gap-1.5">
               <Shield className="h-3.5 w-3.5 text-accent" /> Approval-gated
diff --git a/packages/web/src/components/landing/sections/hosting.tsx b/packages/web/src/components/landing/sections/hosting.tsx
index faeccda7..4a42c954 100644
--- a/packages/web/src/components/landing/sections/hosting.tsx
+++ b/packages/web/src/components/landing/sections/hosting.tsx
@@ -23,11 +23,11 @@ export function Hosting() {
             Two ways to run it
           </Badge>
           <h2 className="text-3xl sm:text-4xl font-semibold tracking-[-0.02em]">
-            Alpha-hosted or on your own server.
+            Cloud-hosted or on your own server.
           </h2>
           <p className="text-muted-foreground mt-4 text-base sm:text-lg leading-relaxed max-w-xl mx-auto">
-            Use our alpha to try it free. Self-host when you&apos;re ready to run it for your team
-            or your clients — one Docker container, your data stays yours, full source on GitHub.
+            Start free on our cloud. Self-host when you&apos;re ready to run it for your team or
+            your clients — one Docker container, your data stays yours, full source on GitHub.
           </p>
         </Reveal>
 
@@ -42,10 +42,10 @@ export function Hosting() {
                     </div>
                     <div>
                       <h3 className="text-xl font-semibold">Foreman Cloud</h3>
-                      <p className="text-xs text-muted-foreground">Free during alpha</p>
+                      <p className="text-xs text-muted-foreground">Free to start</p>
                     </div>
                   </div>
-                  <Badge variant="outline">Alpha</Badge>
+                  <Badge variant="outline">Free</Badge>
                 </div>
                 <ul className="space-y-2.5 text-sm mb-6">
                   {CLOUD_BULLETS.map((line) => (
diff --git a/packages/web/src/components/landing/sections/more-capabilities.tsx b/packages/web/src/components/landing/sections/more-capabilities.tsx
new file mode 100644
index 00000000..ecab04ea
--- /dev/null
+++ b/packages/web/src/components/landing/sections/more-capabilities.tsx
@@ -0,0 +1,252 @@
+import { Gauge, Lock, Users } from "@/components/icons/hi";
+import { Reveal } from "@/components/landing/reveal";
+import { TiltedSpotlight } from "@/components/landing/tilted-spotlight";
+import { Badge } from "@/components/ui/badge";
+
+export function MoreCapabilities() {
+  return (
+    <section className="py-14 sm:py-20 md:py-24">
+      <div className="max-w-6xl mx-auto px-4 sm:px-6">
+        <Reveal className="max-w-2xl mx-auto text-center mb-12 sm:mb-16">
+          <Badge variant="accent" className="mb-4">
+            More in Foreman
+          </Badge>
+          <h2 className="text-3xl sm:text-4xl font-semibold tracking-[-0.02em] text-balance">
+            Beyond the chat driver.
+          </h2>
+          <p className="text-muted-foreground mt-4 text-base sm:text-lg leading-relaxed text-pretty">
+            Build live apps — dashboards, internal tools — from the data you pull, and run a
+            separate workspace for every team or client, all from the same chat.
+          </p>
+        </Reveal>
+
+        {/* Live dashboards — text left, visual right */}
+        <div className="grid md:grid-cols-2 gap-10 md:gap-12 items-center">
+          <Reveal>
+            <Badge variant="accent" className="mb-4">
+              Live apps
+            </Badge>
+            <h3 className="text-2xl sm:text-3xl font-semibold tracking-[-0.02em] text-balance">
+              Ask for an app. Get a live one.
+            </h3>
+            <p className="text-muted-foreground mt-4 text-base leading-relaxed text-pretty">
+              Foreman pulls the numbers from your connected apps and turns them into a shareable app
+              — a live dashboard or internal tool — you can bring up right from chat. KPIs, trends,
+              and totals, refreshed whenever you ask. Just say what you want to see.
+            </p>
+            <ul className="mt-6 space-y-2 text-sm">
+              {[
+                "Built from the apps you already connected",
+                "Pull it up from any channel by asking",
+                "Share a snapshot with your team in one link",
+              ].map((line) => (
+                <li key={line} className="flex items-center gap-2.5">
+                  <span className="h-1.5 w-1.5 shrink-0 rounded-full bg-accent" />
+                  <span>{line}</span>
+                </li>
+              ))}
+            </ul>
+          </Reveal>
+          <Reveal delay={0.1} direction="right">
+            <TiltedSpotlight>
+              <DashboardMini />
+            </TiltedSpotlight>
+          </Reveal>
+        </div>
+
+        {/* Workspaces — visual left, text right (text first in source for mobile reading) */}
+        <div className="mt-16 grid md:grid-cols-2 gap-10 md:gap-12 items-center sm:mt-20 md:mt-24">
+          <Reveal className="md:order-2">
+            <Badge variant="accent" className="mb-4">
+              Workspaces
+            </Badge>
+            <h3 className="text-2xl sm:text-3xl font-semibold tracking-[-0.02em] text-balance">
+              One agent. A workspace per team or client.
+            </h3>
+            <p className="text-muted-foreground mt-4 text-base leading-relaxed text-pretty">
+              Multi-tenant by design. Share one Zapier connection across a workspace, keep every
+              person&apos;s chats private, and spin up a separate, isolated workspace for each
+              client — switch between them without leaving chat.
+            </p>
+            <ul className="mt-6 space-y-2 text-sm">
+              {[
+                "Isolated data and members per workspace",
+                "Shared connections, private conversations",
+                "A clean tenant for every client you serve",
+              ].map((line) => (
+                <li key={line} className="flex items-center gap-2.5">
+                  <span className="h-1.5 w-1.5 shrink-0 rounded-full bg-accent" />
+                  <span>{line}</span>
+                </li>
+              ))}
+            </ul>
+          </Reveal>
+          <Reveal delay={0.1} className="md:order-1">
+            <TiltedSpotlight>
+              <WorkspaceMini />
+            </TiltedSpotlight>
+          </Reveal>
+        </div>
+      </div>
+    </section>
+  );
+}
+
+const KPIS = [
+  { label: "MRR", value: "$48.2k", delta: "+12%" },
+  { label: "New customers", value: "37", delta: "+8" },
+  { label: "Open deals", value: "14", delta: "+3" },
+];
+
+const BARS = [
+  { id: "mon", h: "h-[38%]" },
+  { id: "tue", h: "h-[54%]" },
+  { id: "wed", h: "h-[44%]" },
+  { id: "thu", h: "h-[66%]" },
+  { id: "fri", h: "h-[58%]" },
+  { id: "sat", h: "h-[82%]" },
+  { id: "sun", h: "h-[72%]" },
+];
+
+const DAY_LABELS = ["M", "T", "W", "T", "F", "S", "S"];
+
+function DashboardMini() {
+  return (
+    <div className="rounded-2xl border border-border bg-surface shadow-2xl shadow-black/10 overflow-hidden">
+      <div className="flex items-center justify-between px-4 py-3 border-b border-border">
+        <div className="flex items-center gap-2">
+          <Gauge className="h-4 w-4 text-accent" />
+          <span className="text-xs font-medium">Revenue · this week</span>
+        </div>
+        <span className="flex items-center gap-1.5 text-[10px] uppercase tracking-wider text-muted-foreground">
+          <span className="h-1.5 w-1.5 rounded-full bg-green-500 animate-pulse" /> live
+        </span>
+      </div>
+      <div className="p-4 sm:p-5 space-y-4">
+        <div className="grid grid-cols-3 gap-2.5">
+          {KPIS.map((kpi) => (
+            <div
+              key={kpi.label}
+              className="rounded-xl border border-border/60 bg-background/40 p-3"
+            >
+              <div className="text-[11px] text-muted-foreground truncate">{kpi.label}</div>
+              <div className="mt-1 text-base sm:text-lg font-semibold tabular-nums">
+                {kpi.value}
+              </div>
+              <div className="text-[11px] font-medium text-green-600 dark:text-green-400 tabular-nums">
+                {kpi.delta}
+              </div>
+            </div>
+          ))}
+        </div>
+        <div>
+          <div className="flex items-end gap-1.5 h-24">
+            {BARS.map((bar, i) => (
+              <div
+                key={bar.id}
+                className={`flex-1 rounded-t ${i >= 5 ? "bg-accent" : "bg-accent/30"} ${bar.h}`}
+              />
+            ))}
+          </div>
+          <div className="mt-2 flex justify-between px-0.5 text-[10px] text-muted-foreground">
+            {BARS.map((bar, i) => (
+              <span key={bar.id} className="w-3 text-center">
+                {DAY_LABELS[i]}
+              </span>
+            ))}
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+const WORKSPACES = [
+  {
+    initials: "A",
+    name: "Acme Corp",
+    type: "Team workspace",
+    members: 5,
+    chipClass: "bg-accent text-white",
+    active: true,
+  },
+  {
+    initials: "B",
+    name: "Beta Client",
+    type: "Client workspace",
+    members: 2,
+    chipClass: "bg-blue-500 text-white",
+    active: false,
+  },
+  {
+    initials: "P",
+    name: "Personal",
+    type: "Just you",
+    members: 1,
+    chipClass: "bg-purple-500 text-white",
+    active: false,
+  },
+];
+
+const AVATAR_COLORS = ["bg-accent", "bg-blue-500", "bg-purple-500", "bg-emerald-500"];
+
+function MemberDots({ count }: { count: number }) {
+  const shown = AVATAR_COLORS.slice(0, Math.min(count, 3));
+  return (
+    <div className="flex items-center -space-x-1.5">
+      {shown.map((color) => (
+        <span key={color} className={`h-5 w-5 rounded-full ring-2 ring-surface ${color}`} />
+      ))}
+      {count > shown.length && (
+        <span className="ml-2.5 text-[11px] text-muted-foreground">+{count - shown.length}</span>
+      )}
+    </div>
+  );
+}
+
+function WorkspaceMini() {
+  return (
+    <div className="rounded-2xl border border-border bg-surface shadow-2xl shadow-black/10 overflow-hidden">
+      <div className="flex items-center gap-2 px-4 py-3 border-b border-border">
+        <Users className="h-4 w-4 text-accent" />
+        <span className="text-xs font-medium">Workspaces</span>
+      </div>
+      <div className="p-3 sm:p-4 space-y-2">
+        {WORKSPACES.map((ws) => (
+          <div
+            key={ws.name}
+            className={`rounded-xl border p-3 ${
+              ws.active ? "border-accent/40 bg-accent/5" : "border-border/60"
+            }`}
+          >
+            <div className="flex items-center justify-between gap-2">
+              <div className="flex items-center gap-2.5 min-w-0">
+                <span
+                  className={`inline-flex h-8 w-8 items-center justify-center rounded-lg text-xs font-bold shrink-0 ${ws.chipClass}`}
+                >
+                  {ws.initials}
+                </span>
+                <div className="min-w-0">
+                  <div className="text-sm font-medium truncate">{ws.name}</div>
+                  <div className="text-[11px] text-muted-foreground truncate">{ws.type}</div>
+                </div>
+              </div>
+              <div className="flex items-center gap-2.5 shrink-0">
+                <MemberDots count={ws.members} />
+                {ws.active && (
+                  <span className="text-[10px] uppercase tracking-wider text-accent font-medium">
+                    active
+                  </span>
+                )}
+              </div>
+            </div>
+          </div>
+        ))}
+      </div>
+      <div className="flex items-center gap-1.5 px-4 py-2.5 border-t border-border text-[11px] text-muted-foreground">
+        <Lock className="h-3 w-3 shrink-0" />
+        One Zapier connection shared · each person&apos;s chats stay private
+      </div>
+    </div>
+  );
+}
diff --git a/packages/web/src/components/landing/sections/site-footer.tsx b/packages/web/src/components/landing/sections/site-footer.tsx
index b2f80395..484f11cd 100644
--- a/packages/web/src/components/landing/sections/site-footer.tsx
+++ b/packages/web/src/components/landing/sections/site-footer.tsx
@@ -13,6 +13,7 @@ const COLUMNS: Array<{
       { label: "How it works", href: "#how" },
       { label: "Channels", href: "#channels" },
       { label: "Pricing", href: "#hosting" },
+      { label: "vs Zapier Shared Brain", href: "/compare/zapier-shared-brain" },
     ],
   },
   {
@@ -45,13 +46,23 @@ export function SiteFooter() {
           {/* Brand column */}
           <div className="col-span-2 sm:col-span-1">
             <div className="flex items-center gap-2.5">
-              <span className="inline-flex h-6 w-6 items-center justify-center rounded-md bg-accent text-accent-foreground text-[11px] font-bold">
-                F
-              </span>
+              {/* biome-ignore lint/performance/noImgElement: small static brand asset, next/image is overkill */}
+              <img
+                alt="Foreman"
+                className="h-6 w-6 object-contain"
+                height={24}
+                src="/zapier.svg"
+                width={24}
+              />
               <span className="font-semibold text-foreground">Foreman</span>
             </div>
             <p className="text-xs text-muted-foreground mt-3 leading-relaxed max-w-[220px]">
-              A chat driver for your Zapier account. Drive 9,000+ app connections you already built.
+              A chat driver for your Zapier account. Drive 10,000+ app connections you already
+              built.
+            </p>
+            <p className="text-[11px] text-muted-foreground/70 mt-3 leading-relaxed max-w-[240px]">
+              Not affiliated with, endorsed by, or sponsored by Zapier. Foreman is an independent
+              product built on the Zapier SDK. Zapier is a trademark of Zapier, Inc.
             </p>
           </div>
 
@@ -104,13 +115,7 @@ export function SiteFooter() {
             </Suspense>{" "}
             Otaku Solutions. MIT-licensed.
           </span>
-          <span className="flex items-center gap-1.5">
-            <span className="inline-flex items-center gap-1 rounded-full border border-border px-2 py-0.5 text-[10px] uppercase tracking-wider text-accent">
-              <span className="h-1.5 w-1.5 rounded-full bg-accent animate-pulse" />
-              Alpha
-            </span>
-            Built with Mastra.
-          </span>
+          <span>Built with Mastra.</span>
         </div>
       </div>
     </footer>
diff --git a/packages/web/src/components/landing/sections/tool-discovery-section.tsx b/packages/web/src/components/landing/sections/tool-discovery-section.tsx
index 96cf6c3e..e5cf3547 100644
--- a/packages/web/src/components/landing/sections/tool-discovery-section.tsx
+++ b/packages/web/src/components/landing/sections/tool-discovery-section.tsx
@@ -8,7 +8,7 @@ const BULLETS = [
   "Execute actions, search data, manage tables",
   "Discover and connect apps on the fly",
   "Authenticated HTTP requests via Zapier Relay",
-  "Works across all 9,000+ Zapier apps",
+  "Works across all 10,000+ Zapier apps",
 ];
 
 export function ToolDiscoverySection() {
@@ -26,13 +26,13 @@ export function ToolDiscoverySection() {
             <p className="text-muted-foreground mt-4 text-base sm:text-lg leading-relaxed">
               Actions, Zapier Tables, authenticated HTTP, connection discovery — 33 SDK tools in
               all. Foreman searches and loads only what a request needs, so it stays fast across
-              9,000+ apps.
+              10,000+ apps.
             </p>
             <ul className="mt-6 space-y-2.5 text-sm">
               {BULLETS.map((line) => (
                 <li key={line} className="flex items-center gap-2.5">
-                  <div className="h-5 w-5 rounded-full bg-accent/10 flex items-center justify-center shrink-0">
-                    <Check className="h-3 w-3 text-accent" />
+                  <div className="h-5 w-5 rounded-full bg-accent flex items-center justify-center shrink-0">
+                    <Check className="h-3 w-3 text-accent-foreground" />
                   </div>
                   <span>{line}</span>
                 </li>
diff --git a/packages/web/src/components/landing/sections/workflows.tsx b/packages/web/src/components/landing/sections/workflows.tsx
deleted file mode 100644
index 9a50a371..00000000
--- a/packages/web/src/components/landing/sections/workflows.tsx
+++ /dev/null
@@ -1,28 +0,0 @@
-import { WorkflowExtraction } from "@/components/landing/demos/workflow-extraction";
-import { Reveal } from "@/components/landing/reveal";
-import { Badge } from "@/components/ui/badge";
-
-export function Workflows() {
-  return (
-    <section className="bg-surface/50">
-      <div className="max-w-6xl mx-auto px-4 sm:px-6 py-14 sm:py-20 md:py-24">
-        <Reveal className="max-w-2xl mb-10 sm:mb-14">
-          <Badge variant="accent" className="mb-4">
-            Workflows
-          </Badge>
-          <h2 className="text-3xl sm:text-4xl font-semibold tracking-[-0.02em]">
-            A workflow is just a conversation you saved.
-          </h2>
-          <p className="text-muted-foreground mt-4 text-base sm:text-lg leading-relaxed">
-            When a sequence works, say &apos;save that.&apos; Foreman extracts the steps into a
-            reusable workflow with streamed progress and run history. No canvas, no trigger picker,
-            no 14-field mapping — just the chat you already had.
-          </p>
-        </Reveal>
-        <Reveal delay={0.1}>
-          <WorkflowExtraction />
-        </Reveal>
-      </div>
-    </section>
-  );
-}
diff --git a/packages/web/src/components/landing/site-nav.tsx b/packages/web/src/components/landing/site-nav.tsx
index fe611140..a42d3df6 100644
--- a/packages/web/src/components/landing/site-nav.tsx
+++ b/packages/web/src/components/landing/site-nav.tsx
@@ -10,6 +10,7 @@ import { createClient } from "@/lib/client";
 export function SiteNav() {
   const [mobileOpen, setMobileOpen] = useState(false);
   const [isSignedIn, setIsSignedIn] = useState(false);
+  const [scrolled, setScrolled] = useState(false);
 
   useEffect(() => {
     createClient()
@@ -19,17 +20,36 @@ export function SiteNav() {
       });
   }, []);
 
+  // Transparent over the hero; fade in a blurred bar once the page scrolls.
+  useEffect(() => {
+    const onScroll = () => setScrolled(window.scrollY > 8);
+    onScroll();
+    window.addEventListener("scroll", onScroll, { passive: true });
+    return () => window.removeEventListener("scroll", onScroll);
+  }, []);
+
+  // Keep a readable backdrop whenever the mobile menu is open, regardless of scroll.
+  const solid = scrolled || mobileOpen;
+
   return (
-    <nav className="sticky top-0 z-50 border-b border-border/60 bg-background/80 backdrop-blur-xl">
-      <div className="max-w-6xl mx-auto px-6 h-14 flex items-center justify-between">
+    <nav
+      className={`sticky top-0 z-50 border-b transition-colors duration-300 ${
+        solid
+          ? "border-border/60 bg-background/80 backdrop-blur-xl"
+          : "border-transparent bg-transparent"
+      }`}
+    >
+      <div className="max-w-6xl mx-auto px-4 sm:px-6 h-14 flex items-center justify-between">
         <Link href="/" className="flex items-center gap-2.5 font-semibold tracking-tight">
-          <span className="inline-flex h-6 w-6 items-center justify-center rounded-md bg-accent text-accent-foreground text-xs font-bold">
-            F
-          </span>
+          {/* biome-ignore lint/performance/noImgElement: small static brand asset, next/image is overkill */}
+          <img
+            alt="Foreman"
+            className="h-6 w-6 object-contain"
+            height={24}
+            src="/zapier.svg"
+            width={24}
+          />
           <span className="text-[15px]">Foreman</span>
-          <span className="hidden sm:inline text-[10px] font-medium text-accent border border-accent/30 rounded-full px-2 py-0.5 ml-0.5 uppercase tracking-wider">
-            Alpha
-          </span>
         </Link>
 
         {/* Desktop nav */}
@@ -77,7 +97,7 @@ export function SiteNav() {
 
       {/* Mobile menu */}
       {mobileOpen && (
-        <div className="md:hidden border-t border-border bg-background px-6 py-4 space-y-3 animate-fade-in">
+        <div className="md:hidden border-t border-border bg-background px-4 sm:px-6 py-4 space-y-3 animate-fade-in">
           <a
             href="#features"
             className="block text-sm text-muted-foreground hover:text-foreground"
diff --git a/packages/web/src/components/login-form.tsx b/packages/web/src/components/login-form.tsx
index 3de24121..a6dd8cbb 100644
--- a/packages/web/src/components/login-form.tsx
+++ b/packages/web/src/components/login-form.tsx
@@ -3,9 +3,10 @@
 import Link from "next/link";
 import { useRouter } from "next/navigation";
 import { useState } from "react";
+import { Alert, AlertDescription } from "@/components/ui/alert";
 import { Button } from "@/components/ui/button";
+import { Field, FieldLabel } from "@/components/ui/field";
 import { Input } from "@/components/ui/input";
-import { Label } from "@/components/ui/label";
 import { createClient } from "@/lib/client";
 
 export function LoginForm() {
@@ -40,10 +41,10 @@ export function LoginForm() {
       </div>
 
       <form onSubmit={handleLogin} className="space-y-5">
-        <div className="space-y-1.5">
-          <Label htmlFor="email" className="text-sm font-medium">
+        <Field>
+          <FieldLabel htmlFor="email" className="text-sm font-medium">
             Email
-          </Label>
+          </FieldLabel>
           <Input
             id="email"
             type="email"
@@ -54,13 +55,13 @@ export function LoginForm() {
             onChange={(e) => setEmail(e.target.value)}
             className="h-10 rounded-md"
           />
-        </div>
+        </Field>
 
-        <div className="space-y-1.5">
+        <Field>
           <div className="flex items-center justify-between">
-            <Label htmlFor="password" className="text-sm font-medium">
+            <FieldLabel htmlFor="password" className="text-sm font-medium">
               Password
-            </Label>
+            </FieldLabel>
             <Link
               href="/auth/forgot-password"
               className="text-xs text-muted-foreground underline-offset-4 hover:underline"
@@ -78,12 +79,12 @@ export function LoginForm() {
             onChange={(e) => setPassword(e.target.value)}
             className="h-10 rounded-md"
           />
-        </div>
+        </Field>
 
         {error && (
-          <p className="text-sm text-red-500 bg-red-500/5 border border-red-500/20 rounded-md px-3 py-2">
-            {error}
-          </p>
+          <Alert variant="destructive">
+            <AlertDescription>{error}</AlertDescription>
+          </Alert>
         )}
 
         <Button
diff --git a/packages/web/src/components/logout-button.tsx b/packages/web/src/components/logout-button.tsx
deleted file mode 100644
index c07b3cb5..00000000
--- a/packages/web/src/components/logout-button.tsx
+++ /dev/null
@@ -1,17 +0,0 @@
-"use client";
-
-import { useRouter } from "next/navigation";
-import { Button } from "@/components/ui/button";
-import { createClient } from "@/lib/client";
-
-export function LogoutButton() {
-  const router = useRouter();
-
-  const logout = async () => {
-    const supabase = createClient();
-    await supabase.auth.signOut();
-    router.push("/auth/login");
-  };
-
-  return <Button onClick={logout}>Logout</Button>;
-}
diff --git a/packages/web/src/components/onboarding/onboarding-flow.tsx b/packages/web/src/components/onboarding/onboarding-flow.tsx
index 0dcd090c..720c5d26 100644
--- a/packages/web/src/components/onboarding/onboarding-flow.tsx
+++ b/packages/web/src/components/onboarding/onboarding-flow.tsx
@@ -31,12 +31,14 @@ export function OnboardingFlow({ initialStep, initialUses, zapierJustConnected }
         style={{ borderBottom: "1px solid #FFF3E6" }}
       >
         <div className="flex items-center gap-2.5">
-          <span
-            className="inline-flex h-7 w-7 items-center justify-center rounded-md text-white text-sm font-bold"
-            style={{ backgroundColor: "#FF4F00" }}
-          >
-            F
-          </span>
+          {/* biome-ignore lint/performance/noImgElement: small static brand asset, next/image is overkill */}
+          <img
+            alt="Foreman"
+            className="h-7 w-7 object-contain"
+            height={28}
+            src="/zapier.svg"
+            width={28}
+          />
           <span className="text-sm font-semibold tracking-tight" style={{ color: "#201515" }}>
             Foreman
           </span>
diff --git a/packages/web/src/components/onboarding/step-connect.tsx b/packages/web/src/components/onboarding/step-connect.tsx
index 50d45def..b2ebdd9d 100644
--- a/packages/web/src/components/onboarding/step-connect.tsx
+++ b/packages/web/src/components/onboarding/step-connect.tsx
@@ -2,6 +2,8 @@
 
 import { AlertCircle, ArrowRight, CheckCircle, Zap } from "lucide-react";
 import { useEffect, useState } from "react";
+import { Alert, AlertDescription } from "@/components/ui/alert";
+import { Button } from "@/components/ui/button";
 import { createClient } from "@/lib/client";
 
 const AGENT_URL = process.env.NEXT_PUBLIC_AGENT_SERVER_URL || "http://localhost:4111";
@@ -84,16 +86,18 @@ export function StepConnect({ uses, zapierJustConnected, onNext }: Props) {
           style={{ backgroundColor: "#201515", border: "1px solid #3A2525" }}
         >
           <div className="flex items-center gap-3">
-            <div
-              className="flex h-10 w-10 items-center justify-center rounded-xl"
-              style={{ backgroundColor: "#FF4F00" }}
-            >
-              <Zap className="h-5 w-5 text-white" />
-            </div>
+            {/* biome-ignore lint/performance/noImgElement: small static brand asset, next/image is overkill */}
+            <img
+              alt="Zapier"
+              className="h-10 w-10 rounded-xl bg-white object-contain p-1.5"
+              height={40}
+              src="/zapier.svg"
+              width={40}
+            />
             <div>
               <p className="font-semibold text-white">Zapier</p>
               <p className="text-xs" style={{ color: "#FFBF6E" }}>
-                6,000+ app integrations
+                10,000+ app integrations
               </p>
             </div>
           </div>
@@ -119,34 +123,31 @@ export function StepConnect({ uses, zapierJustConnected, onNext }: Props) {
           </div>
 
           {error && (
-            <div
-              className="flex items-center gap-2 text-sm rounded-lg px-3 py-2"
-              style={{ backgroundColor: "#3A2020", color: "#FF8080" }}
-            >
+            <Alert variant="destructive">
               <AlertCircle className="h-4 w-4 shrink-0" />
-              {error}
-            </div>
+              <AlertDescription>{error}</AlertDescription>
+            </Alert>
           )}
 
-          <button
+          <Button
             type="button"
             onClick={handleConnect}
             disabled={connecting}
-            className="w-full flex items-center justify-center gap-2 rounded-xl py-3 text-sm font-semibold text-white transition-all"
+            className="w-full rounded-xl py-3 text-sm font-semibold text-white"
             style={{ backgroundColor: connecting ? "#CC3F00" : "#FF4F00" }}
           >
             <Zap className="h-4 w-4" />
             {connecting ? "Redirecting to Zapier…" : "Connect Zapier"}
-          </button>
+          </Button>
         </div>
       )}
 
       <div className="flex justify-end pt-2">
-        <button
+        <Button
           type="button"
           onClick={onNext}
           disabled={!connected}
-          className="flex items-center gap-2 rounded-lg px-6 py-2.5 text-sm font-semibold text-white transition-all"
+          className="rounded-lg px-6 py-2.5 text-sm font-semibold text-white"
           style={{
             backgroundColor: connected ? "#FF4F00" : "#FFBF6E",
             cursor: connected ? "pointer" : "not-allowed",
@@ -154,7 +155,7 @@ export function StepConnect({ uses, zapierJustConnected, onNext }: Props) {
         >
           Continue
           <ArrowRight className="h-4 w-4" />
-        </button>
+        </Button>
       </div>
     </div>
   );
diff --git a/packages/web/src/components/onboarding/step-done.tsx b/packages/web/src/components/onboarding/step-done.tsx
index 5c3b7ef3..2b13e4a9 100644
--- a/packages/web/src/components/onboarding/step-done.tsx
+++ b/packages/web/src/components/onboarding/step-done.tsx
@@ -4,7 +4,7 @@ import { ArrowRight, MessageSquare, ShieldCheck, Zap } from "lucide-react";
 const FEATURES = [
   {
     icon: Zap,
-    label: "9,000+ apps at your fingertips",
+    label: "10,000+ apps at your fingertips",
     description: "Foreman can read and write across everything in your Zapier account.",
     color: "#FF4F00",
     bg: "#FFF3E6",
@@ -129,12 +129,14 @@ export function StepDone() {
           className="group flex w-full items-center justify-center gap-3 rounded-2xl px-8 py-4 text-sm font-bold text-white transition-all duration-200 hover:opacity-90 active:scale-[0.98]"
           style={{ backgroundColor: "#FF4F00" }}
         >
-          <span
-            className="inline-flex h-6 w-6 items-center justify-center rounded-lg text-[11px] font-bold"
-            style={{ backgroundColor: "rgba(255,255,255,0.2)" }}
-          >
-            F
-          </span>
+          {/* biome-ignore lint/performance/noImgElement: small static brand asset, next/image is overkill */}
+          <img
+            alt=""
+            className="h-6 w-6 rounded-lg bg-white object-contain p-0.5"
+            height={24}
+            src="/zapier.svg"
+            width={24}
+          />
           Open Foreman
           <ArrowRight className="h-4 w-4 transition-transform duration-200 group-hover:translate-x-0.5" />
         </a>
diff --git a/packages/web/src/components/onboarding/step-try.tsx b/packages/web/src/components/onboarding/step-try.tsx
index 9c913526..aaf95220 100644
--- a/packages/web/src/components/onboarding/step-try.tsx
+++ b/packages/web/src/components/onboarding/step-try.tsx
@@ -5,33 +5,146 @@ import { DefaultChatTransport } from "ai";
 import { ArrowRight, ChevronDown, ChevronRight, Search, Zap } from "lucide-react";
 import { useEffect, useRef, useState } from "react";
 import { MessageResponse } from "@/components/ai-elements/message";
+import { Button } from "@/components/ui/button";
+import { Collapsible, CollapsibleContent, CollapsibleTrigger } from "@/components/ui/collapsible";
 import { createClient } from "@/lib/client";
 import { sanitizeText } from "@/lib/utils";
 
 const AGENT_URL = process.env.NEXT_PUBLIC_AGENT_SERVER_URL || "http://localhost:4111";
 
-const USE_MESSAGES: Record<string, string> = {
-  sales: "What Zapier tables do I have set up?",
-  email: "What Zapier workflows do I have for email?",
-  crm: "What CRM-related Zapier connections do I have?",
-  slack: "What apps am I connected to in Zapier?",
-  data: "What Zapier tables are available for data entry?",
-  reports: "What automation workflows do I have in Zapier?",
-  invoices: "What apps am I connected to in Zapier?",
-  leads: "What apps am I connected to in Zapier?",
-  calendar: "What apps am I connected to in Zapier?",
+// The demo runs on haiku — cheap + fast, and reliable now that the table tools
+// coerce the stringified row data weak models emit (zapier-sdk-tools SCHEMA_OVERRIDES).
+const DEMO_MODEL = "anthropic/claude-haiku-4-5-20251001";
+
+// Per use-case demo: the table Foreman builds + the natural-language instruction
+// that drives it (showcasing NL → real action). The agent creates the table and
+// seeds it with the sample rows; columns come from the row field names.
+type Demo = { table: string; prompt: string };
+
+const USE_DEMOS: Record<string, Demo> = {
+  leads: {
+    table: "Leads",
+    prompt:
+      'Create a Zapier Table called "Leads", then add these three example rows so I can see it working: ' +
+      '(1) Name "Ava Chen", Email "ava@acme.com", Company "Acme Inc", Status "New", Source "Website"; ' +
+      '(2) Name "Ben Ortiz", Email "ben@beta.io", Company "Beta LLC", Status "Contacted", Source "Referral"; ' +
+      '(3) Name "Cara Singh", Email "cara@gamma.co", Company "Gamma Co", Status "Qualified", Source "LinkedIn".',
+  },
+  sales: {
+    table: "Deals",
+    prompt:
+      'Create a Zapier Table called "Deals", then add three example rows: ' +
+      '(1) Deal "Acme renewal", Company "Acme Inc", Value "$12,000", Stage "Negotiation", "Close Date" "2026-07-15"; ' +
+      '(2) Deal "Beta upsell", Company "Beta LLC", Value "$4,500", Stage "Proposal", "Close Date" "2026-07-30"; ' +
+      '(3) Deal "Gamma expansion", Company "Gamma Co", Value "$20,000", Stage "Discovery", "Close Date" "2026-08-10".',
+  },
+  crm: {
+    table: "Contacts",
+    prompt:
+      'Create a Zapier Table called "Contacts", then add three example rows: ' +
+      '(1) Name "Ava Chen", Email "ava@acme.com", Company "Acme Inc", Status "Active", "Last Contact" "2026-06-12"; ' +
+      '(2) Name "Ben Ortiz", Email "ben@beta.io", Company "Beta LLC", Status "Follow up", "Last Contact" "2026-06-15"; ' +
+      '(3) Name "Cara Singh", Email "cara@gamma.co", Company "Gamma Co", Status "New", "Last Contact" "2026-06-18".',
+  },
+  invoices: {
+    table: "Invoices",
+    prompt:
+      'Create a Zapier Table called "Invoices", then add three example rows: ' +
+      '(1) "Invoice #" "INV-001", Client "Acme Inc", Amount "$2,400", "Due Date" "2026-07-01", Status "Sent"; ' +
+      '(2) "Invoice #" "INV-002", Client "Beta LLC", Amount "$980", "Due Date" "2026-07-05", Status "Paid"; ' +
+      '(3) "Invoice #" "INV-003", Client "Gamma Co", Amount "$5,200", "Due Date" "2026-07-10", Status "Overdue".',
+  },
+  data: {
+    table: "Records",
+    prompt:
+      'Create a Zapier Table called "Records", then add three example rows: ' +
+      '(1) Name "Item A", Category "Hardware", Value "120", Date "2026-06-10"; ' +
+      '(2) Name "Item B", Category "Software", Value "75", Date "2026-06-12"; ' +
+      '(3) Name "Item C", Category "Service", Value "300", Date "2026-06-14".',
+  },
+  reports: {
+    table: "Metrics",
+    prompt:
+      'Create a Zapier Table called "Metrics", then add three example rows: ' +
+      '(1) Metric "Signups", Value "142", Change "+12%", Week "Jun 9"; ' +
+      '(2) Metric "Revenue", Value "$8,400", Change "+5%", Week "Jun 9"; ' +
+      '(3) Metric "Churn", Value "1.8%", Change "-0.3%", Week "Jun 9".',
+  },
+  email: {
+    table: "Subscribers",
+    prompt:
+      'Create a Zapier Table called "Subscribers", then add three example rows: ' +
+      '(1) Name "Ava Chen", Email "ava@acme.com", Status "Active", Joined "2026-05-01"; ' +
+      '(2) Name "Ben Ortiz", Email "ben@beta.io", Status "Active", Joined "2026-05-18"; ' +
+      '(3) Name "Cara Singh", Email "cara@gamma.co", Status "Unsubscribed", Joined "2026-04-22".',
+  },
+  slack: {
+    table: "Alerts",
+    prompt:
+      'Create a Zapier Table called "Alerts", then add three example rows: ' +
+      '(1) Message "Deploy succeeded", Channel "#ops", Priority "Low", Status "Sent"; ' +
+      '(2) Message "Payment failed", Channel "#billing", Priority "High", Status "Sent"; ' +
+      '(3) Message "New signup", Channel "#growth", Priority "Medium", Status "Sent".',
+  },
+  calendar: {
+    table: "Events",
+    prompt:
+      'Create a Zapier Table called "Events", then add three example rows: ' +
+      '(1) Event "Standup", Date "2026-06-20", Time "9:00 AM", Attendees "Team"; ' +
+      '(2) Event "Client call", Date "2026-06-20", Time "2:00 PM", Attendees "Acme"; ' +
+      '(3) Event "Review", Date "2026-06-21", Time "11:00 AM", Attendees "Eng".',
+  },
 };
 
-function getPrompt(uses: string[]): string {
+const DEFAULT_DEMO: Demo = USE_DEMOS.leads;
+
+// Nudge the model to batch the inserts. Without this, weaker models (haiku) split
+// the three rows into one create-table-records call each — all succeed, but it's
+// slower and reads as three approvals' worth of work. The records array already
+// takes multiple rows, so one call is correct.
+const SINGLE_CALL_HINT =
+  " Add all the rows in a single create-table-records call — the records array takes multiple rows at once.";
+
+function withHint(demo: Demo): Demo {
+  return { ...demo, prompt: demo.prompt + SINGLE_CALL_HINT };
+}
+
+function getDemo(uses: string[]): Demo {
   for (const u of uses) {
-    if (USE_MESSAGES[u]) return USE_MESSAGES[u];
+    if (USE_DEMOS[u]) return withHint(USE_DEMOS[u]);
   }
-  return "What apps am I connected to in Zapier?";
+  return withHint(DEFAULT_DEMO);
 }
 
 const HIDDEN_TOOLS = new Set(["updateWorkingMemory", "recall"]);
 
-function ToolCallBubble({ part }: { part: any }) {
+// Tiny Zapier brand avatar for assistant messages (replaces the old "F").
+function BotAvatar() {
+  return (
+    // biome-ignore lint/performance/noImgElement: small static brand asset
+    <img
+      alt="Foreman"
+      className="h-5 w-5 shrink-0 object-contain"
+      height={20}
+      src="/zapier.svg"
+      width={20}
+    />
+  );
+}
+
+type ApprovalResponder = ReturnType<typeof useChat>["addToolApprovalResponse"];
+
+function ToolCallBubble({
+  part,
+  addToolApprovalResponse,
+  autoApprove,
+  onApproveFirst,
+}: {
+  part: any;
+  addToolApprovalResponse: ApprovalResponder;
+  autoApprove: boolean;
+  onApproveFirst: () => void;
+}) {
   const [expanded, setExpanded] = useState(false);
   // AI SDK v6: type is "tool-<toolName>", name extracted from type
   const toolName = part.type?.startsWith("tool-")
@@ -40,57 +153,106 @@ function ToolCallBubble({ part }: { part: any }) {
   const isSearch = toolName.includes("search") || toolName.includes("list");
   const Icon = isSearch ? Search : Zap;
   const hasOutput = part.state === "output-available" || part.output != null;
+  const approvalId: string | undefined = part.approval?.id;
+  const needsApproval = part.state === "approval-requested" && !!approvalId;
 
   return (
-    <button
-      type="button"
-      onClick={() => setExpanded((e) => !e)}
-      className="w-full text-left rounded-lg px-3 py-2 transition-colors text-sm"
+    <Collapsible
+      open={expanded || needsApproval}
+      onOpenChange={setExpanded}
+      className="rounded-lg px-3 py-2 text-sm"
       style={{
-        backgroundColor: "#FFF3E6",
-        border: "1px solid #FFBF6E",
+        backgroundColor: needsApproval ? "#FFF7ED" : "#FFF3E6",
+        border: `1px solid ${needsApproval ? "#FF4F00" : "#FFBF6E"}`,
       }}
     >
-      <div className="flex items-center gap-2">
-        <Icon className="h-3 w-3 shrink-0" style={{ color: "#FF4F00" }} />
-        <span className="flex-1 font-medium text-xs" style={{ color: "#FF4F00" }}>
-          {toolName}
-        </span>
-        {hasOutput && (
-          <span className="text-[10px]" style={{ color: "#4A7C2F" }}>
-            ✓
+      <CollapsibleTrigger className="w-full text-left transition-colors">
+        <div className="flex items-center gap-2">
+          <Icon className="h-3 w-3 shrink-0" style={{ color: "#FF4F00" }} />
+          <span className="flex-1 font-medium text-xs" style={{ color: "#FF4F00" }}>
+            {toolName}
           </span>
-        )}
-        {expanded ? (
-          <ChevronDown className="h-3 w-3" style={{ color: "#FFBF6E" }} />
-        ) : (
-          <ChevronRight className="h-3 w-3" style={{ color: "#FFBF6E" }} />
-        )}
-      </div>
-      {expanded && part.input && (
-        <div className="mt-2 pt-2 space-y-1" style={{ borderTop: "1px solid #FFBF6E" }}>
-          {Object.entries(part.input as Record<string, unknown>).map(([k, v]) => (
-            <div key={k} className="flex gap-2 text-[10px]">
-              <span style={{ color: "#FFBF6E" }}>{k}:</span>
-              <span className="font-medium" style={{ color: "#201515" }}>
-                {String(v)}
+          {hasOutput && (
+            <span className="text-[10px]" style={{ color: "#4A7C2F" }}>
+              ✓
+            </span>
+          )}
+          {expanded || needsApproval ? (
+            <ChevronDown className="h-3 w-3" style={{ color: "#FFBF6E" }} />
+          ) : (
+            <ChevronRight className="h-3 w-3" style={{ color: "#FFBF6E" }} />
+          )}
+        </div>
+      </CollapsibleTrigger>
+      {part.input && (
+        <CollapsibleContent>
+          <div className="mt-2 pt-2 space-y-1" style={{ borderTop: "1px solid #FFBF6E" }}>
+            {Object.entries(part.input as Record<string, unknown>).map(([k, v]) => (
+              <div key={k} className="flex gap-2 text-[10px]">
+                <span style={{ color: "#FFBF6E" }}>{k}:</span>
+                <span className="font-medium" style={{ color: "#201515" }}>
+                  {typeof v === "string" ? v : JSON.stringify(v)}
+                </span>
+              </div>
+            ))}
+            {hasOutput && part.output && (
+              <div
+                className="mt-1.5 pt-1.5 text-[10px]"
+                style={{ borderTop: "1px solid #FFBF6E", color: "#4A7C2F" }}
+              >
+                →{" "}
+                {typeof part.output === "string"
+                  ? part.output
+                  : JSON.stringify(part.output).slice(0, 120)}
+              </div>
+            )}
+          </div>
+        </CollapsibleContent>
+      )}
+      {needsApproval && approvalId && (
+        <div
+          className="mt-2 flex items-center gap-2 pt-2"
+          style={{ borderTop: "1px solid #FFBF6E" }}
+        >
+          {autoApprove ? (
+            <span className="flex-1 text-[11px] italic" style={{ color: "#FFBF6E" }}>
+              Approving…
+            </span>
+          ) : (
+            <>
+              <span className="flex-1 text-[11px]" style={{ color: "#6B5050" }}>
+                Foreman needs your OK to create this.
               </span>
-            </div>
-          ))}
-          {hasOutput && part.output && (
-            <div
-              className="mt-1.5 pt-1.5 text-[10px]"
-              style={{ borderTop: "1px solid #FFBF6E", color: "#4A7C2F" }}
-            >
-              →{" "}
-              {typeof part.output === "string"
-                ? part.output
-                : JSON.stringify(part.output).slice(0, 120)}
-            </div>
+              <button
+                type="button"
+                onClick={() =>
+                  addToolApprovalResponse({
+                    id: approvalId,
+                    approved: false,
+                    reason: "Declined in demo",
+                  })
+                }
+                className="rounded-md px-2.5 py-1 text-[11px] font-medium"
+                style={{ color: "#6B5050", border: "1px solid #F0E8E0" }}
+              >
+                Not now
+              </button>
+              <button
+                type="button"
+                onClick={() => {
+                  onApproveFirst();
+                  addToolApprovalResponse({ id: approvalId, approved: true });
+                }}
+                className="rounded-md px-3 py-1 text-[11px] font-semibold text-white"
+                style={{ backgroundColor: "#FF4F00" }}
+              >
+                Approve
+              </button>
+            </>
           )}
         </div>
       )}
-    </button>
+    </Collapsible>
   );
 }
 
@@ -100,12 +262,13 @@ interface Props {
 }
 
 export function StepTry({ uses, onNext }: Props) {
-  const prompt = getPrompt(uses);
+  const demo = getDemo(uses);
   const [chatId] = useState(() => crypto.randomUUID());
   const [userId, setUserId] = useState<string>("");
   const [started, setStarted] = useState(false);
   const scrollRef = useRef<HTMLDivElement>(null);
   const [done, setDone] = useState(false);
+  const [autoApprove, setAutoApprove] = useState(false);
 
   useEffect(() => {
     createClient()
@@ -120,8 +283,19 @@ export function StepTry({ uses, onNext }: Props) {
     userIdRef.current = userId;
   }, [userId]);
 
-  const { messages, sendMessage, status } = useChat({
+  const { messages, sendMessage, status, addToolApprovalResponse } = useChat({
     id: chatId,
+    // Auto-fire the request when the user approves/declines a tool (mirrors the
+    // main chat) — otherwise the approval response is recorded but never sent.
+    sendAutomaticallyWhen: ({ messages: current }: any) => {
+      const last = current.at(-1);
+      return (
+        last?.parts?.some(
+          (p: any) =>
+            "state" in p && p.state === "approval-responded" && p.approval?.approved != null,
+        ) ?? false
+      );
+    },
     transport: new DefaultChatTransport({
       api: `${AGENT_URL}/chat/foreman`,
       fetch: async (input, init) => {
@@ -138,20 +312,40 @@ export function StepTry({ uses, onNext }: Props) {
         });
       },
       prepareSendMessagesRequest(request) {
+        // Tool approval/decline response → resume the run on the backend.
+        const approvalPart = request.messages
+          .flatMap((m) => m.parts ?? [])
+          .find(
+            (p: any) =>
+              "state" in p && p.state === "approval-responded" && p.approval?.approved != null,
+          ) as { approval: { id: string; approved: boolean; reason?: string } } | undefined;
+
+        if (approvalPart) {
+          return {
+            body: {
+              approveRunId: approvalPart.approval.id,
+              approved: approvalPart.approval.approved,
+              reason: approvalPart.approval.reason,
+              threadId: request.id,
+              resourceId: userIdRef.current,
+            },
+          };
+        }
+
         const lastMsg = request.messages.at(-1) as any;
-        // AI SDK may represent content as string or as parts array
         const text: string =
           (typeof lastMsg?.content === "string" && lastMsg.content) ||
           lastMsg?.parts
             ?.filter((p: any) => p.type === "text")
             .map((p: any) => p.text as string)
             .join("") ||
-          prompt;
+          demo.prompt;
         return {
           body: {
             messages: [{ role: "user", content: text }],
             threadId: request.id,
             resourceId: userIdRef.current,
+            model: DEMO_MODEL,
           },
         };
       },
@@ -161,7 +355,7 @@ export function StepTry({ uses, onNext }: Props) {
   const handleStart = () => {
     if (!started && userId) {
       setStarted(true);
-      sendMessage({ role: "user", content: prompt } as any);
+      sendMessage({ role: "user", content: demo.prompt } as any);
     }
   };
 
@@ -176,9 +370,47 @@ export function StepTry({ uses, onNext }: Props) {
     return () => observer.disconnect();
   }, []);
 
+  // "done" requires rows to have actually been written (a create-table-records
+  // tool with output) — not just any "ready" gap between tool steps, which used
+  // to latch done too early (Continue lit up before the table was built).
+  const hasPendingApproval = messages.some((m) =>
+    ((m as any).parts ?? []).some((p: any) => p?.state === "approval-requested" && p.approval?.id),
+  );
+  const recordsAdded = messages.some((m) =>
+    ((m as any).parts ?? []).some(
+      (p: any) =>
+        typeof p?.type === "string" &&
+        p.type.includes("create-table-records") &&
+        (p.state === "output-available" || p.output != null),
+    ),
+  );
+
+  useEffect(() => {
+    if (status === "ready" && !hasPendingApproval && recordsAdded) {
+      setDone(true);
+    }
+  }, [status, hasPendingApproval, recordsAdded]);
+
+  // One teaching approval: after the user approves the first action, auto-approve
+  // the follow-up steps of the same build (fields, records) so it completes
+  // smoothly instead of prompting three times.
+  const autoApprovedKeys = useRef(new Set<string>());
   useEffect(() => {
-    if (status === "ready" && messages.length > 1) setDone(true);
-  }, [status, messages.length]);
+    if (!autoApprove) return;
+    for (const m of messages) {
+      for (const p of (m as any).parts ?? []) {
+        const id = p?.approval?.id;
+        // Dedup by toolCallId (unique per call). approval.id is the *run* id —
+        // shared across every approval step of one run — so deduping on it would
+        // approve only the first follow-up tool and stall the rest.
+        const key: string | undefined = p?.toolCallId ?? id;
+        if (p?.state === "approval-requested" && id && key && !autoApprovedKeys.current.has(key)) {
+          autoApprovedKeys.current.add(key);
+          addToolApprovalResponse({ id, approved: true });
+        }
+      }
+    }
+  }, [autoApprove, messages, addToolApprovalResponse]);
 
   return (
     <div className="space-y-8">
@@ -187,10 +419,11 @@ export function StepTry({ uses, onNext }: Props) {
           Step 3 of 4
         </p>
         <h1 className="text-3xl font-bold tracking-tight" style={{ color: "#201515" }}>
-          Try it out
+          Watch Foreman build for you
         </h1>
         <p className="text-base" style={{ color: "#6B5050" }}>
-          Watch Foreman query your Zapier account in real time.
+          Foreman will create a <strong>{demo.table}</strong> table in your Zapier account — approve
+          it and watch it happen.
         </p>
       </div>
 
@@ -236,19 +469,19 @@ export function StepTry({ uses, onNext }: Props) {
         <div
           ref={scrollRef}
           className="p-4 space-y-3 overflow-y-auto [&::-webkit-scrollbar]:hidden"
-          style={{ minHeight: 200, maxHeight: 320 }}
+          style={{ minHeight: 200, maxHeight: 340 }}
         >
-          {/* Pre-start: show prompt as a clickable suggestion */}
+          {/* Pre-start: show the build action as a clickable button */}
           {!started && (
             <div className="flex h-full flex-col items-center justify-center gap-4 py-4">
               <p className="text-xs text-center" style={{ color: "#FFBF6E" }}>
-                Press the button below to see Foreman in action
+                Press the button to see Foreman build your first table
               </p>
-              <button
+              <Button
                 type="button"
                 onClick={handleStart}
                 disabled={!userId}
-                className="flex items-center gap-2 rounded-xl px-4 py-2.5 text-xs font-medium transition-all"
+                className="gap-2 rounded-xl px-4 py-2.5 text-xs font-medium"
                 style={{
                   backgroundColor: "#FFF3E6",
                   border: "1px solid #FFBF6E",
@@ -257,9 +490,9 @@ export function StepTry({ uses, onNext }: Props) {
                   cursor: userId ? "pointer" : "wait",
                 }}
               >
-                <span>{prompt}</span>
+                <span>Build my {demo.table} table</span>
                 <ArrowRight className="h-3 w-3 shrink-0" style={{ color: "#FF4F00" }} />
-              </button>
+              </Button>
             </div>
           )}
 
@@ -268,20 +501,19 @@ export function StepTry({ uses, onNext }: Props) {
               return (
                 <div key={msg.id} className="flex justify-end">
                   <div
-                    className="max-w-[75%] rounded-2xl rounded-br-sm px-3.5 py-2 text-xs leading-relaxed"
+                    className="max-w-[80%] rounded-2xl rounded-br-sm px-3.5 py-2 text-xs leading-relaxed"
                     style={{
                       backgroundColor: "#FFF3E6",
                       border: "1px solid #FFBF6E",
                       color: "#201515",
                     }}
                   >
-                    {(msg.parts as any[])?.find((p: any) => p.type === "text")?.text || prompt}
+                    Build my {demo.table} table
                   </div>
                 </div>
               );
             }
 
-            // Assistant message — render parts (AI SDK v6: tool parts are "tool-<toolName>")
             const parts: any[] = (msg as any).parts || [];
             return (
               <div key={msg.id} className="space-y-2">
@@ -289,19 +521,22 @@ export function StepTry({ uses, onNext }: Props) {
                   if (part.type?.startsWith("tool-")) {
                     const tn = part.type.replace(/^tool-/, "");
                     if (HIDDEN_TOOLS.has(tn)) return null;
-                    // biome-ignore lint/suspicious/noArrayIndexKey: parts array within a single message render — order is stable
-                    return <ToolCallBubble key={i} part={part} />;
+                    return (
+                      <ToolCallBubble
+                        // biome-ignore lint/suspicious/noArrayIndexKey: parts order is stable within a message
+                        key={i}
+                        addToolApprovalResponse={addToolApprovalResponse}
+                        autoApprove={autoApprove}
+                        onApproveFirst={() => setAutoApprove(true)}
+                        part={part}
+                      />
+                    );
                   }
                   if (part.type === "text" && part.text) {
                     return (
-                      // biome-ignore lint/suspicious/noArrayIndexKey: parts array within a single message render — order is stable
+                      // biome-ignore lint/suspicious/noArrayIndexKey: parts order is stable within a message
                       <div key={i} className="flex items-start gap-2.5">
-                        <div
-                          className="h-5 w-5 rounded-full flex items-center justify-center shrink-0 mt-px text-[9px] font-bold text-white"
-                          style={{ backgroundColor: "#FF4F00" }}
-                        >
-                          F
-                        </div>
+                        <BotAvatar />
                         <div
                           className="rounded-2xl rounded-tl-sm px-3.5 py-2 text-xs leading-relaxed max-w-[80%]"
                           style={{
@@ -317,18 +552,12 @@ export function StepTry({ uses, onNext }: Props) {
                   }
                   return null;
                 })}
-                {/* Fallback: assistant message with no structured parts */}
                 {parts.length === 0 &&
                   (() => {
                     const fallbackText = (msg as any).text || "";
                     return fallbackText ? (
                       <div className="flex items-start gap-2.5">
-                        <div
-                          className="h-5 w-5 rounded-full flex items-center justify-center shrink-0 mt-px text-[9px] font-bold text-white"
-                          style={{ backgroundColor: "#FF4F00" }}
-                        >
-                          F
-                        </div>
+                        <BotAvatar />
                         <div
                           className="rounded-2xl rounded-tl-sm px-3.5 py-2 text-xs leading-relaxed max-w-[80%]"
                           style={{
@@ -348,12 +577,7 @@ export function StepTry({ uses, onNext }: Props) {
 
           {status === "streaming" && messages.length <= 1 && (
             <div className="flex items-center gap-2">
-              <div
-                className="h-5 w-5 rounded-full flex items-center justify-center shrink-0 text-[9px] font-bold text-white"
-                style={{ backgroundColor: "#FF4F00" }}
-              >
-                F
-              </div>
+              <BotAvatar />
               <div className="flex gap-1">
                 {[0, 150, 300].map((delay) => (
                   <span
@@ -374,10 +598,12 @@ export function StepTry({ uses, onNext }: Props) {
           style={{ color: done ? "#4A7C2F" : started ? "#FFBF6E" : "#6B5050" }}
         >
           {done
-            ? "Foreman is connected."
+            ? `Your ${demo.table} table is ready.`
             : started
-              ? "Waiting for response…"
-              : "Click the prompt above to start"}
+              ? hasPendingApproval
+                ? "Approve the action above to continue…"
+                : "Working…"
+              : "Click the button above to start"}
         </p>
         <button
           type="button"
diff --git a/packages/web/src/components/onboarding/step-welcome.tsx b/packages/web/src/components/onboarding/step-welcome.tsx
index e54c2245..d29e9e74 100644
--- a/packages/web/src/components/onboarding/step-welcome.tsx
+++ b/packages/web/src/components/onboarding/step-welcome.tsx
@@ -1,6 +1,8 @@
 "use client";
 
 import { ArrowRight } from "lucide-react";
+import { useState } from "react";
+import { createClient } from "@/lib/client";
 
 const USE_CASES = [
   { id: "sales", label: "Sales tracking", emoji: "📊" },
@@ -21,10 +23,29 @@ interface Props {
 }
 
 export function StepWelcome({ selected, onSelect, onNext }: Props) {
+  const [name, setName] = useState("");
+  const [saving, setSaving] = useState(false);
+
   const toggle = (id: string) => {
     onSelect(selected.includes(id) ? selected.filter((s) => s !== id) : [...selected, id]);
   };
 
+  // Persist the display name (used by the chat greeting) before advancing. The
+  // name is optional — an empty value just skips the update.
+  const handleContinue = async () => {
+    const trimmed = name.trim();
+    if (trimmed) {
+      setSaving(true);
+      try {
+        await createClient().auth.updateUser({ data: { full_name: trimmed } });
+      } catch {
+        // Non-fatal: the user can still set their name later in Settings.
+      }
+      setSaving(false);
+    }
+    onNext();
+  };
+
   return (
     <div className="space-y-10">
       <div className="space-y-2">
@@ -35,30 +56,58 @@ export function StepWelcome({ selected, onSelect, onNext }: Props) {
           Welcome to Foreman
         </h1>
         <p className="text-base" style={{ color: "#6B5050" }}>
-          What do you want to automate? Pick everything that applies.
+          Let's get you set up — it only takes a minute.
         </p>
       </div>
 
-      <div className="grid grid-cols-3 gap-3">
-        {USE_CASES.map((uc) => {
-          const isSelected = selected.includes(uc.id);
-          return (
-            <button
-              type="button"
-              key={uc.id}
-              onClick={() => toggle(uc.id)}
-              className="flex flex-col items-center gap-2.5 rounded-xl px-4 py-5 text-left transition-all duration-150"
-              style={{
-                backgroundColor: isSelected ? "#FFF3E6" : "#FFFFFF",
-                border: `2px solid ${isSelected ? "#FF4F00" : "#F0E8E0"}`,
-                color: "#201515",
-              }}
-            >
-              <span className="text-2xl">{uc.emoji}</span>
-              <span className="text-xs font-semibold text-center leading-tight">{uc.label}</span>
-            </button>
-          );
-        })}
+      {/* Name */}
+      <div className="space-y-2">
+        <label
+          htmlFor="onboarding-name"
+          className="block text-sm font-semibold"
+          style={{ color: "#201515" }}
+        >
+          What should we call you?
+        </label>
+        <input
+          id="onboarding-name"
+          type="text"
+          value={name}
+          onChange={(e) => setName(e.target.value)}
+          placeholder="Your name"
+          autoComplete="given-name"
+          className="w-full max-w-sm rounded-xl px-4 py-2.5 text-sm outline-none focus:border-[#FF4F00]"
+          style={{ backgroundColor: "#FFFFFF", border: "2px solid #F0E8E0", color: "#201515" }}
+        />
+      </div>
+
+      {/* Use cases */}
+      <div className="space-y-3">
+        <p className="text-sm font-semibold" style={{ color: "#201515" }}>
+          What do you want to automate? Pick everything that applies.
+        </p>
+        <div className="grid grid-cols-3 gap-3">
+          {USE_CASES.map((uc) => {
+            const isSelected = selected.includes(uc.id);
+            return (
+              <button
+                type="button"
+                key={uc.id}
+                onClick={() => toggle(uc.id)}
+                aria-pressed={isSelected}
+                className="flex flex-col items-center gap-2.5 rounded-xl px-4 py-5 text-left transition-all duration-150"
+                style={{
+                  backgroundColor: isSelected ? "#FFF3E6" : "#FFFFFF",
+                  border: `2px solid ${isSelected ? "#FF4F00" : "#F0E8E0"}`,
+                  color: "#201515",
+                }}
+              >
+                <span className="text-2xl">{uc.emoji}</span>
+                <span className="text-xs font-semibold text-center leading-tight">{uc.label}</span>
+              </button>
+            );
+          })}
+        </div>
       </div>
 
       <div className="flex items-center justify-between pt-2">
@@ -69,15 +118,15 @@ export function StepWelcome({ selected, onSelect, onNext }: Props) {
         </p>
         <button
           type="button"
-          onClick={onNext}
-          disabled={selected.length === 0}
+          onClick={handleContinue}
+          disabled={selected.length === 0 || saving}
           className="flex items-center gap-2 rounded-lg px-6 py-2.5 text-sm font-semibold text-white transition-all"
           style={{
             backgroundColor: selected.length === 0 ? "#FFBF6E" : "#FF4F00",
-            cursor: selected.length === 0 ? "not-allowed" : "pointer",
+            cursor: selected.length === 0 || saving ? "not-allowed" : "pointer",
           }}
         >
-          Continue
+          {saving ? "Saving…" : "Continue"}
           <ArrowRight className="h-4 w-4" />
         </button>
       </div>
diff --git a/packages/web/src/components/settings/channel-connect-page.tsx b/packages/web/src/components/settings/channel-connect-page.tsx
index 496896d9..e74b41d4 100644
--- a/packages/web/src/components/settings/channel-connect-page.tsx
+++ b/packages/web/src/components/settings/channel-connect-page.tsx
@@ -1,7 +1,10 @@
 "use client";
 
 import Link from "next/link";
-import { useCallback, useEffect, useRef, useState } from "react";
+import { useEffect, useRef, useState } from "react";
+import { CopyButton } from "@/components/copy-button";
+import { Alert, AlertDescription } from "@/components/ui/alert";
+import { Button } from "@/components/ui/button";
 import { createClient } from "@/lib/client";
 
 interface Props {
@@ -35,25 +38,6 @@ function formatSecondsLeft(ms: number) {
   return `${m}:${sec.toString().padStart(2, "0")}`;
 }
 
-function CopyButton({ text, label }: { text: string; label: string }) {
-  const [copied, setCopied] = useState(false);
-  const copy = useCallback(() => {
-    navigator.clipboard.writeText(text);
-    setCopied(true);
-    setTimeout(() => setCopied(false), 2000);
-  }, [text]);
-  return (
-    <button
-      type="button"
-      onClick={copy}
-      className="text-xs px-2 py-1 rounded transition-colors"
-      style={{ backgroundColor: "#FFF3E6", color: copied ? "#065f46" : "#FF4F00" }}
-    >
-      {copied ? "Copied!" : label}
-    </button>
-  );
-}
-
 export function ChannelConnectPage({
   channel,
   displayName,
@@ -224,35 +208,31 @@ export function ChannelConnectPage({
 
       {/* Bot connected banner */}
       {botConnected && (
-        <div
-          className="rounded-lg px-4 py-3 text-sm"
-          style={{ backgroundColor: "#d1fae5", border: "1.5px solid #6ee7b7", color: "#065f46" }}
-        >
-          ✓ {displayName} bot connected to your workspace. Now complete step 2 below to link your
-          personal account.
-        </div>
+        <Alert>
+          <AlertDescription>
+            ✓ {displayName} bot connected to your workspace. Now complete step 2 below to link your
+            personal account.
+          </AlertDescription>
+        </Alert>
       )}
 
       {/* Bot link */}
       {botLink ? (
-        <a
-          href={botLink}
-          target="_blank"
-          rel="noopener noreferrer"
-          className="inline-flex items-center gap-2 rounded-lg px-4 py-2.5 text-sm font-medium text-white transition-opacity hover:opacity-90"
-          style={{ backgroundColor: "#201515" }}
-        >
-          {botLinkLabel} ↗
-        </a>
+        <Button asChild>
+          <a href={botLink} target="_blank" rel="noopener noreferrer">
+            {botLinkLabel} ↗
+          </a>
+        </Button>
       ) : (
-        <div
-          className="rounded-lg px-4 py-3 text-sm"
-          style={{ backgroundColor: "#fff7ed", border: "1.5px solid #FFBF6E", color: "#92400e" }}
-        >
-          {displayName} bot not configured. Set{" "}
-          <code className="font-mono text-xs">NEXT_PUBLIC_{channel.toUpperCase()}_INSTALL_URL</code>{" "}
-          to enable the install link.
-        </div>
+        <Alert variant="destructive">
+          <AlertDescription>
+            {displayName} bot not configured. Set{" "}
+            <code className="font-mono text-xs">
+              NEXT_PUBLIC_{channel.toUpperCase()}_INSTALL_URL
+            </code>{" "}
+            to enable the install link.
+          </AlertDescription>
+        </Alert>
       )}
 
       {/* Steps */}
@@ -288,15 +268,9 @@ export function ChannelConnectPage({
         </h2>
 
         {!code ? (
-          <button
-            type="button"
-            onClick={generateCode}
-            disabled={generating}
-            className="rounded-lg px-5 py-2.5 text-sm font-medium text-white disabled:opacity-60 transition-opacity"
-            style={{ backgroundColor: "#FF4F00" }}
-          >
+          <Button type="button" onClick={generateCode} disabled={generating}>
             {generating ? "Generating…" : "Generate Link Code"}
-          </button>
+          </Button>
         ) : (
           <div className="space-y-3">
             <div className="flex items-center gap-3 flex-wrap">
@@ -306,7 +280,7 @@ export function ChannelConnectPage({
               >
                 {code}
               </span>
-              <CopyButton text={`${linkCommand} ${code}`} label="Copy command" />
+              <CopyButton value={`${linkCommand} ${code}`} label="Copy command" />
             </div>
             <p className="text-xs" style={{ color: "#888" }}>
               Copy the command above, then open the Foreman bot in {displayName} and paste it.{" "}
@@ -321,18 +295,19 @@ export function ChannelConnectPage({
                 Waiting for confirmation…
               </p>
             )}
-            <button
+            <Button
               type="button"
+              variant="link"
+              size="xs"
+              className="px-0 text-muted-foreground"
               onClick={() => {
                 setCode(null);
                 setExpiresAt(null);
                 stopPolling();
               }}
-              className="text-xs underline"
-              style={{ color: "#aaa" }}
             >
               Cancel
-            </button>
+            </Button>
           </div>
         )}
       </div>
diff --git a/packages/web/src/components/settings/integrations-hub.tsx b/packages/web/src/components/settings/integrations-hub.tsx
index cf210ce3..2b7957f0 100644
--- a/packages/web/src/components/settings/integrations-hub.tsx
+++ b/packages/web/src/components/settings/integrations-hub.tsx
@@ -11,6 +11,7 @@ import {
 import { HugeiconsIcon } from "@hugeicons/react";
 import Link from "next/link";
 import { BRAND_COLORS } from "@/components/icons/brands";
+import { Badge } from "@/components/ui/badge";
 
 interface Props {
   connectedChannels: string[];
@@ -113,22 +114,8 @@ export function IntegrationsHub({ connectedChannels }: Props) {
                     <span className="text-sm font-semibold" style={{ color: "#201515" }}>
                       {ch.label}
                     </span>
-                    {connected && (
-                      <span
-                        className="rounded-full px-2 py-0.5 text-xs font-medium"
-                        style={{ backgroundColor: "#d1fae5", color: "#065f46" }}
-                      >
-                        Connected
-                      </span>
-                    )}
-                    {!ch.available && (
-                      <span
-                        className="rounded-full px-2 py-0.5 text-xs font-medium"
-                        style={{ backgroundColor: "#f3f4f6", color: "#6b7280" }}
-                      >
-                        Coming soon
-                      </span>
-                    )}
+                    {connected && <Badge variant="secondary">Connected</Badge>}
+                    {!ch.available && <Badge variant="outline">Coming soon</Badge>}
                   </div>
                   <p className="text-xs mt-0.5" style={{ color: "#888" }}>
                     {ch.description}
diff --git a/packages/web/src/components/settings/mcp-page.tsx b/packages/web/src/components/settings/mcp-page.tsx
index e3a7b6f5..37a95af8 100644
--- a/packages/web/src/components/settings/mcp-page.tsx
+++ b/packages/web/src/components/settings/mcp-page.tsx
@@ -1,6 +1,13 @@
 "use client";
 
 import { useEffect, useState } from "react";
+import { CopyButton } from "@/components/copy-button";
+import { Alert, AlertDescription, AlertTitle } from "@/components/ui/alert";
+import { Button } from "@/components/ui/button";
+import { Empty, EmptyDescription, EmptyHeader, EmptyTitle } from "@/components/ui/empty";
+import { Field, FieldLabel } from "@/components/ui/field";
+import { Input } from "@/components/ui/input";
+import { Skeleton } from "@/components/ui/skeleton";
 import { createClient } from "@/lib/client";
 
 interface ApiKey {
@@ -17,24 +24,6 @@ interface Props {
 
 const AGENT_URL = process.env.NEXT_PUBLIC_AGENT_SERVER_URL || "http://localhost:4111";
 
-function CopyButton({ text }: { text: string }) {
-  const [copied, setCopied] = useState(false);
-  return (
-    <button
-      type="button"
-      onClick={() => {
-        navigator.clipboard.writeText(text);
-        setCopied(true);
-        setTimeout(() => setCopied(false), 2000);
-      }}
-      className="text-xs px-2 py-1 rounded transition-colors"
-      style={{ backgroundColor: "#FFF3E6", color: "#FF4F00" }}
-    >
-      {copied ? "Copied!" : "Copy"}
-    </button>
-  );
-}
-
 function CodeBlock({ code }: { code: string }) {
   return (
     <div
@@ -43,7 +32,7 @@ function CodeBlock({ code }: { code: string }) {
     >
       <pre>{code}</pre>
       <div className="absolute top-2 right-2">
-        <CopyButton text={code} />
+        <CopyButton value={code} />
       </div>
     </div>
   );
@@ -56,6 +45,7 @@ export function McpPage({ mcpUrl }: Props) {
   const [creating, setCreating] = useState(false);
   const [revealedKey, setRevealedKey] = useState<{ id: string; key: string } | null>(null);
   const [revoking, setRevoking] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(null);
 
   async function getToken() {
     const supabase = createClient();
@@ -87,6 +77,7 @@ export function McpPage({ mcpUrl }: Props) {
     const name = newKeyName.trim();
     if (!name) return;
     setCreating(true);
+    setError(null);
     try {
       const token = await getToken();
       const res = await fetch(`${AGENT_URL}/api-keys`, {
@@ -94,7 +85,10 @@ export function McpPage({ mcpUrl }: Props) {
         headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
         body: JSON.stringify({ name }),
       });
-      if (!res.ok) return;
+      if (!res.ok) {
+        setError("Couldn't create the API key. Please try again.");
+        return;
+      }
       const data = await res.json();
       setRevealedKey({ id: data.id, key: data.key });
       setKeys((k) => [
@@ -108,6 +102,8 @@ export function McpPage({ mcpUrl }: Props) {
         ...k,
       ]);
       setNewKeyName("");
+    } catch {
+      setError("Couldn't create the API key. Please try again.");
     } finally {
       setCreating(false);
     }
@@ -115,14 +111,21 @@ export function McpPage({ mcpUrl }: Props) {
 
   async function revokeKey(id: string) {
     setRevoking(id);
+    setError(null);
     try {
       const token = await getToken();
-      await fetch(`${AGENT_URL}/api-keys/${id}`, {
+      const res = await fetch(`${AGENT_URL}/api-keys/${id}`, {
         method: "DELETE",
         headers: { Authorization: `Bearer ${token}` },
       });
+      if (!res.ok) {
+        setError("Couldn't revoke the API key. Please try again.");
+        return;
+      }
       setKeys((k) => k.filter((key) => key.id !== id));
       if (revealedKey?.id === id) setRevealedKey(null);
+    } catch {
+      setError("Couldn't revoke the API key. Please try again.");
     } finally {
       setRevoking(null);
     }
@@ -179,7 +182,7 @@ export function McpPage({ mcpUrl }: Props) {
           <span className="flex-1 font-mono text-sm truncate" style={{ color: "#201515" }}>
             {mcpUrl}
           </span>
-          <CopyButton text={mcpUrl} />
+          <CopyButton value={mcpUrl} />
         </div>
       </div>
 
@@ -190,27 +193,31 @@ export function McpPage({ mcpUrl }: Props) {
         </h2>
 
         {/* Create form */}
-        <div className="flex gap-2 mb-4">
-          <input
-            type="text"
-            placeholder="Key name (e.g. Claude Desktop)"
-            value={newKeyName}
-            onChange={(e) => setNewKeyName(e.target.value)}
-            onKeyDown={(e) => e.key === "Enter" && createKey()}
-            className="flex-1 rounded-lg px-3 py-2 text-sm outline-none"
-            style={{ border: "1.5px solid #FFF3E6", backgroundColor: "#fff", color: "#201515" }}
-          />
-          <button
-            type="button"
-            onClick={createKey}
-            disabled={creating || !newKeyName.trim()}
-            className="rounded-lg px-4 py-2 text-sm font-medium text-white disabled:opacity-50 transition-opacity"
-            style={{ backgroundColor: "#FF4F00" }}
-          >
+        <div className="flex items-end gap-2 mb-4">
+          <Field className="flex-1">
+            <FieldLabel htmlFor="new-key-name">Key name</FieldLabel>
+            <Input
+              id="new-key-name"
+              type="text"
+              placeholder="Key name (e.g. Claude Desktop)"
+              value={newKeyName}
+              onChange={(e) => setNewKeyName(e.target.value)}
+              onKeyDown={(e) => e.key === "Enter" && createKey()}
+            />
+          </Field>
+          <Button type="button" onClick={createKey} disabled={creating || !newKeyName.trim()}>
             {creating ? "Creating…" : "Create Key"}
-          </button>
+          </Button>
         </div>
 
+        {/* Error */}
+        {error && (
+          <Alert variant="destructive" className="mb-4">
+            <AlertTitle>Something went wrong</AlertTitle>
+            <AlertDescription>{error}</AlertDescription>
+          </Alert>
+        )}
+
         {/* Revealed key banner */}
         {revealedKey && (
           <div
@@ -224,7 +231,7 @@ export function McpPage({ mcpUrl }: Props) {
               <code className="flex-1 font-mono text-sm break-all" style={{ color: "#201515" }}>
                 {revealedKey.key}
               </code>
-              <CopyButton text={revealedKey.key} />
+              <CopyButton value={revealedKey.key} />
             </div>
           </div>
         )}
@@ -232,14 +239,21 @@ export function McpPage({ mcpUrl }: Props) {
         {/* Key list */}
         <div className="space-y-2">
           {loading && (
-            <p className="text-sm py-4 text-center" style={{ color: "#aaa" }}>
-              Loading…
-            </p>
+            <>
+              <Skeleton className="h-[60px] w-full rounded-lg" />
+              <Skeleton className="h-[60px] w-full rounded-lg" />
+              <Skeleton className="h-[60px] w-full rounded-lg" />
+            </>
           )}
           {!loading && keys.length === 0 && (
-            <p className="text-sm py-4 text-center" style={{ color: "#aaa" }}>
-              No API keys yet.
-            </p>
+            <Empty>
+              <EmptyHeader>
+                <EmptyTitle>No API keys yet</EmptyTitle>
+                <EmptyDescription>
+                  Create a key above to connect an MCP client to Foreman.
+                </EmptyDescription>
+              </EmptyHeader>
+            </Empty>
           )}
           {keys.map((k) => (
             <div
@@ -258,15 +272,15 @@ export function McpPage({ mcpUrl }: Props) {
                     : " · Never used"}
                 </p>
               </div>
-              <button
+              <Button
                 type="button"
+                variant="destructive"
+                size="sm"
                 onClick={() => revokeKey(k.id)}
                 disabled={revoking === k.id}
-                className="text-xs px-3 py-1.5 rounded-lg transition-colors disabled:opacity-50"
-                style={{ backgroundColor: "#fee2e2", color: "#dc2626" }}
               >
                 {revoking === k.id ? "Revoking…" : "Revoke"}
-              </button>
+              </Button>
             </div>
           ))}
         </div>
diff --git a/packages/web/src/components/settings/profile-form.tsx b/packages/web/src/components/settings/profile-form.tsx
new file mode 100644
index 00000000..78f85dfc
--- /dev/null
+++ b/packages/web/src/components/settings/profile-form.tsx
@@ -0,0 +1,88 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import { Alert, AlertDescription } from "@/components/ui/alert";
+import { Button } from "@/components/ui/button";
+import { Field, FieldDescription, FieldLabel } from "@/components/ui/field";
+import { Input } from "@/components/ui/input";
+import { Skeleton } from "@/components/ui/skeleton";
+import { createClient } from "@/lib/client";
+
+function nameFromMetadata(metadata: Record<string, unknown> | undefined): string {
+  const value = metadata?.full_name ?? metadata?.name;
+  return typeof value === "string" ? value : "";
+}
+
+export function ProfileForm() {
+  const [name, setName] = useState("");
+  const [saved, setSaved] = useState("");
+  const [loading, setLoading] = useState(true);
+  const [saving, setSaving] = useState(false);
+  const [status, setStatus] = useState<{ type: "ok" | "err"; message: string } | null>(null);
+
+  useEffect(() => {
+    createClient()
+      .auth.getUser()
+      .then(({ data: { user } }) => {
+        const current = nameFromMetadata(user?.user_metadata);
+        setName(current);
+        setSaved(current);
+      })
+      .catch(() => {})
+      .finally(() => setLoading(false));
+  }, []);
+
+  async function handleSave() {
+    setSaving(true);
+    setStatus(null);
+    const trimmed = name.trim();
+    const { error } = await createClient().auth.updateUser({ data: { full_name: trimmed } });
+    setSaving(false);
+    if (error) {
+      setStatus({ type: "err", message: error.message });
+      return;
+    }
+    setSaved(trimmed);
+    setStatus({ type: "ok", message: "Profile updated." });
+  }
+
+  const dirty = name.trim() !== saved.trim();
+
+  return (
+    <div className="space-y-6">
+      <div className="space-y-1">
+        <h1 className="font-semibold text-lg">Profile</h1>
+        <p className="text-muted-foreground text-sm">
+          Your display name is used to greet you in chat.
+        </p>
+      </div>
+
+      {status && (
+        <Alert variant={status.type === "err" ? "destructive" : "default"}>
+          <AlertDescription>{status.message}</AlertDescription>
+        </Alert>
+      )}
+
+      {loading ? (
+        <Skeleton className="h-9 w-full max-w-sm rounded-md" />
+      ) : (
+        <Field className="max-w-sm">
+          <FieldLabel htmlFor="display-name">Display name</FieldLabel>
+          <Input
+            disabled={saving}
+            id="display-name"
+            maxLength={60}
+            onChange={(e) => setName(e.target.value)}
+            placeholder="e.g. Alex"
+            value={name}
+          />
+          <FieldDescription>We'll greet you by your first name.</FieldDescription>
+        </Field>
+      )}
+
+      <Button disabled={loading || saving || !dirty} onClick={handleSave}>
+        {saving ? "Saving…" : "Save"}
+      </Button>
+    </div>
+  );
+}
diff --git a/packages/web/src/components/settings/settings-shell.tsx b/packages/web/src/components/settings/settings-shell.tsx
index 69e7603e..a7a82d51 100644
--- a/packages/web/src/components/settings/settings-shell.tsx
+++ b/packages/web/src/components/settings/settings-shell.tsx
@@ -5,67 +5,46 @@ import { usePathname } from "next/navigation";
 import { cn } from "@/lib/utils";
 
 const NAV = [
+  { label: "Profile", href: "/settings/profile" },
   { label: "Integrations", href: "/settings/integrations" },
   { label: "API Keys", href: "/settings/integrations/mcp" },
 ];
 
 export function SettingsShell({ children }: { children: React.ReactNode }) {
   const pathname = usePathname();
+  // Only the single most-specific matching nav item is active (longest matching
+  // href), so a sub-route like /settings/integrations/mcp doesn't also light up
+  // its parent /settings/integrations.
+  const activeHref =
+    NAV.map((n) => n.href)
+      .filter((h) => pathname === h || pathname.startsWith(`${h}/`))
+      .sort((a, b) => b.length - a.length)[0] ?? null;
 
   return (
-    <div className="min-h-svh flex flex-col" style={{ backgroundColor: "#FFFDF9" }}>
-      {/* Header */}
-      <div
-        className="flex items-center gap-4 px-8 py-4"
-        style={{ borderBottom: "1px solid #FFF3E6" }}
-      >
-        <Link href="/chat" className="flex items-center gap-2.5">
-          <span
-            className="inline-flex h-7 w-7 items-center justify-center rounded-md text-white text-sm font-bold"
-            style={{ backgroundColor: "#FF4F00" }}
-          >
-            F
-          </span>
-          <span className="text-sm font-semibold tracking-tight" style={{ color: "#201515" }}>
-            Foreman
-          </span>
-        </Link>
-        <span className="text-sm" style={{ color: "#FFBF6E" }}>
-          /
-        </span>
-        <span className="text-sm font-medium" style={{ color: "#201515" }}>
-          Settings
-        </span>
-      </div>
-
-      <div className="flex flex-1">
-        {/* Sidebar */}
-        <aside className="w-52 shrink-0 px-4 py-8" style={{ borderRight: "1px solid #FFF3E6" }}>
-          <nav className="flex flex-col gap-1">
-            {NAV.map(({ label, href }) => {
-              const active =
-                pathname === href || (href !== "/settings" && pathname.startsWith(href));
-              return (
-                <Link
-                  key={href}
-                  href={href}
-                  className={cn(
-                    "rounded-lg px-3 py-2 text-sm font-medium transition-colors",
-                    active ? "text-white" : "hover:bg-black/5",
-                  )}
-                  style={
-                    active ? { backgroundColor: "#FF4F00", color: "#fff" } : { color: "#201515" }
-                  }
-                >
-                  {label}
-                </Link>
-              );
-            })}
-          </nav>
-        </aside>
-
-        {/* Content */}
-        <main className="flex-1 px-10 py-8 max-w-3xl">{children}</main>
+    <div className="mx-auto w-full max-w-4xl px-4 py-8 sm:px-6">
+      <h1 className="mb-6 font-semibold text-2xl tracking-tight">Settings</h1>
+      <div className="flex flex-col gap-6 md:flex-row md:gap-8">
+        <nav className="flex flex-row gap-1 overflow-x-auto md:w-48 md:flex-col md:overflow-visible [&::-webkit-scrollbar]:hidden">
+          {NAV.map(({ label, href }) => {
+            const active = href === activeHref;
+            return (
+              <Link
+                key={href}
+                href={href}
+                aria-current={active ? "page" : undefined}
+                className={cn(
+                  "shrink-0 whitespace-nowrap rounded-lg px-3 py-2 text-sm font-medium transition-colors",
+                  active
+                    ? "bg-accent text-accent-foreground"
+                    : "text-muted-foreground hover:bg-surface hover:text-foreground",
+                )}
+              >
+                {label}
+              </Link>
+            );
+          })}
+        </nav>
+        <div className="min-w-0 max-w-2xl flex-1">{children}</div>
       </div>
     </div>
   );
diff --git a/packages/web/src/components/sign-up-form.tsx b/packages/web/src/components/sign-up-form.tsx
index 35229ba1..5dd9e7f9 100644
--- a/packages/web/src/components/sign-up-form.tsx
+++ b/packages/web/src/components/sign-up-form.tsx
@@ -3,9 +3,10 @@
 import Link from "next/link";
 import { useRouter } from "next/navigation";
 import { useState } from "react";
+import { Alert, AlertDescription } from "@/components/ui/alert";
 import { Button } from "@/components/ui/button";
+import { Field, FieldLabel } from "@/components/ui/field";
 import { Input } from "@/components/ui/input";
-import { Label } from "@/components/ui/label";
 import { createClient } from "@/lib/client";
 
 export function SignUpForm() {
@@ -51,10 +52,10 @@ export function SignUpForm() {
       </div>
 
       <form onSubmit={handleSignUp} className="space-y-5">
-        <div className="space-y-1.5">
-          <Label htmlFor="email" className="text-sm font-medium">
+        <Field>
+          <FieldLabel htmlFor="email" className="text-sm font-medium">
             Email
-          </Label>
+          </FieldLabel>
           <Input
             id="email"
             type="email"
@@ -65,12 +66,12 @@ export function SignUpForm() {
             onChange={(e) => setEmail(e.target.value)}
             className="h-10 rounded-md"
           />
-        </div>
+        </Field>
 
-        <div className="space-y-1.5">
-          <Label htmlFor="password" className="text-sm font-medium">
+        <Field>
+          <FieldLabel htmlFor="password" className="text-sm font-medium">
             Password
-          </Label>
+          </FieldLabel>
           <Input
             id="password"
             type="password"
@@ -81,12 +82,12 @@ export function SignUpForm() {
             onChange={(e) => setPassword(e.target.value)}
             className="h-10 rounded-md"
           />
-        </div>
+        </Field>
 
-        <div className="space-y-1.5">
-          <Label htmlFor="repeat-password" className="text-sm font-medium">
+        <Field>
+          <FieldLabel htmlFor="repeat-password" className="text-sm font-medium">
             Confirm password
-          </Label>
+          </FieldLabel>
           <Input
             id="repeat-password"
             type="password"
@@ -97,12 +98,12 @@ export function SignUpForm() {
             onChange={(e) => setRepeatPassword(e.target.value)}
             className="h-10 rounded-md"
           />
-        </div>
+        </Field>
 
         {error && (
-          <p className="text-sm text-red-500 bg-red-500/5 border border-red-500/20 rounded-md px-3 py-2">
-            {error}
-          </p>
+          <Alert variant="destructive">
+            <AlertDescription>{error}</AlertDescription>
+          </Alert>
         )}
 
         <Button
diff --git a/packages/web/src/components/ui/dropdown-menu.tsx b/packages/web/src/components/ui/dropdown-menu.tsx
index 60443b4c..10fdb42a 100644
--- a/packages/web/src/components/ui/dropdown-menu.tsx
+++ b/packages/web/src/components/ui/dropdown-menu.tsx
@@ -216,14 +216,18 @@ function DropdownMenuSubContent({
   ...props
 }: React.ComponentProps<typeof DropdownMenuPrimitive.SubContent>) {
   return (
-    <DropdownMenuPrimitive.SubContent
-      data-slot="dropdown-menu-sub-content"
-      className={cn(
-        "z-50 min-w-36 origin-(--radix-dropdown-menu-content-transform-origin) overflow-hidden rounded-2xl bg-popover p-1 text-popover-foreground shadow-2xl ring-1 ring-foreground/5 duration-100 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 data-open:animate-in data-open:fade-in-0 data-open:zoom-in-95 data-closed:animate-out data-closed:fade-out-0 data-closed:zoom-out-95",
-        className,
-      )}
-      {...props}
-    />
+    // Portal the flyout to the body so it isn't clipped by the parent
+    // DropdownMenuContent's `overflow-*` (which otherwise hides the submenu).
+    <DropdownMenuPrimitive.Portal>
+      <DropdownMenuPrimitive.SubContent
+        data-slot="dropdown-menu-sub-content"
+        className={cn(
+          "z-50 min-w-36 origin-(--radix-dropdown-menu-content-transform-origin) overflow-hidden rounded-2xl bg-popover p-1 text-popover-foreground shadow-2xl ring-1 ring-foreground/5 duration-100 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 data-open:animate-in data-open:fade-in-0 data-open:zoom-in-95 data-closed:animate-out data-closed:fade-out-0 data-closed:zoom-out-95",
+          className,
+        )}
+        {...props}
+      />
+    </DropdownMenuPrimitive.Portal>
   );
 }
 
diff --git a/packages/web/src/components/ui/sidebar.tsx b/packages/web/src/components/ui/sidebar.tsx
index 3f9eee1c..1beb7859 100644
--- a/packages/web/src/components/ui/sidebar.tsx
+++ b/packages/web/src/components/ui/sidebar.tsx
@@ -225,7 +225,7 @@ function Sidebar({
           // Adjust the padding for floating and inset variants.
           variant === "floating" || variant === "inset"
             ? "p-2 group-data-[collapsible=icon]:w-[calc(var(--sidebar-width-icon)+(--spacing(4))+2px)]"
-            : "group-data-[collapsible=icon]:w-(--sidebar-width-icon) group-data-[side=left]:border-r group-data-[side=right]:border-l",
+            : "group-data-[collapsible=icon]:w-(--sidebar-width-icon)",
           className,
         )}
         {...props}
@@ -445,7 +445,7 @@ function SidebarMenuItem({ className, ...props }: React.ComponentProps<"li">) {
 }
 
 const sidebarMenuButtonVariants = cva(
-  "peer/menu-button group/menu-button flex w-full items-center gap-2 overflow-hidden rounded-lg px-3 py-2 text-left text-sm ring-sidebar-ring outline-hidden transition-[width,height,padding] group-has-data-[sidebar=menu-action]/menu-item:pr-8 group-data-[collapsible=icon]:size-8! group-data-[collapsible=icon]:p-2! hover:bg-sidebar-accent hover:text-sidebar-accent-foreground focus-visible:ring-2 active:bg-sidebar-accent active:text-sidebar-accent-foreground disabled:pointer-events-none disabled:opacity-50 aria-disabled:pointer-events-none aria-disabled:opacity-50 data-open:hover:bg-sidebar-accent data-open:hover:text-sidebar-accent-foreground data-active:bg-sidebar-accent data-active:font-medium data-active:text-sidebar-accent-foreground [&_svg]:size-4 [&_svg]:shrink-0 [&>span:last-child]:truncate",
+  "peer/menu-button group/menu-button flex w-full items-center gap-2 overflow-hidden rounded-lg px-3 py-2 text-left text-sm ring-sidebar-ring outline-hidden transition-[width,height,padding] group-has-data-[sidebar=menu-action]/menu-item:pr-8 group-data-[collapsible=icon]:size-8! group-data-[collapsible=icon]:p-2! hover:bg-sidebar-accent hover:text-sidebar-accent-foreground focus-visible:ring-2 active:bg-sidebar-accent active:text-sidebar-accent-foreground disabled:pointer-events-none disabled:opacity-50 aria-disabled:pointer-events-none aria-disabled:opacity-50 data-open:hover:bg-sidebar-accent data-open:hover:text-sidebar-accent-foreground data-[active=true]:bg-sidebar-accent data-[active=true]:font-medium data-[active=true]:text-sidebar-accent-foreground [&_svg]:size-4 [&_svg]:shrink-0 [&>span:last-child]:truncate",
   {
     variants: {
       variant: {
diff --git a/packages/web/src/components/update-password-form.tsx b/packages/web/src/components/update-password-form.tsx
index 57e18cde..27e8e385 100644
--- a/packages/web/src/components/update-password-form.tsx
+++ b/packages/web/src/components/update-password-form.tsx
@@ -2,10 +2,11 @@
 
 import { useRouter } from "next/navigation";
 import { useState } from "react";
+import { Alert, AlertDescription } from "@/components/ui/alert";
 import { Button } from "@/components/ui/button";
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { Field, FieldLabel } from "@/components/ui/field";
 import { Input } from "@/components/ui/input";
-import { Label } from "@/components/ui/label";
 import { createClient } from "@/lib/client";
 import { cn } from "@/lib/utils";
 
@@ -43,8 +44,8 @@ export function UpdatePasswordForm({ className, ...props }: React.ComponentProps
         <CardContent>
           <form onSubmit={handleForgotPassword}>
             <div className="flex flex-col gap-6">
-              <div className="grid gap-2">
-                <Label htmlFor="password">New password</Label>
+              <Field>
+                <FieldLabel htmlFor="password">New password</FieldLabel>
                 <Input
                   id="password"
                   type="password"
@@ -53,8 +54,12 @@ export function UpdatePasswordForm({ className, ...props }: React.ComponentProps
                   value={password}
                   onChange={(e) => setPassword(e.target.value)}
                 />
-              </div>
-              {error && <p className="text-sm text-red-500">{error}</p>}
+              </Field>
+              {error && (
+                <Alert variant="destructive">
+                  <AlertDescription>{error}</AlertDescription>
+                </Alert>
+              )}
               <Button type="submit" className="w-full" disabled={isLoading}>
                 {isLoading ? "Saving..." : "Save new password"}
               </Button>
diff --git a/packages/web/src/components/workflows/trigger-controls.tsx b/packages/web/src/components/workflows/trigger-controls.tsx
deleted file mode 100644
index 54bc65b5..00000000
--- a/packages/web/src/components/workflows/trigger-controls.tsx
+++ /dev/null
@@ -1,85 +0,0 @@
-"use client";
-
-import { useRouter } from "next/navigation";
-import { useState, useTransition } from "react";
-import type { WorkflowTrigger } from "@/lib/workflows-client";
-
-export function TriggerControls({
-  workflowId,
-  trigger,
-}: {
-  workflowId: string;
-  trigger: WorkflowTrigger;
-}) {
-  const router = useRouter();
-  const [enabled, setEnabled] = useState(trigger.enabled);
-  const [pending, startTransition] = useTransition();
-  const [busy, setBusy] = useState(false);
-  const [err, setErr] = useState<string | null>(null);
-
-  async function toggle() {
-    setBusy(true);
-    setErr(null);
-    const next = !enabled;
-    const res = await fetch(`/api/workflows/${workflowId}/triggers/${trigger.id}`, {
-      method: "PATCH",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ enabled: next }),
-    });
-    setBusy(false);
-    if (!res.ok) {
-      setErr(`Toggle failed: ${res.status}`);
-      return;
-    }
-    setEnabled(next);
-    startTransition(() => router.refresh());
-  }
-
-  async function detach() {
-    if (!confirm("Detach this trigger? The workflow won't be deleted.")) return;
-    setBusy(true);
-    setErr(null);
-    const res = await fetch(`/api/workflows/${workflowId}/triggers/${trigger.id}`, {
-      method: "DELETE",
-    });
-    setBusy(false);
-    if (!res.ok) {
-      setErr(`Detach failed: ${res.status}`);
-      return;
-    }
-    startTransition(() => router.refresh());
-  }
-
-  return (
-    <div className="flex items-center gap-2">
-      <button
-        type="button"
-        onClick={toggle}
-        disabled={busy || pending}
-        className="rounded border px-3 py-1 text-xs font-medium"
-        style={{
-          borderColor: "#FFD7B5",
-          backgroundColor: enabled ? "#FF4F00" : "#FFF",
-          color: enabled ? "#FFF" : "#201515",
-        }}
-        aria-pressed={enabled}
-      >
-        {enabled ? "Enabled" : "Disabled"}
-      </button>
-      <button
-        type="button"
-        onClick={detach}
-        disabled={busy || pending}
-        className="rounded border px-3 py-1 text-xs font-medium"
-        style={{ borderColor: "#FFD7B5", color: "#A61B1B" }}
-      >
-        Detach
-      </button>
-      {err ? (
-        <span className="text-xs" style={{ color: "#A61B1B" }}>
-          {err}
-        </span>
-      ) : null}
-    </div>
-  );
-}
diff --git a/packages/web/src/components/workflows/workflow-detail-actions.tsx b/packages/web/src/components/workflows/workflow-detail-actions.tsx
deleted file mode 100644
index 354ee546..00000000
--- a/packages/web/src/components/workflows/workflow-detail-actions.tsx
+++ /dev/null
@@ -1,146 +0,0 @@
-"use client";
-
-import { useRouter } from "next/navigation";
-import { useState, useTransition } from "react";
-
-export function WorkflowDetailActions({
-  workflowId,
-  currentName,
-}: {
-  workflowId: string;
-  currentName: string;
-}) {
-  const router = useRouter();
-  const [name, setName] = useState(currentName);
-  const [editing, setEditing] = useState(false);
-  const [running, setRunning] = useState(false);
-  const [pending, startTransition] = useTransition();
-  const [err, setErr] = useState<string | null>(null);
-
-  async function rename() {
-    if (name.trim() === currentName || name.trim().length === 0) {
-      setEditing(false);
-      return;
-    }
-    setErr(null);
-    const res = await fetch(`/api/workflows/${workflowId}`, {
-      method: "PATCH",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ name: name.trim() }),
-    });
-    if (!res.ok) {
-      setErr(`Rename failed: ${res.status}`);
-      return;
-    }
-    setEditing(false);
-    startTransition(() => router.refresh());
-  }
-
-  async function runNow() {
-    setRunning(true);
-    setErr(null);
-    try {
-      const res = await fetch(`/api/workflows/${workflowId}/run`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ inputs: {} }),
-      });
-      if (!res.ok) {
-        setErr(`Run failed: ${res.status}`);
-        return;
-      }
-      // Drain the SSE stream so the run completes; we just refresh after.
-      const reader = res.body?.getReader();
-      if (reader) {
-        while (true) {
-          const { done } = await reader.read();
-          if (done) break;
-        }
-      }
-      startTransition(() => router.refresh());
-    } finally {
-      setRunning(false);
-    }
-  }
-
-  async function remove() {
-    if (!confirm("Delete this workflow? This cannot be undone.")) return;
-    setErr(null);
-    const res = await fetch(`/api/workflows/${workflowId}`, { method: "DELETE" });
-    if (!res.ok) {
-      setErr(`Delete failed: ${res.status}`);
-      return;
-    }
-    router.push("/workflows");
-  }
-
-  return (
-    <div className="space-y-3">
-      {editing ? (
-        <div className="flex items-center gap-2">
-          <input
-            value={name}
-            onChange={(e) => setName(e.target.value)}
-            className="flex-1 rounded border px-3 py-1.5 text-sm"
-            style={{ borderColor: "#FFD7B5" }}
-            // biome-ignore lint/a11y/noAutofocus: rename input is rendered on user action (edit click), not page load — focusing it immediately is intended UX
-            autoFocus
-          />
-          <button
-            type="button"
-            onClick={rename}
-            disabled={pending}
-            className="rounded px-3 py-1.5 text-sm font-medium text-white"
-            style={{ backgroundColor: "#FF4F00" }}
-          >
-            Save
-          </button>
-          <button
-            type="button"
-            onClick={() => {
-              setName(currentName);
-              setEditing(false);
-            }}
-            className="rounded px-3 py-1.5 text-sm font-medium"
-            style={{ color: "#7A6A5C" }}
-          >
-            Cancel
-          </button>
-        </div>
-      ) : (
-        <div className="flex flex-wrap items-center gap-2">
-          <button
-            type="button"
-            onClick={runNow}
-            disabled={running}
-            className="rounded px-4 py-1.5 text-sm font-medium text-white disabled:opacity-60"
-            style={{ backgroundColor: "#FF4F00" }}
-          >
-            {running ? "Running…" : "Run now"}
-          </button>
-          <button
-            type="button"
-            onClick={() => setEditing(true)}
-            className="rounded border px-4 py-1.5 text-sm font-medium"
-            style={{ borderColor: "#FFD7B5", color: "#201515" }}
-          >
-            Rename
-          </button>
-          <button
-            type="button"
-            onClick={remove}
-            className="rounded border px-4 py-1.5 text-sm font-medium"
-            style={{ borderColor: "#FFD7B5", color: "#A61B1B" }}
-          >
-            Delete
-          </button>
-        </div>
-      )}
-      {err ? (
-        <div className="text-xs" style={{ color: "#A61B1B" }}>
-          {err}
-        </div>
-      ) : null}
-    </div>
-  );
-}
diff --git a/packages/web/src/components/workflows/workflows-shell.tsx b/packages/web/src/components/workflows/workflows-shell.tsx
deleted file mode 100644
index 22932740..00000000
--- a/packages/web/src/components/workflows/workflows-shell.tsx
+++ /dev/null
@@ -1,37 +0,0 @@
-"use client";
-
-import Link from "next/link";
-
-export function WorkflowsShell({ children }: { children: React.ReactNode }) {
-  return (
-    <div className="min-h-svh flex flex-col" style={{ backgroundColor: "#FFFDF9" }}>
-      <div
-        className="flex items-center gap-4 px-8 py-4"
-        style={{ borderBottom: "1px solid #FFF3E6" }}
-      >
-        <Link href="/chat" className="flex items-center gap-2.5">
-          <span
-            className="inline-flex h-7 w-7 items-center justify-center rounded-md text-white text-sm font-bold"
-            style={{ backgroundColor: "#FF4F00" }}
-          >
-            F
-          </span>
-          <span className="text-sm font-semibold tracking-tight" style={{ color: "#201515" }}>
-            Foreman
-          </span>
-        </Link>
-        <span className="text-sm" style={{ color: "#FFBF6E" }}>
-          /
-        </span>
-        <Link
-          href="/workflows"
-          className="text-sm font-medium hover:underline"
-          style={{ color: "#201515" }}
-        >
-          Workflows
-        </Link>
-      </div>
-      <main className="flex-1 px-10 py-8 max-w-5xl w-full mx-auto">{children}</main>
-    </div>
-  );
-}
diff --git a/packages/web/src/components/workspaces/workspace-switcher.tsx b/packages/web/src/components/workspaces/workspace-switcher.tsx
new file mode 100644
index 00000000..b0f22d18
--- /dev/null
+++ b/packages/web/src/components/workspaces/workspace-switcher.tsx
@@ -0,0 +1,173 @@
+"use client";
+
+import { Building2Icon, CheckIcon, ChevronsUpDownIcon, PlusIcon, SettingsIcon } from "lucide-react";
+import Link from "next/link";
+import { useRouter } from "next/navigation";
+import { useEffect, useState, useTransition } from "react";
+import { Button } from "@/components/ui/button";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from "@/components/ui/dropdown-menu";
+import { Field, FieldLabel } from "@/components/ui/field";
+import { Input } from "@/components/ui/input";
+import {
+  SidebarMenu,
+  SidebarMenuButton,
+  SidebarMenuItem,
+  useSidebar,
+} from "@/components/ui/sidebar";
+import { createWorkspace, getMyWorkspaces, switchWorkspace } from "@/data/workspaces";
+import type { WorkspaceSummary } from "@/data/workspaces-types";
+
+/**
+ * Sidebar workspace switcher: lists the user's workspaces, marks the active one,
+ * switches the agent's active workspace (writes user.default_workspace_id via the
+ * agent server), and creates new team workspaces. Self-fetching so it can drop
+ * into the sidebar with no layout plumbing.
+ */
+export function WorkspaceSwitcher() {
+  const router = useRouter();
+  const { setOpenMobile } = useSidebar();
+  const [workspaces, setWorkspaces] = useState<WorkspaceSummary[]>([]);
+  const [activeId, setActiveId] = useState<string | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [pending, startTransition] = useTransition();
+  const [createOpen, setCreateOpen] = useState(false);
+  const [name, setName] = useState("");
+  const [error, setError] = useState<string | null>(null);
+
+  function load() {
+    getMyWorkspaces()
+      .then((d) => {
+        setWorkspaces(d.workspaces);
+        setActiveId(d.active_workspace_id);
+      })
+      .catch(() => {})
+      .finally(() => setLoading(false));
+  }
+
+  useEffect(() => {
+    load();
+  }, []);
+
+  const active = workspaces.find((w) => w.id === activeId) ?? workspaces[0];
+
+  function onSwitch(id: string) {
+    if (id === active?.id) return;
+    startTransition(async () => {
+      await switchWorkspace(id);
+      setActiveId(id);
+      router.refresh();
+    });
+  }
+
+  function onCreate() {
+    setError(null);
+    startTransition(async () => {
+      try {
+        await createWorkspace(name.trim());
+        setCreateOpen(false);
+        setName("");
+        load();
+        router.refresh();
+      } catch (e) {
+        setError((e as Error).message);
+      }
+    });
+  }
+
+  if (loading || !active) {
+    return (
+      <SidebarMenu>
+        <SidebarMenuItem>
+          <SidebarMenuButton className="h-8" disabled tooltip="Workspace">
+            <Building2Icon className="size-4" />
+            <span className="truncate text-[13px]">{loading ? "Loading…" : "Workspace"}</span>
+          </SidebarMenuButton>
+        </SidebarMenuItem>
+      </SidebarMenu>
+    );
+  }
+
+  return (
+    <SidebarMenu>
+      <SidebarMenuItem>
+        <DropdownMenu>
+          <DropdownMenuTrigger asChild>
+            <SidebarMenuButton className="h-8" tooltip={active.name}>
+              <Building2Icon className="size-4" />
+              <span className="truncate text-[13px] font-medium">{active.name}</span>
+              <ChevronsUpDownIcon className="ml-auto size-3.5 opacity-60" />
+            </SidebarMenuButton>
+          </DropdownMenuTrigger>
+          <DropdownMenuContent align="start" className="w-56">
+            <DropdownMenuLabel className="text-muted-foreground text-xs">
+              Workspaces
+            </DropdownMenuLabel>
+            {workspaces.map((w) => (
+              <DropdownMenuItem disabled={pending} key={w.id} onClick={() => onSwitch(w.id)}>
+                <Building2Icon className="size-4" />
+                <span className="truncate">{w.name}</span>
+                {w.id === active.id && <CheckIcon className="ml-auto size-4" />}
+              </DropdownMenuItem>
+            ))}
+            <DropdownMenuSeparator />
+            <DropdownMenuItem onClick={() => setCreateOpen(true)}>
+              <PlusIcon className="size-4" />
+              New workspace
+            </DropdownMenuItem>
+            <DropdownMenuItem asChild>
+              <Link href="/workspaces" onClick={() => setOpenMobile(false)}>
+                <SettingsIcon className="size-4" />
+                Manage workspaces
+              </Link>
+            </DropdownMenuItem>
+          </DropdownMenuContent>
+        </DropdownMenu>
+      </SidebarMenuItem>
+
+      <Dialog onOpenChange={setCreateOpen} open={createOpen}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>New workspace</DialogTitle>
+            <DialogDescription>
+              A shared workspace for your team — agents, dashboards, and connections are shared
+              across members.
+            </DialogDescription>
+          </DialogHeader>
+          <Field>
+            <FieldLabel htmlFor="ws-name">Name</FieldLabel>
+            <Input
+              id="ws-name"
+              onChange={(e) => setName(e.target.value)}
+              placeholder="Acme Inc"
+              value={name}
+            />
+          </Field>
+          {error && <p className="text-destructive text-sm">{error}</p>}
+          <DialogFooter>
+            <Button onClick={() => setCreateOpen(false)} variant="outline">
+              Cancel
+            </Button>
+            <Button disabled={!name.trim() || pending} onClick={onCreate}>
+              Create
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+    </SidebarMenu>
+  );
+}
diff --git a/packages/web/src/components/workspaces/workspaces-manager.tsx b/packages/web/src/components/workspaces/workspaces-manager.tsx
new file mode 100644
index 00000000..6a01b934
--- /dev/null
+++ b/packages/web/src/components/workspaces/workspaces-manager.tsx
@@ -0,0 +1,477 @@
+"use client";
+
+import { useEffect, useState, useTransition } from "react";
+import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { Input } from "@/components/ui/input";
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/components/ui/select";
+import { Skeleton } from "@/components/ui/skeleton";
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from "@/components/ui/table";
+import {
+  acceptInvitation,
+  clearSharedConnection,
+  declineInvitation,
+  getMyInvitations,
+  getMyWorkspaces,
+  getSharedConnection,
+  getWorkspaceInvitations,
+  getWorkspaceMembers,
+  getWorkspaceSettings,
+  inviteMember,
+  leaveWorkspace,
+  removeMember,
+  revokeInvitation,
+  setConnectionMode,
+  shareMyConnection,
+  switchWorkspace,
+  updateMemberRole,
+} from "@/data/workspaces";
+import type {
+  ConnectionMode,
+  MyInvitation,
+  SharedConnectionInfo,
+  WorkspaceInvitation,
+  WorkspaceMember,
+  WorkspaceRole,
+  WorkspaceSummary,
+} from "@/data/workspaces-types";
+import { initialsFrom, seedToGradient } from "@/lib/avatar";
+
+const ASSIGNABLE: WorkspaceRole[] = ["admin", "member", "readonly"];
+const isAdminRole = (r?: WorkspaceRole) => r === "owner" || r === "admin";
+
+export function WorkspacesManager() {
+  const [workspaces, setWorkspaces] = useState<WorkspaceSummary[]>([]);
+  const [activeId, setActiveId] = useState<string | null>(null);
+  const [myInvites, setMyInvites] = useState<MyInvitation[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [pending, start] = useTransition();
+  const [error, setError] = useState<string | null>(null);
+
+  function reload() {
+    Promise.all([getMyWorkspaces(), getMyInvitations().catch(() => [] as MyInvitation[])])
+      .then(([w, inv]) => {
+        setWorkspaces(w.workspaces);
+        setActiveId(w.active_workspace_id);
+        setMyInvites(inv);
+      })
+      .catch((e) => setError((e as Error).message))
+      .finally(() => setLoading(false));
+  }
+
+  useEffect(() => {
+    reload();
+  }, []);
+
+  const active = workspaces.find((w) => w.id === activeId) ?? workspaces[0];
+
+  const act = (fn: () => Promise<unknown>) => {
+    setError(null);
+    start(async () => {
+      try {
+        await fn();
+        reload();
+      } catch (e) {
+        setError((e as Error).message);
+      }
+    });
+  };
+
+  if (loading)
+    return (
+      <div className="flex flex-col gap-3">
+        <Skeleton className="h-28 w-full" />
+        <Skeleton className="h-40 w-full" />
+      </div>
+    );
+
+  return (
+    <div className="flex flex-col gap-6">
+      {error && (
+        <p className="rounded-md bg-destructive/10 px-3 py-2 text-destructive text-sm">{error}</p>
+      )}
+
+      {myInvites.length > 0 && (
+        <Card>
+          <CardHeader>
+            <CardTitle>Pending invitations</CardTitle>
+            <CardDescription>You've been invited to these workspaces.</CardDescription>
+          </CardHeader>
+          <CardContent className="flex flex-col gap-2">
+            {myInvites.map((inv) => (
+              <div className="flex items-center justify-between gap-3" key={inv.id}>
+                <span className="text-sm">
+                  <span className="font-medium">{inv.workspace?.name ?? "A workspace"}</span> · as{" "}
+                  {inv.role}
+                </span>
+                <span className="flex gap-2">
+                  <Button
+                    disabled={pending}
+                    onClick={() => act(() => acceptInvitation(inv.id))}
+                    size="sm"
+                  >
+                    Accept
+                  </Button>
+                  <Button
+                    disabled={pending}
+                    onClick={() => act(() => declineInvitation(inv.id))}
+                    size="sm"
+                    variant="outline"
+                  >
+                    Decline
+                  </Button>
+                </span>
+              </div>
+            ))}
+          </CardContent>
+        </Card>
+      )}
+
+      <Card>
+        <CardHeader>
+          <CardTitle>Your workspaces</CardTitle>
+          <CardDescription>Switch the active workspace your agent operates in.</CardDescription>
+        </CardHeader>
+        <CardContent className="flex flex-col gap-2">
+          {workspaces.map((w) => (
+            <div className="flex items-center justify-between gap-3" key={w.id}>
+              <span className="flex items-center gap-2 text-sm">
+                <span className="font-medium">{w.name}</span>
+                <Badge variant="secondary">{w.role}</Badge>
+                {w.membership_type === "solo" && <Badge variant="outline">personal</Badge>}
+                {w.id === active?.id && <Badge>active</Badge>}
+              </span>
+              {w.id !== active?.id && (
+                <Button
+                  disabled={pending}
+                  onClick={() => act(() => switchWorkspace(w.id))}
+                  size="sm"
+                  variant="outline"
+                >
+                  Switch
+                </Button>
+              )}
+            </div>
+          ))}
+        </CardContent>
+      </Card>
+
+      {active && (active.membership_type === "team" || isAdminRole(active.role)) && (
+        <>
+          {active.membership_type === "solo" && isAdminRole(active.role) && (
+            <p className="text-muted-foreground text-sm">
+              Invite a teammate to turn this personal workspace into a shared team workspace — your
+              shared documents and automations become visible to the team. Your private documents
+              stay private.
+            </p>
+          )}
+          <MembersSection
+            isAdmin={isAdminRole(active.role)}
+            onAct={act}
+            pending={pending}
+            workspaceId={active.id}
+          />
+          {isAdminRole(active.role) ? (
+            <>
+              <InvitationsSection onAct={act} pending={pending} workspaceId={active.id} />
+              {active.membership_type === "team" && (
+                <ConnectionSection onAct={act} pending={pending} workspaceId={active.id} />
+              )}
+            </>
+          ) : (
+            <Button
+              className="self-start"
+              disabled={pending}
+              onClick={() => act(() => leaveWorkspace(active.id))}
+              variant="outline"
+            >
+              Leave workspace
+            </Button>
+          )}
+        </>
+      )}
+    </div>
+  );
+}
+
+function MembersSection(props: {
+  workspaceId: string;
+  isAdmin: boolean;
+  pending: boolean;
+  onAct: (fn: () => Promise<unknown>) => void;
+}) {
+  const { workspaceId, isAdmin, pending, onAct } = props;
+  const [members, setMembers] = useState<WorkspaceMember[]>([]);
+
+  // Reload on workspace change and after each mutation settles (pending edge).
+  useEffect(() => {
+    getWorkspaceMembers(workspaceId)
+      .then(setMembers)
+      .catch(() => {});
+  }, [workspaceId, pending]);
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle>Members</CardTitle>
+        <CardDescription>People with access to this workspace's shared resources.</CardDescription>
+      </CardHeader>
+      <CardContent>
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>Member</TableHead>
+              <TableHead>Role</TableHead>
+              <TableHead />
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {members.map((m) => (
+              <TableRow key={m.id}>
+                <TableCell>
+                  <div className="flex items-center gap-2.5">
+                    <Avatar className="size-7 shrink-0">
+                      {m.avatar_url ? <AvatarImage alt="" src={m.avatar_url} /> : null}
+                      <AvatarFallback
+                        className="text-[11px] font-medium text-white"
+                        style={{ background: seedToGradient(m.name ?? m.id) }}
+                      >
+                        {initialsFrom(m.name ?? m.id)}
+                      </AvatarFallback>
+                    </Avatar>
+                    <span>
+                      {m.name ?? m.id.slice(0, 8)}
+                      {m.is_self && <span className="text-muted-foreground"> (you)</span>}
+                    </span>
+                  </div>
+                </TableCell>
+                <TableCell>
+                  {isAdmin && m.role !== "owner" ? (
+                    <Select
+                      onValueChange={(role) =>
+                        onAct(() => updateMemberRole(workspaceId, m.id, role as WorkspaceRole))
+                      }
+                      value={m.role}
+                    >
+                      <SelectTrigger className="h-8 w-32" disabled={pending}>
+                        <SelectValue />
+                      </SelectTrigger>
+                      <SelectContent>
+                        {ASSIGNABLE.map((r) => (
+                          <SelectItem key={r} value={r}>
+                            {r}
+                          </SelectItem>
+                        ))}
+                      </SelectContent>
+                    </Select>
+                  ) : (
+                    <Badge variant="secondary">{m.role}</Badge>
+                  )}
+                </TableCell>
+                <TableCell className="text-right">
+                  {isAdmin && m.role !== "owner" && !m.is_self && (
+                    <Button
+                      disabled={pending}
+                      onClick={() => onAct(() => removeMember(workspaceId, m.id))}
+                      size="sm"
+                      variant="ghost"
+                    >
+                      Remove
+                    </Button>
+                  )}
+                </TableCell>
+              </TableRow>
+            ))}
+          </TableBody>
+        </Table>
+      </CardContent>
+    </Card>
+  );
+}
+
+function InvitationsSection(props: {
+  workspaceId: string;
+  pending: boolean;
+  onAct: (fn: () => Promise<unknown>) => void;
+}) {
+  const { workspaceId, pending, onAct } = props;
+  const [invites, setInvites] = useState<WorkspaceInvitation[]>([]);
+  const [email, setEmail] = useState("");
+  const [role, setRole] = useState<WorkspaceRole>("member");
+
+  useEffect(() => {
+    getWorkspaceInvitations(workspaceId)
+      .then(setInvites)
+      .catch(() => {});
+  }, [workspaceId, pending]);
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle>Invite a teammate</CardTitle>
+        <CardDescription>They'll join with the role you choose once they accept.</CardDescription>
+      </CardHeader>
+      <CardContent className="flex flex-col gap-4">
+        <div className="flex flex-wrap items-center gap-2">
+          <Input
+            className="max-w-xs"
+            onChange={(e) => setEmail(e.target.value)}
+            placeholder="teammate@example.com"
+            type="email"
+            value={email}
+          />
+          <Select onValueChange={(r) => setRole(r as WorkspaceRole)} value={role}>
+            <SelectTrigger className="w-32">
+              <SelectValue />
+            </SelectTrigger>
+            <SelectContent>
+              {ASSIGNABLE.map((r) => (
+                <SelectItem key={r} value={r}>
+                  {r}
+                </SelectItem>
+              ))}
+            </SelectContent>
+          </Select>
+          <Button
+            disabled={pending || !email.trim()}
+            onClick={() =>
+              onAct(async () => {
+                await inviteMember(workspaceId, email.trim(), role);
+                setEmail("");
+              })
+            }
+          >
+            Send invite
+          </Button>
+        </div>
+        {invites.length > 0 && (
+          <div className="flex flex-col gap-1">
+            {invites.map((inv) => (
+              <div className="flex items-center justify-between gap-3 text-sm" key={inv.id}>
+                <span>
+                  {inv.invitee_user_email} · {inv.invitee_user_role}{" "}
+                  <Badge variant="outline">pending</Badge>
+                </span>
+                <Button
+                  disabled={pending}
+                  onClick={() => onAct(() => revokeInvitation(workspaceId, inv.id))}
+                  size="sm"
+                  variant="ghost"
+                >
+                  Revoke
+                </Button>
+              </div>
+            ))}
+          </div>
+        )}
+      </CardContent>
+    </Card>
+  );
+}
+
+function ConnectionSection(props: {
+  workspaceId: string;
+  pending: boolean;
+  onAct: (fn: () => Promise<unknown>) => void;
+}) {
+  const { workspaceId, pending, onAct } = props;
+  const [mode, setMode] = useState<ConnectionMode>("member-first");
+  const [shared, setShared] = useState<SharedConnectionInfo | null>(null);
+
+  useEffect(() => {
+    getWorkspaceSettings(workspaceId)
+      .then((s) => setMode(s.zapier_connection_mode))
+      .catch(() => {});
+  }, [workspaceId]);
+
+  useEffect(() => {
+    getSharedConnection(workspaceId)
+      .then(setShared)
+      .catch(() => {});
+  }, [workspaceId, pending]);
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle>Zapier connections</CardTitle>
+        <CardDescription>
+          How members' Zapier connections resolve when the agent acts. <strong>member-first</strong>
+          : own connection, else the workspace's shared one · <strong>shared</strong>: always the
+          workspace's connection · <strong>personal</strong>: own only.
+        </CardDescription>
+      </CardHeader>
+      <CardContent className="flex flex-col gap-4">
+        <Select
+          onValueChange={(m) =>
+            onAct(async () => {
+              await setConnectionMode(workspaceId, m as ConnectionMode);
+              setMode(m as ConnectionMode);
+            })
+          }
+          value={mode}
+        >
+          <SelectTrigger className="w-48" disabled={pending}>
+            <SelectValue />
+          </SelectTrigger>
+          <SelectContent>
+            <SelectItem value="member-first">member-first</SelectItem>
+            <SelectItem value="shared">shared</SelectItem>
+            <SelectItem value="personal">personal</SelectItem>
+          </SelectContent>
+        </Select>
+
+        <div className="flex flex-col gap-2 border-t pt-4">
+          <p className="font-medium text-sm">Shared connection</p>
+          <p className="text-muted-foreground text-sm">
+            {shared?.shared
+              ? shared.shared.is_self
+                ? "Your Zapier connection is this workspace's shared connection."
+                : "A teammate's connection is shared with this workspace."
+              : "No shared connection set — shared / member-first fallback has nothing to resolve to yet."}
+          </p>
+          <div className="flex gap-2">
+            {!shared?.shared?.is_self && (
+              <Button
+                disabled={pending || !shared?.caller_has_connection}
+                onClick={() => onAct(() => shareMyConnection(workspaceId))}
+                size="sm"
+              >
+                Use my connection
+              </Button>
+            )}
+            {shared?.shared && (
+              <Button
+                disabled={pending}
+                onClick={() => onAct(() => clearSharedConnection(workspaceId))}
+                size="sm"
+                variant="outline"
+              >
+                Clear
+              </Button>
+            )}
+          </div>
+          {!(shared?.caller_has_connection || shared?.shared) && (
+            <p className="text-muted-foreground text-xs">
+              Connect your own Zapier account first to share it with the workspace.
+            </p>
+          )}
+        </div>
+      </CardContent>
+    </Card>
+  );
+}
diff --git a/packages/web/src/data/automations-types.ts b/packages/web/src/data/automations-types.ts
new file mode 100644
index 00000000..1b751332
--- /dev/null
+++ b/packages/web/src/data/automations-types.ts
@@ -0,0 +1,152 @@
+/**
+ * Shared types for the automations data layer. Kept out of the "use server"
+ * module (data/automations.ts) because a "use server" file may only export async
+ * functions. Shapes mirror the agent /automations route responses.
+ */
+
+export interface ScheduleSpec {
+  /** Cron expression; Mastra's WorkflowScheduler owns the firing (foreman-bhb5). */
+  cron: string;
+  timezone?: string;
+}
+
+export interface AutomationTriggerSpec {
+  app?: string;
+  action?: string;
+  connection?: string | number | null;
+  inputs?: Record<string, unknown>;
+  /** A recurring schedule (foreman-ufo3.3) — present instead of app/action for scheduled automations. */
+  schedule?: ScheduleSpec;
+  /** With `schedule`, this automation is a daily digest of recent activity. */
+  digest?: boolean;
+}
+
+export interface Automation {
+  id: string;
+  name: string;
+  description: string | null;
+  enabled: boolean;
+  status: string;
+  zapier_workflow_id: string;
+  editor_url: string | null;
+  trigger: AutomationTriggerSpec | null;
+  trigger_inbox_id: string | null;
+  created_at: string;
+  updated_at: string;
+}
+
+export interface AutomationRun {
+  id: string;
+  status: string;
+  inbox_message_id: string | null;
+  trigger_id: string | null;
+  durable_run_id: string | null;
+  /** Durable result on a finished run (null until terminal). */
+  output: unknown;
+  /**
+   * Failure detail on a failed/stuck run; while status is "retrying" it holds the
+   * in-flight DurableRunDetail (last_error + retrying ops, foreman-jc12). Null otherwise.
+   */
+  error: unknown;
+  created_at: string;
+  updated_at: string;
+}
+
+export interface AutomationDetail {
+  automation: Automation;
+  runs: AutomationRun[];
+}
+
+export interface InboxMessageAttributes {
+  lease_count: number;
+  error_message: string | null;
+  possible_duplicate_data: boolean;
+}
+
+export interface InboxMessage {
+  id: string;
+  created_at: string;
+  status: string;
+  message_attributes: InboxMessageAttributes;
+}
+
+export interface InboxState {
+  inbox: {
+    id: string;
+    status: string;
+    paused_reason: string | null;
+    subscription: {
+      connection_id: string | number | null;
+      app_key: string;
+      action_key: string;
+      inputs: Record<string, unknown>;
+    };
+  } | null;
+  messages: InboxMessage[];
+}
+
+export type InboxPriorityLevel = "high" | "medium" | "low";
+
+/** Importance/urgency ranking for an inbox entry (foreman-6r9y). */
+export interface InboxPriority {
+  score: number;
+  level: InboxPriorityLevel;
+  reasons: string[];
+}
+
+/** One automation's inbox within the workspace-wide aggregate (`/automations/inbox`). */
+export interface WorkspaceInboxEntry {
+  automation: {
+    id: string;
+    name: string;
+    enabled: boolean;
+    status: string;
+    trigger: AutomationTriggerSpec | null;
+  };
+  /** Which workspace member owns this automation (teammate aggregation). */
+  owner: { userId: string; isSelf: boolean };
+  inbox: InboxState["inbox"];
+  messages: InboxMessage[];
+  priority: InboxPriority;
+}
+
+/** A run surfaced in a digest bucket (failures / waiting / retrying). */
+export interface DigestRunRef {
+  automationId: string;
+  automationName: string;
+  createdAt: string;
+  error?: string | null;
+}
+
+/** The workspace's latest daily digest (foreman-ufo3.2). */
+export interface AutomationDigest {
+  kind: "automation_digest";
+  periodStart: string;
+  periodEnd: string;
+  totals: {
+    total: number;
+    finished: number;
+    failed: number;
+    waiting: number;
+    retrying: number;
+    other: number;
+  };
+  failures: DigestRunRef[];
+  waiting: DigestRunRef[];
+  retrying: DigestRunRef[];
+  headline: string;
+  /** Optional LLM prose summary; null when the narrative layer is off. */
+  narrative?: string | null;
+}
+
+export interface WorkspaceInbox {
+  entries: WorkspaceInboxEntry[];
+  digest: AutomationDigest | null;
+}
+
+export interface RunResult {
+  runId: string;
+  triggerId: string;
+  status: string;
+  durableRunId: string | null;
+}
diff --git a/packages/web/src/data/automations.ts b/packages/web/src/data/automations.ts
new file mode 100644
index 00000000..817442d5
--- /dev/null
+++ b/packages/web/src/data/automations.ts
@@ -0,0 +1,99 @@
+"use server";
+
+import { auth } from "@/lib/auth";
+import { createClient } from "@/lib/server";
+import type {
+  Automation,
+  AutomationDetail,
+  InboxState,
+  RunResult,
+  WorkspaceInbox,
+} from "./automations-types";
+
+/**
+ * Server actions for durable automations. Thin wrappers over the agent server's
+ * /automations routes (service_role + workspace scoping live there), using
+ * Foreman's standard web→agent pattern: authenticate, forward the user's Supabase
+ * access token as a Bearer. Creation is chat-driven (the agent authors the durable
+ * source), so there's no create action here — this surface manages existing ones.
+ */
+
+const AGENT_URL = process.env.NEXT_PUBLIC_AGENT_SERVER_URL || "http://localhost:4111";
+
+async function accessToken(): Promise<string> {
+  const session = await auth();
+  if (!session?.user?.id) throw new Error("Unauthorized");
+  const supabase = await createClient();
+  const {
+    data: { session: s },
+  } = await supabase.auth.getSession();
+  if (!s?.access_token) throw new Error("Unauthorized");
+  return s.access_token;
+}
+
+async function agent<T>(path: string, init?: { method?: string; body?: unknown }): Promise<T> {
+  const token = await accessToken();
+  const res = await fetch(`${AGENT_URL}${path}`, {
+    method: init?.method ?? "GET",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    body: init?.body !== undefined ? JSON.stringify(init.body) : undefined,
+    cache: "no-store",
+  });
+  if (!res.ok) {
+    let message = `${init?.method ?? "GET"} ${path} → ${res.status}`;
+    try {
+      const body = (await res.json()) as { error?: string };
+      if (body?.error) message = body.error;
+    } catch {}
+    throw new Error(message);
+  }
+  return (await res.json()) as T;
+}
+
+export async function getAutomations(): Promise<Automation[]> {
+  const { automations } = await agent<{ automations: Automation[] }>("/automations");
+  return automations;
+}
+
+export async function getAutomation(id: string): Promise<AutomationDetail> {
+  return agent(`/automations/${id}`);
+}
+
+export async function getInboxState(id: string): Promise<InboxState> {
+  return agent(`/automations/${id}/inbox`);
+}
+
+/** Workspace-wide aggregate inbox — every automation's inbox in one round-trip. */
+export async function getWorkspaceInbox(): Promise<WorkspaceInbox> {
+  return agent("/automations/inbox");
+}
+
+export async function setAutomationEnabled(id: string, enabled: boolean): Promise<void> {
+  await agent(`/automations/${id}`, { method: "PATCH", body: { enabled } });
+}
+
+export async function renameAutomation(id: string, name: string): Promise<void> {
+  await agent(`/automations/${id}`, { method: "PATCH", body: { name } });
+}
+
+export async function runAutomation(id: string): Promise<RunResult> {
+  return agent(`/automations/${id}/run`, { method: "POST", body: {} });
+}
+
+export async function deleteAutomation(id: string): Promise<void> {
+  await agent(`/automations/${id}`, { method: "DELETE" });
+}
+
+/** Cancel a running durable run (foreman-y4kc). */
+export async function cancelRun(runId: string): Promise<{ cancelled: boolean; status: string }> {
+  return agent(`/automations/runs/${runId}/cancel`, { method: "POST", body: {} });
+}
+
+/** Approve/deny a durable human-approval gate (foreman-zfnj). Approve resumes with a
+ * payload; deny (cancel:true) cancels the run. */
+export async function respondToCallback(
+  runId: string,
+  input: { payload?: unknown; cancel?: boolean; callbackName?: string },
+): Promise<{ ok: boolean; action: string; status?: number; reason?: string }> {
+  return agent(`/automations/runs/${runId}/callback`, { method: "POST", body: input });
+}
diff --git a/packages/web/src/data/workspaces-types.ts b/packages/web/src/data/workspaces-types.ts
new file mode 100644
index 00000000..4102009e
--- /dev/null
+++ b/packages/web/src/data/workspaces-types.ts
@@ -0,0 +1,48 @@
+/**
+ * Shared types for the workspace data layer. Kept out of the "use server"
+ * module (data/workspaces.ts) because a "use server" file may only export
+ * async functions.
+ */
+
+export type WorkspaceRole = "owner" | "admin" | "member" | "readonly";
+
+export interface WorkspaceSummary {
+  id: string;
+  slug: string;
+  name: string;
+  membership_type: "solo" | "team";
+  role: WorkspaceRole;
+  is_active: boolean;
+  created_at: string;
+}
+
+export interface WorkspaceMember {
+  id: string;
+  role: WorkspaceRole;
+  added_at: string;
+  name: string | null;
+  avatar_url: string | null;
+  is_self: boolean;
+}
+
+export interface WorkspaceInvitation {
+  id: string;
+  invitee_user_email: string;
+  invitee_user_role: WorkspaceRole;
+  status: string;
+  created_at: string;
+}
+
+export interface MyInvitation {
+  id: string;
+  role: WorkspaceRole;
+  created_at: string;
+  workspace: { id: string; slug: string; name: string } | null;
+}
+
+export type ConnectionMode = "member-first" | "shared" | "personal";
+
+export interface SharedConnectionInfo {
+  shared: { owner_id: string; is_self: boolean } | null;
+  caller_has_connection: boolean;
+}
diff --git a/packages/web/src/data/workspaces.ts b/packages/web/src/data/workspaces.ts
new file mode 100644
index 00000000..64cda712
--- /dev/null
+++ b/packages/web/src/data/workspaces.ts
@@ -0,0 +1,181 @@
+"use server";
+
+import { auth } from "@/lib/auth";
+import { createClient } from "@/lib/server";
+import type {
+  ConnectionMode,
+  MyInvitation,
+  SharedConnectionInfo,
+  WorkspaceInvitation,
+  WorkspaceMember,
+  WorkspaceRole,
+  WorkspaceSummary,
+} from "./workspaces-types";
+
+/**
+ * Server actions for workspace management. Thin wrappers over the agent server's
+ * /workspaces routes (service_role + membership/admin checks live there), using
+ * Foreman's standard web→agent pattern: authenticate, forward the user's Supabase
+ * access token as a Bearer. Callable from both server components and client
+ * components.
+ */
+
+const AGENT_URL = process.env.NEXT_PUBLIC_AGENT_SERVER_URL || "http://localhost:4111";
+
+async function accessToken(): Promise<string> {
+  const session = await auth();
+  if (!session?.user?.id) throw new Error("Unauthorized");
+  const supabase = await createClient();
+  const {
+    data: { session: s },
+  } = await supabase.auth.getSession();
+  if (!s?.access_token) throw new Error("Unauthorized");
+  return s.access_token;
+}
+
+async function agent<T>(path: string, init?: { method?: string; body?: unknown }): Promise<T> {
+  const token = await accessToken();
+  const res = await fetch(`${AGENT_URL}${path}`, {
+    method: init?.method ?? "GET",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    body: init?.body !== undefined ? JSON.stringify(init.body) : undefined,
+    cache: "no-store",
+  });
+  if (!res.ok) {
+    let message = `${init?.method ?? "GET"} ${path} → ${res.status}`;
+    try {
+      const body = (await res.json()) as { error?: string };
+      if (body?.error) message = body.error;
+    } catch {}
+    throw new Error(message);
+  }
+  return (await res.json()) as T;
+}
+
+// ─── My workspaces / switching ───
+
+export async function getMyWorkspaces(): Promise<{
+  workspaces: WorkspaceSummary[];
+  active_workspace_id: string | null;
+}> {
+  return agent("/workspaces");
+}
+
+export async function switchWorkspace(workspaceId: string): Promise<void> {
+  await agent("/workspaces/switch", { method: "POST", body: { workspaceId } });
+}
+
+export async function createWorkspace(name: string, setActive = true): Promise<{ id: string }> {
+  return agent("/workspaces", { method: "POST", body: { name, setActive } });
+}
+
+export async function getWorkspaceBySlug(slug: string): Promise<WorkspaceSummary[]> {
+  const { workspaces } = await getMyWorkspaces();
+  return workspaces.filter((w) => w.slug === slug);
+}
+
+// ─── A workspace ───
+
+export async function renameWorkspace(workspaceId: string, name: string): Promise<void> {
+  await agent(`/workspaces/${workspaceId}`, { method: "PATCH", body: { name } });
+}
+
+export async function deleteWorkspace(workspaceId: string): Promise<void> {
+  await agent(`/workspaces/${workspaceId}`, { method: "DELETE" });
+}
+
+// ─── Members ───
+
+export async function getWorkspaceMembers(workspaceId: string): Promise<WorkspaceMember[]> {
+  const { members } = await agent<{ members: WorkspaceMember[] }>(
+    `/workspaces/${workspaceId}/members`,
+  );
+  return members;
+}
+
+export async function updateMemberRole(
+  workspaceId: string,
+  memberId: string,
+  role: WorkspaceRole,
+): Promise<void> {
+  await agent(`/workspaces/${workspaceId}/members/${memberId}`, {
+    method: "PATCH",
+    body: { role },
+  });
+}
+
+export async function removeMember(workspaceId: string, memberId: string): Promise<void> {
+  await agent(`/workspaces/${workspaceId}/members/${memberId}`, { method: "DELETE" });
+}
+
+export async function leaveWorkspace(workspaceId: string): Promise<void> {
+  await agent(`/workspaces/${workspaceId}/leave`, { method: "POST" });
+}
+
+// ─── Invitations (admin side) ───
+
+export async function getWorkspaceInvitations(workspaceId: string): Promise<WorkspaceInvitation[]> {
+  const { invitations } = await agent<{ invitations: WorkspaceInvitation[] }>(
+    `/workspaces/${workspaceId}/invitations`,
+  );
+  return invitations;
+}
+
+export async function inviteMember(
+  workspaceId: string,
+  email: string,
+  role: WorkspaceRole,
+): Promise<void> {
+  await agent(`/workspaces/${workspaceId}/invitations`, {
+    method: "POST",
+    body: { email, role },
+  });
+}
+
+export async function revokeInvitation(workspaceId: string, invitationId: string): Promise<void> {
+  await agent(`/workspaces/${workspaceId}/invitations/${invitationId}`, { method: "DELETE" });
+}
+
+// ─── Invitations (invitee side) ───
+
+export async function getMyInvitations(): Promise<MyInvitation[]> {
+  const { invitations } = await agent<{ invitations: MyInvitation[] }>(
+    "/workspaces/invitations/mine",
+  );
+  return invitations;
+}
+
+export async function acceptInvitation(invitationId: string): Promise<void> {
+  await agent(`/workspaces/invitations/${invitationId}/accept`, { method: "POST" });
+}
+
+export async function declineInvitation(invitationId: string): Promise<void> {
+  await agent(`/workspaces/invitations/${invitationId}/decline`, { method: "POST" });
+}
+
+// ─── Settings ───
+
+export async function getWorkspaceSettings(
+  workspaceId: string,
+): Promise<{ zapier_connection_mode: ConnectionMode }> {
+  return agent(`/workspaces/${workspaceId}/settings`);
+}
+
+export async function setConnectionMode(workspaceId: string, mode: ConnectionMode): Promise<void> {
+  await agent(`/workspaces/${workspaceId}/settings`, {
+    method: "PATCH",
+    body: { zapier_connection_mode: mode },
+  });
+}
+
+export async function getSharedConnection(workspaceId: string): Promise<SharedConnectionInfo> {
+  return agent(`/workspaces/${workspaceId}/shared-connection`);
+}
+
+export async function shareMyConnection(workspaceId: string): Promise<void> {
+  await agent(`/workspaces/${workspaceId}/shared-connection`, { method: "POST" });
+}
+
+export async function clearSharedConnection(workspaceId: string): Promise<void> {
+  await agent(`/workspaces/${workspaceId}/shared-connection`, { method: "DELETE" });
+}
diff --git a/packages/web/src/hooks/use-active-chat.tsx b/packages/web/src/hooks/use-active-chat.tsx
index ca185cf2..d75a90a6 100644
--- a/packages/web/src/hooks/use-active-chat.tsx
+++ b/packages/web/src/hooks/use-active-chat.tsx
@@ -43,7 +43,9 @@ type ActiveChatContextValue = {
   input: string;
   setInput: Dispatch<SetStateAction<string>>;
   visibilityType: VisibilityType;
+  chatTitle: string | null;
   isReadonly: boolean;
+  isOwner: boolean;
   isLoading: boolean;
   votes: Vote[] | undefined;
   currentModelId: string;
@@ -114,6 +116,7 @@ export function ActiveChatProvider({ children }: { children: ReactNode }) {
 
   const initialMessages: ChatMessage[] = isNewChat ? [] : (chatData?.messages ?? []);
   const visibility: VisibilityType = isNewChat ? "private" : (chatData?.visibility ?? "private");
+  const chatTitle: string | null = isNewChat ? null : (chatData?.title ?? null);
 
   const {
     messages,
@@ -220,6 +223,7 @@ export function ActiveChatProvider({ children }: { children: ReactNode }) {
             messages: [{ role: "user", content: text }],
             threadId: request.id,
             resourceId: uid,
+            model: currentModelIdRef.current,
           },
         };
       },
@@ -382,6 +386,9 @@ export function ActiveChatProvider({ children }: { children: ReactNode }) {
   });
 
   const isReadonly = isNewChat ? false : (chatData?.isReadonly ?? false);
+  // Owner-only controls (visibility, public share, rename/delete). A teammate may
+  // write to a shared chat (foreman-whkr) but not manage it.
+  const isOwner = isNewChat ? true : (chatData?.isOwner ?? true);
 
   const { data: votes } = useSWR<Vote[]>(
     !isReadonly && messages.length >= 2
@@ -404,7 +411,9 @@ export function ActiveChatProvider({ children }: { children: ReactNode }) {
       input,
       setInput,
       visibilityType: visibility,
+      chatTitle,
       isReadonly,
+      isOwner,
       isLoading: !isNewChat && isLoading,
       votes,
       currentModelId,
@@ -423,7 +432,9 @@ export function ActiveChatProvider({ children }: { children: ReactNode }) {
       addToolApprovalResponse,
       input,
       visibility,
+      chatTitle,
       isReadonly,
+      isOwner,
       isNewChat,
       isLoading,
       votes,
diff --git a/packages/web/src/hooks/use-knowledge-panel.ts b/packages/web/src/hooks/use-knowledge-panel.ts
new file mode 100644
index 00000000..c0f1ff5b
--- /dev/null
+++ b/packages/web/src/hooks/use-knowledge-panel.ts
@@ -0,0 +1,60 @@
+"use client";
+
+import { useCallback, useMemo } from "react";
+import useSWR from "swr";
+
+/**
+ * Global store for the knowledge-document side panel (foreman-aqjx).
+ *
+ * Mirrors use-preview-panel exactly (SWR-as-store, no provider) so a knowledge
+ * document opens in the same resizable side panel as the live preview — "see it
+ * like the web preview". The panel shows whichever is open, with knowledge taking
+ * the slot when present (see shell.tsx).
+ */
+export type KnowledgePanelState = {
+  /** Workspace-relative path, e.g. documents/q3-plan.md. */
+  path: string;
+  title: string;
+  isOpen: boolean;
+};
+
+export const initialKnowledgePanel: KnowledgePanelState = {
+  path: "",
+  title: "Document",
+  isOpen: false,
+};
+
+const KEY = "knowledge-panel";
+
+export function useKnowledgePanelSelector<Selected>(
+  selector: (state: KnowledgePanelState) => Selected,
+) {
+  const { data } = useSWR<KnowledgePanelState>(KEY, null, {
+    fallbackData: initialKnowledgePanel,
+  });
+  return useMemo(() => selector(data ?? initialKnowledgePanel), [data, selector]);
+}
+
+export function useKnowledgePanel() {
+  const { data, mutate } = useSWR<KnowledgePanelState>(KEY, null, {
+    fallbackData: initialKnowledgePanel,
+  });
+  const state = data ?? initialKnowledgePanel;
+
+  const open = useCallback(
+    (next: { path: string; title?: string }) => {
+      mutate({ path: next.path, title: next.title ?? "Document", isOpen: true }, false);
+    },
+    [mutate],
+  );
+
+  const close = useCallback(() => {
+    mutate((s) => ({ ...(s ?? initialKnowledgePanel), isOpen: false }), false);
+  }, [mutate]);
+
+  const reset = useCallback(() => {
+    mutate(initialKnowledgePanel, false);
+  }, [mutate]);
+
+  return useMemo(() => ({ ...state, open, close, reset }), [state, open, close, reset]);
+}
diff --git a/packages/web/src/hooks/use-messages.tsx b/packages/web/src/hooks/use-messages.tsx
deleted file mode 100644
index 98999b93..00000000
--- a/packages/web/src/hooks/use-messages.tsx
+++ /dev/null
@@ -1,35 +0,0 @@
-import type { UseChatHelpers } from "@ai-sdk/react";
-import { useEffect, useState } from "react";
-import type { ChatMessage } from "@/lib/types";
-import { useScrollToBottom } from "./use-scroll-to-bottom";
-
-export function useMessages({ status }: { status: UseChatHelpers<ChatMessage>["status"] }) {
-  const {
-    containerRef,
-    endRef,
-    isAtBottom,
-    scrollToBottom,
-    onViewportEnter,
-    onViewportLeave,
-    reset,
-  } = useScrollToBottom();
-
-  const [hasSentMessage, setHasSentMessage] = useState(false);
-
-  useEffect(() => {
-    if (status === "submitted") {
-      setHasSentMessage(true);
-    }
-  }, [status]);
-
-  return {
-    containerRef,
-    endRef,
-    isAtBottom,
-    scrollToBottom,
-    onViewportEnter,
-    onViewportLeave,
-    hasSentMessage,
-    reset,
-  };
-}
diff --git a/packages/web/src/hooks/use-preview-panel.ts b/packages/web/src/hooks/use-preview-panel.ts
new file mode 100644
index 00000000..4df8e424
--- /dev/null
+++ b/packages/web/src/hooks/use-preview-panel.ts
@@ -0,0 +1,74 @@
+"use client";
+
+import { useCallback, useMemo } from "react";
+import useSWR from "swr";
+
+/**
+ * Lightweight global store for the live-preview side panel (foreman-q4kf).
+ *
+ * Mirrors the SWR-as-store pattern of use-artifact.ts so there's no new
+ * dependency and no provider to thread. The preview is transient (a sandbox URL,
+ * not a DB-backed document), so it deliberately does NOT use the heavier
+ * document-centric artifact framework — just open/close + the current URL.
+ */
+export type PreviewPanelState = {
+  url: string;
+  title: string;
+  /** The generated component source (Code tab). */
+  source: string;
+  /** The build log with ANSI (Terminal tab). */
+  log: string;
+  isOpen: boolean;
+};
+
+export const initialPreviewPanel: PreviewPanelState = {
+  url: "",
+  title: "Preview",
+  source: "",
+  log: "",
+  isOpen: false,
+};
+
+const KEY = "preview-panel";
+
+export function usePreviewPanelSelector<Selected>(
+  selector: (state: PreviewPanelState) => Selected,
+) {
+  const { data } = useSWR<PreviewPanelState>(KEY, null, {
+    fallbackData: initialPreviewPanel,
+  });
+  return useMemo(() => selector(data ?? initialPreviewPanel), [data, selector]);
+}
+
+export function usePreviewPanel() {
+  const { data, mutate } = useSWR<PreviewPanelState>(KEY, null, {
+    fallbackData: initialPreviewPanel,
+  });
+  const state = data ?? initialPreviewPanel;
+
+  const open = useCallback(
+    (next: { url: string; title?: string; source?: string; log?: string }) => {
+      mutate(
+        {
+          url: next.url,
+          title: next.title ?? "Preview",
+          source: next.source ?? "",
+          log: next.log ?? "",
+          isOpen: true,
+        },
+        false,
+      );
+    },
+    [mutate],
+  );
+
+  const close = useCallback(() => {
+    mutate((s) => ({ ...(s ?? initialPreviewPanel), isOpen: false }), false);
+  }, [mutate]);
+
+  const reset = useCallback(() => {
+    mutate(initialPreviewPanel, false);
+  }, [mutate]);
+
+  return useMemo(() => ({ ...state, open, close, reset }), [state, open, close, reset]);
+}
diff --git a/packages/web/src/hooks/use-scroll-to-bottom.tsx b/packages/web/src/hooks/use-scroll-to-bottom.tsx
deleted file mode 100644
index b970702f..00000000
--- a/packages/web/src/hooks/use-scroll-to-bottom.tsx
+++ /dev/null
@@ -1,124 +0,0 @@
-import { useCallback, useEffect, useRef, useState } from "react";
-
-export function useScrollToBottom() {
-  const containerRef = useRef<HTMLDivElement>(null);
-  const endRef = useRef<HTMLDivElement>(null);
-  const [isAtBottom, setIsAtBottom] = useState(true);
-  const isAtBottomRef = useRef(true);
-  const isUserScrollingRef = useRef(false);
-
-  useEffect(() => {
-    isAtBottomRef.current = isAtBottom;
-  }, [isAtBottom]);
-
-  const checkIfAtBottom = useCallback(() => {
-    if (!containerRef.current) {
-      return true;
-    }
-    const { scrollTop, scrollHeight, clientHeight } = containerRef.current;
-    return scrollTop + clientHeight >= scrollHeight - 100;
-  }, []);
-
-  const scrollToBottom = useCallback((behavior: ScrollBehavior = "smooth") => {
-    if (!containerRef.current) {
-      return;
-    }
-    containerRef.current.scrollTo({
-      top: containerRef.current.scrollHeight,
-      behavior,
-    });
-  }, []);
-
-  useEffect(() => {
-    const container = containerRef.current;
-    if (!container) {
-      return;
-    }
-
-    let scrollTimeout: ReturnType<typeof setTimeout>;
-
-    const handleScroll = () => {
-      isUserScrollingRef.current = true;
-      clearTimeout(scrollTimeout);
-
-      const atBottom = checkIfAtBottom();
-      setIsAtBottom(atBottom);
-      isAtBottomRef.current = atBottom;
-
-      scrollTimeout = setTimeout(() => {
-        isUserScrollingRef.current = false;
-      }, 150);
-    };
-
-    container.addEventListener("scroll", handleScroll, { passive: true });
-    return () => {
-      container.removeEventListener("scroll", handleScroll);
-      clearTimeout(scrollTimeout);
-    };
-  }, [checkIfAtBottom]);
-
-  useEffect(() => {
-    const container = containerRef.current;
-    if (!container) {
-      return;
-    }
-
-    const scrollIfNeeded = () => {
-      if (isAtBottomRef.current && !isUserScrollingRef.current) {
-        requestAnimationFrame(() => {
-          container.scrollTo({
-            top: container.scrollHeight,
-            behavior: "instant",
-          });
-          setIsAtBottom(true);
-          isAtBottomRef.current = true;
-        });
-      }
-    };
-
-    const mutationObserver = new MutationObserver(scrollIfNeeded);
-    mutationObserver.observe(container, {
-      childList: true,
-      subtree: true,
-      characterData: true,
-    });
-
-    const resizeObserver = new ResizeObserver(scrollIfNeeded);
-    resizeObserver.observe(container);
-
-    for (const child of container.children) {
-      resizeObserver.observe(child);
-    }
-
-    return () => {
-      mutationObserver.disconnect();
-      resizeObserver.disconnect();
-    };
-  }, []);
-
-  function onViewportEnter() {
-    setIsAtBottom(true);
-    isAtBottomRef.current = true;
-  }
-
-  function onViewportLeave() {
-    setIsAtBottom(false);
-    isAtBottomRef.current = false;
-  }
-
-  const reset = useCallback(() => {
-    setIsAtBottom(true);
-    isAtBottomRef.current = true;
-    isUserScrollingRef.current = false;
-  }, []);
-
-  return {
-    containerRef,
-    endRef,
-    isAtBottom,
-    scrollToBottom,
-    onViewportEnter,
-    onViewportLeave,
-    reset,
-  };
-}
diff --git a/packages/web/src/hooks/use-session-user.ts b/packages/web/src/hooks/use-session-user.ts
new file mode 100644
index 00000000..5bab34ea
--- /dev/null
+++ b/packages/web/src/hooks/use-session-user.ts
@@ -0,0 +1,32 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import { createClient } from "@/lib/client";
+
+export type SessionUserSnapshot = { email: string; image: string | null };
+
+/**
+ * Minimal client-side snapshot of the signed-in user (email + avatar URL),
+ * fetched once on mount. Used where a client component needs the current
+ * user's identity for avatars but isn't handed it via props (e.g. chat
+ * messages — foreman-3f1v). Returns null until resolved.
+ */
+export function useSessionUser(): SessionUserSnapshot | null {
+  const [user, setUser] = useState<SessionUserSnapshot | null>(null);
+
+  useEffect(() => {
+    createClient()
+      .auth.getUser()
+      .then(({ data: { user } }) => {
+        if (user) {
+          setUser({
+            email: user.email ?? "",
+            image: (user.user_metadata?.avatar_url as string | undefined) ?? null,
+          });
+        }
+      })
+      .catch(() => {});
+  }, []);
+
+  return user;
+}
diff --git a/packages/web/src/lib/ai/models.ts b/packages/web/src/lib/ai/models.ts
index 10fc20a8..a104a8bb 100644
--- a/packages/web/src/lib/ai/models.ts
+++ b/packages/web/src/lib/ai/models.ts
@@ -3,7 +3,7 @@
  * The actual model is selected by the agent server — this is for display/selection UI only.
  */
 
-export const DEFAULT_CHAT_MODEL = "foreman";
+export const DEFAULT_CHAT_MODEL = "anthropic/claude-sonnet-4-6";
 
 export type ModelCapabilities = {
   tools: boolean;
@@ -16,25 +16,62 @@ export type ChatModel = {
   name: string;
   provider: string;
   description: string;
+  /** Context-window size in tokens (used by the composer's context-usage gauge). */
+  contextWindow: number;
   gatewayOrder?: string[];
   reasoningEffort?: string;
 };
 
+// Claude 4.x models share a 200k-token context window.
+const CLAUDE_CONTEXT_WINDOW = 200_000;
+
+// `id` is the actual `provider/model` string the agent server routes on (it is
+// sent in the chat request body and validated server-side against an allowlist).
+// All three are Anthropic so Foreman's prompt/tool cache-control stays valid.
 export const chatModels: ChatModel[] = [
   {
-    id: "foreman",
-    name: "Foreman",
+    id: "anthropic/claude-sonnet-4-6",
+    name: "Claude Sonnet 4.6",
+    provider: "anthropic",
+    description: "Balanced — Foreman's default",
+    contextWindow: CLAUDE_CONTEXT_WINDOW,
+  },
+  {
+    id: "anthropic/claude-opus-4-6",
+    name: "Claude Opus 4.6",
     provider: "anthropic",
-    description: "AI assistant powered by Claude",
+    description: "Most capable — deeper reasoning, slower",
+    contextWindow: CLAUDE_CONTEXT_WINDOW,
+  },
+  {
+    id: "anthropic/claude-haiku-4-5-20251001",
+    name: "Claude Haiku 4.5",
+    provider: "anthropic",
+    description: "Fastest — lighter tasks",
+    contextWindow: CLAUDE_CONTEXT_WINDOW,
   },
 ];
 
 export const allowedModelIds = new Set(chatModels.map((m) => m.id));
 
+/** Context-window size for a model id, falling back to the default model's window. */
+export function getContextWindow(modelId: string | undefined): number {
+  return (
+    chatModels.find((m) => m.id === modelId)?.contextWindow ??
+    chatModels.find((m) => m.id === DEFAULT_CHAT_MODEL)?.contextWindow ??
+    CLAUDE_CONTEXT_WINDOW
+  );
+}
+
+export const MODEL_CAPABILITIES: Record<string, ModelCapabilities> = {
+  // All Claude 4.x models are tool- + vision-capable, so the chat accepts image attachments.
+  "anthropic/claude-sonnet-4-6": { tools: true, vision: true, reasoning: true },
+  "anthropic/claude-opus-4-6": { tools: true, vision: true, reasoning: true },
+  "anthropic/claude-haiku-4-5-20251001": { tools: true, vision: true, reasoning: true },
+};
+
 export async function getCapabilities(): Promise<Record<string, ModelCapabilities>> {
-  return {
-    foreman: { tools: true, vision: false, reasoning: true },
-  };
+  return MODEL_CAPABILITIES;
 }
 
 export function getActiveModels(): ChatModel[] {
diff --git a/packages/web/src/lib/apps-client.ts b/packages/web/src/lib/apps-client.ts
new file mode 100644
index 00000000..930ec6c7
--- /dev/null
+++ b/packages/web/src/lib/apps-client.ts
@@ -0,0 +1,214 @@
+/**
+ * Typed client + spec types for the /apps/* routes on the agents server.
+ *
+ * Server components pass a Supabase access token directly; client components go
+ * through app/api/apps/[...path]/route.ts which injects the same token.
+ * Shapes mirror packages/agents/src/lib/dashboards/snapshot.ts.
+ */
+
+const AGENT_URL = process.env.NEXT_PUBLIC_AGENT_SERVER_URL || "http://localhost:4111";
+
+export type SnapshotRecord = Record<string, unknown>;
+
+export interface Snapshot {
+  id: string;
+  appKey: string;
+  sourceConfig: unknown;
+  records: SnapshotRecord[];
+  rowCount: number;
+  refreshedAt: string;
+}
+
+export interface SnapshotHistory {
+  appKey: string;
+  count: number;
+  snapshots: Snapshot[];
+}
+
+// ─── Dashboard spec ─────────────────────────────────────────────────────────
+//
+// A constrained, JSON-serializable description of a dashboard. The agent emits
+// this (Phase 2 tool); the DashboardRenderer composes it from installed
+// shadcn/recharts/react-data-grid components. No code execution → safe to
+// render in-app and (later) on public pages. This type is the contract; the
+// agent-server zod schema will mirror it.
+
+export type Aggregation = "count" | "sum" | "avg" | "min" | "max";
+
+export type DashboardBlock =
+  | { type: "kpi"; label: string; field?: string; agg: Aggregation }
+  | {
+      type: "chart";
+      chartType: "bar" | "line";
+      label: string;
+      xField: string;
+      yField?: string;
+      agg: "count" | "sum";
+    }
+  | { type: "table"; label?: string; columns: string[] };
+
+export interface DashboardSpec {
+  title: string;
+  blocks: DashboardBlock[];
+}
+
+async function request<T>(path: string, accessToken: string): Promise<T> {
+  const res = await fetch(`${AGENT_URL}${path}`, {
+    headers: {
+      Authorization: `Bearer ${accessToken}`,
+      "Content-Type": "application/json",
+    },
+    cache: "no-store",
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new Error(`GET ${path} → ${res.status}: ${body}`);
+  }
+  return (await res.json()) as T;
+}
+
+export interface DashboardArtifact {
+  id: string;
+  kind: string;
+  title: string;
+  spec: DashboardSpec;
+  records: SnapshotRecord[];
+  rowCount: number;
+  updatedAt: string;
+}
+
+/** A stored dashboard artifact (spec + records) by id, or null on 404. */
+export async function getArtifact(id: string, token: string): Promise<DashboardArtifact | null> {
+  try {
+    return await request<DashboardArtifact>(`/apps/artifacts/${encodeURIComponent(id)}`, token);
+  } catch (e) {
+    if ((e as Error).message.includes("→ 404")) return null;
+    throw e;
+  }
+}
+
+/**
+ * A publicly shared dashboard by share token, or null on 404 / expired token.
+ * No auth — hits the agent server's public endpoint directly (the token is the
+ * capability). Dynamic (no-store) so the share reflects the latest snapshot.
+ */
+export async function getPublicDashboard(shareToken: string): Promise<DashboardArtifact | null> {
+  const res = await fetch(`${AGENT_URL}/apps/public/${encodeURIComponent(shareToken)}`, {
+    headers: { "Content-Type": "application/json" },
+    cache: "no-store",
+  });
+  if (res.status === 404) return null;
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new Error(`GET /apps/public → ${res.status}: ${body}`);
+  }
+  return (await res.json()) as DashboardArtifact;
+}
+
+export interface SnapshotApp {
+  appKey: string;
+  refreshedAt: string;
+  rowCount: number;
+}
+
+/**
+ * The apps that have data in the caller's workspace, newest-refreshed first.
+ * Lets the Apps page default to a real source instead of a hardcoded one
+ * (foreman-djo7). Returns [] if none / on error.
+ */
+export async function listSnapshotApps(token: string): Promise<SnapshotApp[]> {
+  try {
+    const { apps } = await request<{ apps: SnapshotApp[] }>("/apps", token);
+    return apps ?? [];
+  } catch {
+    return [];
+  }
+}
+
+/** Latest snapshot for an app, or null on 404 (no data pulled yet). */
+export async function getLatestSnapshot(appKey: string, token: string): Promise<Snapshot | null> {
+  try {
+    return await request<Snapshot>(`/apps/snapshots/${encodeURIComponent(appKey)}`, token);
+  } catch (e) {
+    if ((e as Error).message.includes("→ 404")) return null;
+    throw e;
+  }
+}
+
+export function getSnapshotHistory(
+  appKey: string,
+  token: string,
+  opts: { since?: string; limit?: number } = {},
+): Promise<SnapshotHistory> {
+  const qs = new URLSearchParams({ history: "true" });
+  if (opts.since) qs.set("since", opts.since);
+  if (opts.limit) qs.set("limit", String(opts.limit));
+  return request<SnapshotHistory>(`/apps/snapshots/${encodeURIComponent(appKey)}?${qs}`, token);
+}
+
+// ─── Default spec inference ──────────────────────────────────────────────────
+//
+// Until the agent generates+stores a spec (rest of Phase 2), derive a sensible
+// default from the snapshot records so a dashboard is viewable immediately:
+// KPIs (row count + sum/avg of the first numeric field), a bar chart (first
+// numeric grouped by first categorical, else counts by first categorical), and
+// a table of all columns.
+
+function isNumeric(v: unknown): v is number {
+  return typeof v === "number" && Number.isFinite(v);
+}
+
+export function defaultSpecFromRecords(appKey: string, records: SnapshotRecord[]): DashboardSpec {
+  const title = `${appKey} overview`;
+  const blocks: DashboardBlock[] = [];
+
+  const sample = records[0] ?? {};
+  const columns = Object.keys(sample);
+  const numericFields = columns.filter((c) => records.some((r) => isNumeric(r[c])));
+  const categoricalFields = columns.filter(
+    (c) => !numericFields.includes(c) && records.some((r) => typeof r[c] === "string"),
+  );
+
+  blocks.push({ type: "kpi", label: "Total records", agg: "count" });
+  if (numericFields[0]) {
+    blocks.push({
+      type: "kpi",
+      label: `Total ${numericFields[0]}`,
+      field: numericFields[0],
+      agg: "sum",
+    });
+    blocks.push({
+      type: "kpi",
+      label: `Avg ${numericFields[0]}`,
+      field: numericFields[0],
+      agg: "avg",
+    });
+  }
+
+  if (categoricalFields[0]) {
+    blocks.push(
+      numericFields[0]
+        ? {
+            type: "chart",
+            chartType: "bar",
+            label: `${numericFields[0]} by ${categoricalFields[0]}`,
+            xField: categoricalFields[0],
+            yField: numericFields[0],
+            agg: "sum",
+          }
+        : {
+            type: "chart",
+            chartType: "bar",
+            label: `Count by ${categoricalFields[0]}`,
+            xField: categoricalFields[0],
+            agg: "count",
+          },
+    );
+  }
+
+  if (columns.length > 0) {
+    blocks.push({ type: "table", label: "Records", columns });
+  }
+
+  return { title, blocks };
+}
diff --git a/packages/web/src/lib/avatar.ts b/packages/web/src/lib/avatar.ts
new file mode 100644
index 00000000..8bb0851d
--- /dev/null
+++ b/packages/web/src/lib/avatar.ts
@@ -0,0 +1,29 @@
+/**
+ * Fallback-avatar helpers (foreman-3f1v). When a user/member has no avatar
+ * image, we render initials on a deterministic per-identity gradient so the
+ * same person always gets the same tint. The gradient formula matches the
+ * one the user-nav circle used before the Avatar primitive was wired in.
+ */
+
+/** Deterministic hue (0-359) from a seed string (email/name/id). */
+export function seedToHue(seed: string): number {
+  let hash = 0;
+  for (const char of seed) {
+    hash = char.charCodeAt(0) + ((hash << 5) - hash);
+  }
+  return Math.abs(hash) % 360;
+}
+
+/** CSS `background` for a fallback avatar, tinted by the seed. */
+export function seedToGradient(seed: string): string {
+  const hue = seedToHue(seed);
+  return `linear-gradient(135deg, oklch(0.35 0.08 ${hue}), oklch(0.25 0.05 ${hue + 40}))`;
+}
+
+/** Up to two uppercase initials from an email or display name. */
+export function initialsFrom(value: string): string {
+  const base = value.includes("@") ? (value.split("@")[0] ?? "") : value;
+  const parts = base.split(/[\s._-]+/).filter(Boolean);
+  const chars = parts.length >= 2 ? parts[0][0] + parts[1][0] : base.slice(0, 2);
+  return chars.toUpperCase() || "?";
+}
diff --git a/packages/web/src/lib/conversations-client.ts b/packages/web/src/lib/conversations-client.ts
new file mode 100644
index 00000000..a9a0ea4d
--- /dev/null
+++ b/packages/web/src/lib/conversations-client.ts
@@ -0,0 +1,30 @@
+const AGENT_URL = process.env.NEXT_PUBLIC_AGENT_SERVER_URL || "http://localhost:4111";
+
+export interface PublicChatMessage {
+  id?: string;
+  role: "user" | "assistant" | "system";
+  parts?: Array<{ type: string; text?: string }>;
+}
+
+export interface PublicConversation {
+  conversation: { id: string; title: string | null; created_at: string };
+  messages: PublicChatMessage[];
+}
+
+/**
+ * Fetch a publicly-shared chat by token (foreman-mk25). No auth — the token in the
+ * URL is the capability, validated + expiry-checked by the agent's
+ * /conversations/public/:token endpoint. Server-component use; no-store so the
+ * share reflects the latest thread state. Returns null on 404 (unknown/expired).
+ */
+export async function getPublicConversation(
+  shareToken: string,
+): Promise<PublicConversation | null> {
+  const res = await fetch(`${AGENT_URL}/conversations/public/${encodeURIComponent(shareToken)}`, {
+    headers: { "Content-Type": "application/json" },
+    cache: "no-store",
+  });
+  if (res.status === 404) return null;
+  if (!res.ok) throw new Error(`GET /conversations/public → ${res.status}`);
+  return (await res.json()) as PublicConversation;
+}
diff --git a/packages/web/src/lib/db/schema.ts b/packages/web/src/lib/db/schema.ts
index 58437333..54e4ad4d 100644
--- a/packages/web/src/lib/db/schema.ts
+++ b/packages/web/src/lib/db/schema.ts
@@ -9,6 +9,8 @@ export type Chat = {
   title: string;
   userId: string;
   visibility: "public" | "private";
+  /** Set when the conversation is archived (non-destructive hide); null when active. */
+  archivedAt?: string | null;
 };
 
 export type DBMessage = {
diff --git a/packages/web/src/lib/documents-client.ts b/packages/web/src/lib/documents-client.ts
new file mode 100644
index 00000000..c554c263
--- /dev/null
+++ b/packages/web/src/lib/documents-client.ts
@@ -0,0 +1,173 @@
+/**
+ * Typed client for the /documents/* routes on the agents server (foreman-aqjx).
+ *
+ * Knowledge documents are files under documents/ in the user's per-tenant
+ * Workspace filesystem. The browser calls the agent server directly with the
+ * Supabase access token (same pattern as the chat transport in use-active-chat),
+ * so no Next proxy route is needed.
+ */
+import { createClient } from "@/lib/client";
+
+const AGENT_URL = process.env.NEXT_PUBLIC_AGENT_SERVER_URL || "http://localhost:4111";
+
+export type DocSpace = "shared" | "personal";
+
+export interface DocumentMeta {
+  name: string;
+  path: string;
+  size?: number;
+  space?: DocSpace;
+}
+
+/** Derive a document's Space from its path (personal docs live under _private/). */
+export function spaceOfPath(path: string): DocSpace {
+  return path.startsWith("_private/") ? "personal" : "shared";
+}
+
+async function authToken(): Promise<string> {
+  const {
+    data: { session },
+  } = await createClient().auth.getSession();
+  return session?.access_token ?? "";
+}
+
+async function authedGet<T>(path: string): Promise<T> {
+  const res = await fetch(`${AGENT_URL}${path}`, {
+    headers: {
+      Authorization: `Bearer ${await authToken()}`,
+      "Content-Type": "application/json",
+    },
+    cache: "no-store",
+  });
+  if (!res.ok) {
+    throw new Error(`GET ${path} → ${res.status}`);
+  }
+  return (await res.json()) as T;
+}
+
+async function authedPost<T>(path: string, body: unknown): Promise<T> {
+  const res = await fetch(`${AGENT_URL}${path}`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${await authToken()}`,
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify(body),
+    cache: "no-store",
+  });
+  if (!res.ok) {
+    throw new Error(`POST ${path} → ${res.status}`);
+  }
+  return (await res.json()) as T;
+}
+
+async function authedDelete<T>(path: string): Promise<T> {
+  const res = await fetch(`${AGENT_URL}${path}`, {
+    method: "DELETE",
+    headers: {
+      Authorization: `Bearer ${await authToken()}`,
+      "Content-Type": "application/json",
+    },
+    cache: "no-store",
+  });
+  if (!res.ok) {
+    throw new Error(`DELETE ${path} → ${res.status}`);
+  }
+  return (await res.json()) as T;
+}
+
+/** List the knowledge documents in the caller's workspace. */
+export async function listDocuments(): Promise<DocumentMeta[]> {
+  return (await authedGet<{ documents: DocumentMeta[] }>("/documents")).documents;
+}
+
+/** Read one document's markdown content by its workspace-relative path. */
+export async function getDocument(path: string): Promise<{ path: string; content: string }> {
+  return authedGet(`/documents/content?path=${encodeURIComponent(path)}`);
+}
+
+/**
+ * Import a text/markdown file as a new document. The server derives the slug from
+ * `name` and writes it into the chosen space (default shared). `content` is the
+ * file's text (read client-side).
+ */
+export async function importDocument(
+  name: string,
+  content: string,
+  space: DocSpace = "shared",
+): Promise<{ path: string; title: string; space: DocSpace }> {
+  return authedPost("/documents/import", { name, content, space });
+}
+
+export interface DocumentVersion {
+  version: number;
+  blobHash: string;
+  size: number;
+  title: string;
+  createdAt: string;
+  note?: string;
+}
+
+/** List a document's revisions (newest first), from its version manifest. */
+export async function listDocumentVersions(
+  path: string,
+): Promise<{ current: number; title: string; versions: DocumentVersion[] }> {
+  return authedGet(`/documents/versions?path=${encodeURIComponent(path)}`);
+}
+
+/** Read one historical revision's content from the blob store. */
+export async function getDocumentVersion(
+  path: string,
+  version: number,
+): Promise<{ path: string; version: number; content: string }> {
+  return authedGet(`/documents/version?path=${encodeURIComponent(path)}&v=${version}`);
+}
+
+/** Restore an older revision as the live document (recorded as a new revision). */
+export async function restoreDocumentVersion(
+  path: string,
+  version: number,
+): Promise<{ path: string; current: number }> {
+  return authedPost("/documents/restore", { path, version });
+}
+
+export interface DocumentShare {
+  token: string;
+  expiresAt: string | null;
+}
+
+/** The document's current public-share state (token if shared, else null). */
+export async function getDocumentShare(path: string): Promise<DocumentShare | null> {
+  const { share } = await authedGet<{ share: DocumentShare | null }>(
+    `/documents/share?path=${encodeURIComponent(path)}`,
+  );
+  return share;
+}
+
+/** Mint a public share link for a document. */
+export async function shareDocument(path: string, expiresInDays?: number): Promise<DocumentShare> {
+  return authedPost("/documents/share", { path, expiresInDays });
+}
+
+/** Revoke a public share token. */
+export async function unshareDocument(token: string): Promise<{ revoked: boolean }> {
+  return authedDelete(`/documents/share/${encodeURIComponent(token)}`);
+}
+
+/**
+ * Read a publicly shared document by token — NO auth, used by the logged-out
+ * share page (server-side fetch). Returns null on 404 (revoked/expired/unknown).
+ */
+export async function getPublicDocument(
+  token: string,
+): Promise<{ title: string; path: string; content: string } | null> {
+  const res = await fetch(`${AGENT_URL}/documents/public/${encodeURIComponent(token)}`, {
+    headers: { "Content-Type": "application/json" },
+    cache: "no-store",
+  });
+  if (res.status === 404) return null;
+  if (!res.ok) {
+    throw new Error(`GET /documents/public → ${res.status}`);
+  }
+  return (await res.json()) as { title: string; path: string; content: string };
+}
diff --git a/packages/web/src/lib/middleware.ts b/packages/web/src/lib/middleware.ts
index dd98c4af..17c68d78 100644
--- a/packages/web/src/lib/middleware.ts
+++ b/packages/web/src/lib/middleware.ts
@@ -44,6 +44,10 @@ export async function updateSession(request: NextRequest) {
     !user &&
     request.nextUrl.pathname !== "/" &&
     !request.nextUrl.pathname.startsWith("/docs") &&
+    !request.nextUrl.pathname.startsWith("/doc/") &&
+    !request.nextUrl.pathname.startsWith("/d/") &&
+    !request.nextUrl.pathname.startsWith("/c/") &&
+    !request.nextUrl.pathname.startsWith("/compare") &&
     !request.nextUrl.pathname.startsWith("/login") &&
     !request.nextUrl.pathname.startsWith("/auth")
   ) {
diff --git a/packages/web/src/lib/theme-presets.ts b/packages/web/src/lib/theme-presets.ts
index c73e63d8..41b65367 100644
--- a/packages/web/src/lib/theme-presets.ts
+++ b/packages/web/src/lib/theme-presets.ts
@@ -16,11 +16,11 @@ export type ThemePreset = {
 
 export const THEME_PRESETS: ThemePreset[] = [
   { name: "Foreman (Default)", value: "default", swatch: "#ff4a00" },
-  { name: "Underground", value: "underground", swatch: "oklch(0.5315 0.0694 156.19)" },
+  { name: "Underground", value: "underground", swatch: "oklch(0.53 0.15 156.19)" },
   { name: "Rose Garden", value: "rose-garden", swatch: "oklch(0.5827 0.2418 12.23)" },
-  { name: "Lake View", value: "lake-view", swatch: "oklch(0.765 0.177 163.22)" },
+  { name: "Lake View", value: "lake-view", swatch: "oklch(0.62 0.17 163.22)" },
   { name: "Sunset Glow", value: "sunset-glow", swatch: "oklch(0.5591 0.1882 25.33)" },
-  { name: "Forest Whisper", value: "forest-whisper", swatch: "oklch(0.5276 0.1072 182.22)" },
+  { name: "Forest Whisper", value: "forest-whisper", swatch: "oklch(0.53 0.15 182.22)" },
   { name: "Ocean Breeze", value: "ocean-breeze", swatch: "oklch(0.5461 0.2152 262.88)" },
   { name: "Lavender Dream", value: "lavender-dream", swatch: "oklch(0.5709 0.1808 306.89)" },
 ];
diff --git a/packages/web/src/lib/types.ts b/packages/web/src/lib/types.ts
index 9067ae7c..4e91ed4f 100644
--- a/packages/web/src/lib/types.ts
+++ b/packages/web/src/lib/types.ts
@@ -23,6 +23,10 @@ export type CustomUIDataTypes = {
   clear: null;
   finish: null;
   "chat-title": string;
+  // Live build feed for preview_app — one part per stage, streamed in order.
+  "preview-progress": { stage: string; label: string };
+  // Streamed terminal build log for the preview Sandbox's Terminal tab.
+  "preview-log": { log: string; done: boolean };
 };
 
 export type ChatMessage = UIMessage<MessageMetadata, CustomUIDataTypes>;
diff --git a/packages/web/src/lib/workflows-client.ts b/packages/web/src/lib/workflows-client.ts
deleted file mode 100644
index f3c0e9eb..00000000
--- a/packages/web/src/lib/workflows-client.ts
+++ /dev/null
@@ -1,122 +0,0 @@
-/**
- * Typed client for /workflows/* routes on the agents server.
- *
- * Server components pass a Supabase access token; client components rely on
- * a route handler that injects the same token. The shapes here mirror the
- * Hono routes in packages/agents/src/routes/workflows.ts.
- */
-
-const AGENT_URL = process.env.NEXT_PUBLIC_AGENT_SERVER_URL || "http://localhost:4111";
-
-export interface WorkflowSummary {
-  id: string;
-  name: string;
-  source_conversation_id: string | null;
-  parameters: string[];
-  created_at: string;
-  updated_at: string;
-}
-
-export interface WorkflowStep {
-  id: string;
-  order: number;
-  proposal_template: {
-    app_key?: string;
-    action_key?: string;
-    human_label?: string;
-    inputs?: Record<string, unknown>;
-  };
-}
-
-export interface WorkflowDetail {
-  workflow: WorkflowSummary;
-  steps: WorkflowStep[];
-}
-
-export interface WorkflowRun {
-  id: string;
-  workflow_id: string;
-  inputs: Record<string, string>;
-  status: "running" | "success" | "failed";
-  created_at: string;
-  completed_at: string | null;
-  /** How the run started: 'manual' | 'cron' | 'channel' | 'poll'. */
-  fired_by: string | null;
-  /** Failure reason when status is 'failed'. */
-  error_message: string | null;
-  /** The workflow_trigger that fired this run (null for manual runs). */
-  trigger_id: string | null;
-}
-
-export interface WorkflowTrigger {
-  id: string;
-  type: "cron" | "channel" | "poll";
-  enabled: boolean;
-  config: Record<string, unknown>;
-  last_fired_at: string | null;
-}
-
-async function request<T>(path: string, accessToken: string, init: RequestInit = {}): Promise<T> {
-  const res = await fetch(`${AGENT_URL}${path}`, {
-    ...init,
-    headers: {
-      Authorization: `Bearer ${accessToken}`,
-      "Content-Type": "application/json",
-      ...(init.headers ?? {}),
-    },
-    cache: "no-store",
-  });
-  if (!res.ok) {
-    const body = await res.text().catch(() => "");
-    throw new Error(`${init.method ?? "GET"} ${path} → ${res.status}: ${body}`);
-  }
-  return (await res.json()) as T;
-}
-
-export function listWorkflows(token: string) {
-  return request<WorkflowSummary[]>("/workflows", token);
-}
-
-export function getWorkflow(id: string, token: string) {
-  return request<WorkflowDetail>(`/workflows/${id}`, token);
-}
-
-export function listRuns(id: string, token: string) {
-  return request<WorkflowRun[]>(`/workflows/${id}/runs`, token);
-}
-
-export function listTriggers(id: string, token: string) {
-  return request<{ triggers: WorkflowTrigger[] }>(`/workflows/${id}/triggers`, token);
-}
-
-export function renameWorkflow(id: string, name: string, token: string) {
-  return request<{ ok: true; id: string; name: string }>(`/workflows/${id}`, token, {
-    method: "PATCH",
-    body: JSON.stringify({ name }),
-  });
-}
-
-export function deleteWorkflow(id: string, token: string) {
-  return request<{ ok: true; id: string }>(`/workflows/${id}`, token, { method: "DELETE" });
-}
-
-export function setTriggerEnabled(
-  workflowId: string,
-  triggerId: string,
-  enabled: boolean,
-  token: string,
-) {
-  return request<{ ok: true; id: string; enabled: boolean }>(
-    `/workflows/${workflowId}/triggers/${triggerId}`,
-    token,
-    { method: "PATCH", body: JSON.stringify({ enabled }) },
-  );
-}
-
-export function detachTrigger(workflowId: string, triggerId: string, token: string) {
-  return request<{ ok: true; id: string }>(
-    `/workflows/${workflowId}/triggers/${triggerId}`,
-    token,
-    { method: "DELETE" },
-  );
-}
diff --git a/rules/index.md b/rules/index.md
new file mode 100644
index 00000000..4819bc03
--- /dev/null
+++ b/rules/index.md
@@ -0,0 +1,18 @@
+# Project Rules
+
+Imperative coding rules for Foreman — follow these whenever you write or change
+code in this repo. They complement the other two root docs, not duplicate them:
+
+- **CLAUDE.md** — where code lives + hard-won debugging gotchas (navigation).
+- **AGENTS.md** — agent workflow: beads issue tracking, the Next.js caveat.
+- **rules/** (this folder) — conventions to apply while implementing.
+
+Each file here is `@`-imported at the top of `CLAUDE.md`, so Claude Code loads
+them every session. Keep each rule short and specific; link to CLAUDE.md for
+background instead of restating it. Change a rule in its own file — never fork a copy.
+
+## Files
+
+- `zapier-sdk.md` — generating tools + calling Zapier SDK methods
+- `mastra.md` — `createTool`, `@mastra/*` version pinning, server middleware
+- `testing-and-db.md` — test tiers, AIMock, generated DB types
diff --git a/rules/mastra.md b/rules/mastra.md
new file mode 100644
index 00000000..dc05ddf4
--- /dev/null
+++ b/rules/mastra.md
@@ -0,0 +1,18 @@
+# Mastra & Agent-Server Rules
+
+- **Never set `strict: true` on `createTool`.** It forces Anthropic's
+  grammar-constrained tool mode, which rejects `additionalProperties` /
+  `propertyNames` and caps optional params at 24 — it broke Foreman's custom
+  tools before.
+- **Keep the whole `@mastra/*` set on identical pinned versions.** They're pinned
+  in the root `overrides`; core/deployer/server drifting apart 500s every authed
+  route. `scripts/check-dep-uniqueness.mjs` enforces this — to bump, update every
+  pin together, then reinstall from a clean lockfile.
+- **`server.middleware` must not consume the request body.** A Web `Request` body
+  is single-read; the custom Hono app only pre-routes its own prefixes and lets
+  everything else fall through to Mastra with the body intact.
+- **Inline images need an explicit `mediaType`.** The `/chat` route forwards
+  `{ type: "image", image, mediaType }`; without it the AI SDK assumes JPEG and
+  Anthropic rejects PNGs.
+- **Models come from `lib/providers/models.ts` (`AGENT_MODELS`), env-overridable.**
+  Don't hard-code model ids in agent files.
diff --git a/rules/testing-and-db.md b/rules/testing-and-db.md
new file mode 100644
index 00000000..0b909b4d
--- /dev/null
+++ b/rules/testing-and-db.md
@@ -0,0 +1,14 @@
+# Testing & Database Rules
+
+- **Mocked tests must not need real provider keys.** CI runs with keys absent;
+  anything reaching a non-mocked path must fail loudly, not silently hit a real
+  API. AIMock starts in-process via `tests/aimock-setup.ts`.
+- **Test tiers:** `npm test` (mocked unit/integration) runs in CI; `test:sdk` and
+  `test:live` are opt-in and need real credentials — never wire them into CI.
+- **Regenerate DB types with the workspace flag.** After a schema/migration change
+  run `npm run db:types` (from `packages/agents`); it uses `--workdir ../..` so the
+  CLI finds the root `supabase/config.toml`. CI diffs it via `db:types:check`.
+  Start the local stack (`npx supabase start`) first.
+- **Schema is generated, not hand-written.** `src/lib/db/database.types.ts` is
+  codegen — edit migrations in `supabase/migrations/`, then regenerate; never
+  hand-edit the types.
diff --git a/rules/zapier-sdk.md b/rules/zapier-sdk.md
new file mode 100644
index 00000000..561f96a9
--- /dev/null
+++ b/rules/zapier-sdk.md
@@ -0,0 +1,29 @@
+# Zapier SDK Rules
+
+The agent's Zapier tools are auto-generated from the SDK registry in
+`packages/agents/src/lib/zapier-sdk-tools.ts`. When touching that path or calling
+the SDK:
+
+- **Never guess parameter names.** Read them from the SDK's Zod schema in the
+  registry. Known traps: table ops take `table` (not `tableId`); record creation
+  wraps each record as `{ data: {...} }`.
+- **Trigger inboxes are keyed on `key`, not `name`.** `name` is a deprecated
+  alias as of SDK 0.81.0. Pass `key` to `ensureTriggerInbox` / `createTriggerInbox`
+  and filter with `key` (see `lib/trigger-inbox/`).
+- **Classify every registry method.** Each method belongs to exactly one of
+  `APPROVAL_REQUIRED` (write/destructive → `requireApproval`), `READ_ONLY` (safe
+  reads), or `EXCLUDED_METHODS` (deprecated wrappers + surfaces we don't expose).
+  An unclassified method silently becomes a no-approval agent tool — when an SDK
+  bump adds a method, assign its set before shipping.
+- **Don't re-add deprecated/blocking methods.** `request`, the `*Authentication`
+  duplicates, the `*InputField*` aliases, and the blocking
+  `createConnection` / `waitForNewConnection` helpers stay in `EXCLUDED_METHODS`.
+- After bumping the SDK, run `npm run sdk:check` and the `zapier-sdk-tools` unit
+  test; confirm the registry-method count still equals the sum of the three sets.
+- **Human-approval durables must self-report their callback URL.** `getDurableRun`
+  does NOT expose the `ctx.createCallback` URL, so any durable with an approval gate
+  must emit the `humanApprovalGate(name)` pattern (a step reporting
+  `{ callbackUrl, callbackName }`) — that's what `resolveCallbackUrl` reads so the
+  `/automations` Approve/Deny action can POST to it. The URL is a **public bearer
+  secret**: resolve + POST it server-side only, never send it to the browser
+  (foreman-zfnj).
diff --git a/scripts/check-dep-uniqueness.mjs b/scripts/check-dep-uniqueness.mjs
index 16afc442..59fd35e2 100644
--- a/scripts/check-dep-uniqueness.mjs
+++ b/scripts/check-dep-uniqueness.mjs
@@ -8,9 +8,63 @@
 // force a single version, then run `rm -rf node_modules package-lock.json && npm install`.
 import { execSync } from "node:child_process";
 
-const MUST_BE_SINGLE = ["zod", "postcss", "@mastra/core"];
+const MUST_BE_SINGLE = ["zod", "postcss", "@mastra/core", "@mastra/deployer", "@mastra/server"];
+
+// These @mastra packages are released in lockstep and MUST all resolve to the
+// SAME version. They are NOT pinned together by default: `@mastra/core` carries
+// a root override, but `@mastra/deployer`/`@mastra/server` are transitive (pulled
+// by the `mastra` CLI via a `^` range) and silently float UP to the latest minor.
+// When they drift ahead of core, the server calls APIs core doesn't have yet —
+// e.g. deployer 1.43.0 called `mastra.getStudio()` while core was 1.42.0-alpha.3,
+// throwing in route auth so EVERY authed HTTP route 500'd while agents still
+// worked in-process. Cost ~a full session to find. Keep all three pinned to the
+// same version in root `overrides`.
+const MUST_MATCH_VERSION = ["@mastra/core", "@mastra/deployer", "@mastra/server"];
+
+function resolvedVersions(pkg) {
+  let out = "";
+  try {
+    out = execSync(`npm ls ${pkg} --all --json`, {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    });
+  } catch (err) {
+    out = err.stdout || "";
+  }
+  const versions = new Set();
+  if (out) {
+    const walk = (node) => {
+      if (node?.dependencies) {
+        for (const [name, child] of Object.entries(node.dependencies)) {
+          if (name === pkg && child.version) versions.add(child.version);
+          walk(child);
+        }
+      }
+    };
+    try {
+      walk(JSON.parse(out));
+    } catch {}
+  }
+  return versions;
+}
 
 let failed = false;
+
+// Cross-package version alignment for the lockstep @mastra server packages.
+const mastraVersions = new Map();
+for (const pkg of MUST_MATCH_VERSION) {
+  for (const v of resolvedVersions(pkg)) mastraVersions.set(`${pkg}@${v}`, v);
+}
+const distinctMastra = new Set(mastraVersions.values());
+if (distinctMastra.size > 1) {
+  console.error(
+    `\n[dep-uniqueness] @mastra/core, @mastra/deployer, @mastra/server must share ONE version, found: ${[...mastraVersions.keys()].join(", ")}`,
+  );
+  console.error(`  Pin all three in root "overrides" to the same version, then:`);
+  console.error(`    rm -rf node_modules package-lock.json && npm install`);
+  failed = true;
+}
+
 for (const pkg of MUST_BE_SINGLE) {
   // npm ls exits non-zero when there are unmet peers, but still prints valid JSON.
   // Suppress stderr at the API level (cross-platform) and ignore exit code.
diff --git a/skills-lock.json b/skills-lock.json
new file mode 100644
index 00000000..1469ab60
--- /dev/null
+++ b/skills-lock.json
@@ -0,0 +1,17 @@
+{
+  "version": 1,
+  "skills": {
+    "make-interfaces-feel-better": {
+      "source": "jakubkrehel/make-interfaces-feel-better",
+      "sourceType": "github",
+      "skillPath": "skills/make-interfaces-feel-better/SKILL.md",
+      "computedHash": "2c3576e63d8c39d75ed327f1dcf6aab7aec0edf293a55f6cb3f7b8571974a01c"
+    },
+    "supabase-postgres-best-practices": {
+      "source": "supabase/agent-skills",
+      "sourceType": "github",
+      "skillPath": "skills/supabase-postgres-best-practices/SKILL.md",
+      "computedHash": "3639bed1f40b3fbadae79fee631c42c89b2d1f5c30b05d5aa3cca06422a6bbbc"
+    }
+  }
+}
diff --git a/supabase/migrations/20260425000001_foreman_principal.sql b/supabase/migrations/20260425000001_foreman_principal.sql
new file mode 100644
index 00000000..23d36b5c
--- /dev/null
+++ b/supabase/migrations/20260425000001_foreman_principal.sql
@@ -0,0 +1,21 @@
+-- Foreman runtime principal table.
+--
+-- The unified identity every Foreman runtime table references. For web users
+-- the id equals the Supabase auth.users id (identity.ensureUserExists mirrors it
+-- here); channel-only users (Slack/Discord/etc.) get a standalone uuid with no
+-- auth.users row, bridged to a web account via channel_link_code.
+-- TEXT id (Better-Auth heritage); accessed via service_role only.
+
+CREATE TABLE IF NOT EXISTS public."user" (
+    id text NOT NULL,
+    name text NOT NULL,
+    email text NOT NULL,
+    "emailVerified" boolean NOT NULL,
+    image text,
+    "createdAt" timestamp with time zone NOT NULL,
+    "updatedAt" timestamp with time zone NOT NULL
+);
+
+ALTER TABLE public."user" OWNER TO postgres;
+ALTER TABLE public."user" ADD CONSTRAINT user_pkey PRIMARY KEY (id);
+ALTER TABLE public."user" ADD CONSTRAINT user_email_unique UNIQUE (email);
diff --git a/supabase/migrations/20260425000002_foreman_conversation.sql b/supabase/migrations/20260425000002_foreman_conversation.sql
new file mode 100644
index 00000000..3ee43850
--- /dev/null
+++ b/supabase/migrations/20260425000002_foreman_conversation.sql
@@ -0,0 +1,19 @@
+-- Conversations: chat sessions linking a principal to a Mastra thread.
+-- org_id is dropped and workspace_id added later, in
+-- 20260426000018_org_id_to_workspace_id.sql.
+
+CREATE TABLE IF NOT EXISTS public.conversation (
+    id text NOT NULL,
+    user_id text NOT NULL,
+    org_id text,
+    mastra_thread_id text,
+    title text,
+    created_at timestamp with time zone NOT NULL,
+    updated_at timestamp with time zone NOT NULL
+);
+
+ALTER TABLE public.conversation OWNER TO postgres;
+ALTER TABLE public.conversation ADD CONSTRAINT conversation_pkey PRIMARY KEY (id);
+ALTER TABLE public.conversation
+    ADD CONSTRAINT conversation_user_id_user_id_fk
+    FOREIGN KEY (user_id) REFERENCES public."user"(id);
diff --git a/supabase/migrations/20260425000003_foreman_proposals.sql b/supabase/migrations/20260425000003_foreman_proposals.sql
new file mode 100644
index 00000000..e9accef6
--- /dev/null
+++ b/supabase/migrations/20260425000003_foreman_proposals.sql
@@ -0,0 +1,43 @@
+-- Action proposals (pending tool calls awaiting human approval) and their run
+-- results. Ownership resolves through conversation (action_proposal
+-- .conversation_id -> conversation.user_id); neither table carries user_id.
+
+CREATE TABLE IF NOT EXISTS public.action_proposal (
+    id text NOT NULL,
+    conversation_id text NOT NULL,
+    mastra_run_id text,
+    app_key text NOT NULL,
+    action_type text NOT NULL,
+    action_key text NOT NULL,
+    human_label text NOT NULL,
+    inputs text NOT NULL,
+    input_schema text NOT NULL,
+    connection_id text,
+    status text NOT NULL,
+    created_at timestamp with time zone NOT NULL,
+    updated_at timestamp with time zone NOT NULL
+);
+
+ALTER TABLE public.action_proposal OWNER TO postgres;
+ALTER TABLE public.action_proposal ADD CONSTRAINT action_proposal_pkey PRIMARY KEY (id);
+
+
+CREATE TABLE IF NOT EXISTS public.action_run (
+    id text NOT NULL,
+    proposal_id text NOT NULL,
+    result text NOT NULL,
+    error text,
+    executed_at timestamp with time zone NOT NULL
+);
+
+ALTER TABLE public.action_run OWNER TO postgres;
+ALTER TABLE public.action_run ADD CONSTRAINT action_run_pkey PRIMARY KEY (id);
+
+
+ALTER TABLE public.action_proposal
+    ADD CONSTRAINT action_proposal_conversation_id_conversation_id_fk
+    FOREIGN KEY (conversation_id) REFERENCES public.conversation(id);
+
+ALTER TABLE public.action_run
+    ADD CONSTRAINT action_run_proposal_id_action_proposal_id_fk
+    FOREIGN KEY (proposal_id) REFERENCES public.action_proposal(id);
diff --git a/supabase/migrations/20260425000004_foreman_zapier.sql b/supabase/migrations/20260425000004_foreman_zapier.sql
new file mode 100644
index 00000000..95847fe4
--- /dev/null
+++ b/supabase/migrations/20260425000004_foreman_zapier.sql
@@ -0,0 +1,56 @@
+-- Zapier integration tables: per-principal OAuth identity, friendly connection
+-- aliases, and the global Zapier app-catalog cache. zapier_identity gains a
+-- workspace_id later (20260426000018) so org/team workspaces can share a
+-- connection (see lib/zapier/sdk.ts, which reads workspace_id before user_id).
+
+CREATE TABLE IF NOT EXISTS public.zapier_identity (
+    id text NOT NULL,
+    user_id text NOT NULL,
+    org_id text,
+    access_token text NOT NULL,
+    refresh_token text NOT NULL,
+    expires_at timestamp with time zone,
+    scopes text NOT NULL,
+    created_at timestamp with time zone NOT NULL,
+    updated_at timestamp with time zone NOT NULL
+);
+
+ALTER TABLE public.zapier_identity OWNER TO postgres;
+ALTER TABLE public.zapier_identity ADD CONSTRAINT zapier_identity_pkey PRIMARY KEY (id);
+ALTER TABLE public.zapier_identity ADD CONSTRAINT zapier_identity_user_id_unique UNIQUE (user_id);
+
+
+CREATE TABLE IF NOT EXISTS public.connection_alias (
+    user_id text NOT NULL,
+    alias text NOT NULL,
+    app_key text NOT NULL,
+    connection_id integer NOT NULL,
+    created_at timestamp with time zone NOT NULL
+);
+
+ALTER TABLE public.connection_alias OWNER TO postgres;
+ALTER TABLE public.connection_alias ADD CONSTRAINT connection_alias_user_id_alias_pk PRIMARY KEY (user_id, alias);
+
+
+CREATE TABLE IF NOT EXISTS public.app_catalog (
+    app_key text NOT NULL,
+    slug text NOT NULL,
+    title text NOT NULL,
+    categories text NOT NULL,
+    auth_type text,
+    action_count integer,
+    embedding_text text,
+    synced_at timestamp with time zone NOT NULL
+);
+
+ALTER TABLE public.app_catalog OWNER TO postgres;
+ALTER TABLE public.app_catalog ADD CONSTRAINT app_catalog_pkey PRIMARY KEY (app_key);
+
+
+ALTER TABLE public.zapier_identity
+    ADD CONSTRAINT zapier_identity_user_id_user_id_fk
+    FOREIGN KEY (user_id) REFERENCES public."user"(id);
+
+ALTER TABLE public.connection_alias
+    ADD CONSTRAINT connection_alias_user_id_user_id_fk
+    FOREIGN KEY (user_id) REFERENCES public."user"(id);
diff --git a/supabase/migrations/20260425000005_foreman_channels.sql b/supabase/migrations/20260425000005_foreman_channels.sql
new file mode 100644
index 00000000..acc882e4
--- /dev/null
+++ b/supabase/migrations/20260425000005_foreman_channels.sql
@@ -0,0 +1,20 @@
+-- Channel identities: map an external chat-platform user to a Foreman principal.
+-- org_id is dropped and workspace_id added later (20260426000018). The link-code
+-- table that bridges a channel account to a web account lives in
+-- 20260430000000_channel_link_codes.sql.
+
+CREATE TABLE IF NOT EXISTS public.channel_identity (
+    id text NOT NULL,
+    user_id text NOT NULL,
+    org_id text,
+    channel text NOT NULL,
+    channel_user_id text NOT NULL,
+    display_name text,
+    created_at timestamp with time zone NOT NULL
+);
+
+ALTER TABLE public.channel_identity OWNER TO postgres;
+ALTER TABLE public.channel_identity ADD CONSTRAINT channel_identity_pkey PRIMARY KEY (id);
+ALTER TABLE public.channel_identity
+    ADD CONSTRAINT channel_identity_user_id_user_id_fk
+    FOREIGN KEY (user_id) REFERENCES public."user"(id);
diff --git a/supabase/migrations/20260425000006_foreman_api_keys.sql b/supabase/migrations/20260425000006_foreman_api_keys.sql
new file mode 100644
index 00000000..81019194
--- /dev/null
+++ b/supabase/migrations/20260425000006_foreman_api_keys.sql
@@ -0,0 +1,18 @@
+-- API keys for programmatic access (fmn_ prefix), per principal.
+
+CREATE TABLE IF NOT EXISTS public.api_key (
+    id text NOT NULL,
+    user_id text NOT NULL,
+    key_hash text NOT NULL,
+    name text NOT NULL,
+    scopes text NOT NULL,
+    last_used_at timestamp with time zone,
+    created_at timestamp with time zone NOT NULL
+);
+
+ALTER TABLE public.api_key OWNER TO postgres;
+ALTER TABLE public.api_key ADD CONSTRAINT api_key_pkey PRIMARY KEY (id);
+ALTER TABLE public.api_key ADD CONSTRAINT api_key_key_hash_unique UNIQUE (key_hash);
+ALTER TABLE public.api_key
+    ADD CONSTRAINT api_key_user_id_user_id_fk
+    FOREIGN KEY (user_id) REFERENCES public."user"(id);
diff --git a/supabase/migrations/20260425000007_foreman_capabilities.sql b/supabase/migrations/20260425000007_foreman_capabilities.sql
new file mode 100644
index 00000000..c52c4533
--- /dev/null
+++ b/supabase/migrations/20260425000007_foreman_capabilities.sql
@@ -0,0 +1,13 @@
+-- Capability flags: per-principal feature toggles.
+
+CREATE TABLE IF NOT EXISTS public.capability_flag (
+    user_id text NOT NULL,
+    capability text NOT NULL,
+    enabled boolean DEFAULT false NOT NULL
+);
+
+ALTER TABLE public.capability_flag OWNER TO postgres;
+ALTER TABLE public.capability_flag ADD CONSTRAINT capability_flag_user_id_capability_pk PRIMARY KEY (user_id, capability);
+ALTER TABLE public.capability_flag
+    ADD CONSTRAINT capability_flag_user_id_user_id_fk
+    FOREIGN KEY (user_id) REFERENCES public."user"(id);
diff --git a/supabase/migrations/20260426000000_foreman_core.sql b/supabase/migrations/20260426000000_foreman_core.sql
deleted file mode 100644
index 2170ccc8..00000000
--- a/supabase/migrations/20260426000000_foreman_core.sql
+++ /dev/null
@@ -1,251 +0,0 @@
--- Foreman core application tables
--- Legacy tables carried over from Drizzle/Clerk era, migrated to Supabase
--- Note: user_id columns are TEXT (Better Auth IDs), not UUIDs
--- workspace_id columns are added later in 20260426000018_org_id_to_workspace_id.sql
--- These tables are accessed via service_role only; RLS is not enabled here
-
--- Legacy user table (Better Auth schema — id is text, not UUID)
-CREATE TABLE IF NOT EXISTS public."user" (
-    id text NOT NULL,
-    name text NOT NULL,
-    email text NOT NULL,
-    "emailVerified" boolean NOT NULL,
-    image text,
-    "createdAt" timestamp with time zone NOT NULL,
-    "updatedAt" timestamp with time zone NOT NULL
-);
-
-ALTER TABLE public."user" OWNER TO postgres;
-ALTER TABLE public."user" ADD CONSTRAINT user_pkey PRIMARY KEY (id);
-ALTER TABLE public."user" ADD CONSTRAINT user_email_unique UNIQUE (email);
-
-
--- Action proposals: pending tool calls awaiting human approval
-CREATE TABLE IF NOT EXISTS public.action_proposal (
-    id text NOT NULL,
-    conversation_id text NOT NULL,
-    mastra_run_id text,
-    app_key text NOT NULL,
-    action_type text NOT NULL,
-    action_key text NOT NULL,
-    human_label text NOT NULL,
-    inputs text NOT NULL,
-    input_schema text NOT NULL,
-    connection_id text,
-    status text NOT NULL,
-    created_at timestamp with time zone NOT NULL,
-    updated_at timestamp with time zone NOT NULL
-);
-
-ALTER TABLE public.action_proposal OWNER TO postgres;
-ALTER TABLE public.action_proposal ADD CONSTRAINT action_proposal_pkey PRIMARY KEY (id);
-
-
--- Action run results: outcome of executed proposals
-CREATE TABLE IF NOT EXISTS public.action_run (
-    id text NOT NULL,
-    proposal_id text NOT NULL,
-    result text NOT NULL,
-    error text,
-    executed_at timestamp with time zone NOT NULL
-);
-
-ALTER TABLE public.action_run OWNER TO postgres;
-ALTER TABLE public.action_run ADD CONSTRAINT action_run_pkey PRIMARY KEY (id);
-
-
--- API keys for programmatic access (fmn_ prefix)
-CREATE TABLE IF NOT EXISTS public.api_key (
-    id text NOT NULL,
-    user_id text NOT NULL,
-    key_hash text NOT NULL,
-    name text NOT NULL,
-    scopes text NOT NULL,
-    last_used_at timestamp with time zone,
-    created_at timestamp with time zone NOT NULL
-);
-
-ALTER TABLE public.api_key OWNER TO postgres;
-ALTER TABLE public.api_key ADD CONSTRAINT api_key_pkey PRIMARY KEY (id);
-ALTER TABLE public.api_key ADD CONSTRAINT api_key_key_hash_unique UNIQUE (key_hash);
-
-
--- App catalog: Zapier app registry cache
-CREATE TABLE IF NOT EXISTS public.app_catalog (
-    app_key text NOT NULL,
-    slug text NOT NULL,
-    title text NOT NULL,
-    categories text NOT NULL,
-    auth_type text,
-    action_count integer,
-    embedding_text text,
-    synced_at timestamp with time zone NOT NULL
-);
-
-ALTER TABLE public.app_catalog OWNER TO postgres;
-ALTER TABLE public.app_catalog ADD CONSTRAINT app_catalog_pkey PRIMARY KEY (app_key);
-
-
--- Capability flags: per-user feature toggles
-CREATE TABLE IF NOT EXISTS public.capability_flag (
-    user_id text NOT NULL,
-    capability text NOT NULL,
-    enabled boolean DEFAULT false NOT NULL
-);
-
-ALTER TABLE public.capability_flag OWNER TO postgres;
-ALTER TABLE public.capability_flag ADD CONSTRAINT capability_flag_user_id_capability_pk PRIMARY KEY (user_id, capability);
-
-
--- Channel identities: maps external chat platform users to Foreman users
-CREATE TABLE IF NOT EXISTS public.channel_identity (
-    id text NOT NULL,
-    user_id text NOT NULL,
-    org_id text,
-    channel text NOT NULL,
-    channel_user_id text NOT NULL,
-    display_name text,
-    created_at timestamp with time zone NOT NULL
-);
-
-ALTER TABLE public.channel_identity OWNER TO postgres;
-ALTER TABLE public.channel_identity ADD CONSTRAINT channel_identity_pkey PRIMARY KEY (id);
-
-
--- Connection aliases: friendly names for Zapier connections
-CREATE TABLE IF NOT EXISTS public.connection_alias (
-    user_id text NOT NULL,
-    alias text NOT NULL,
-    app_key text NOT NULL,
-    connection_id integer NOT NULL,
-    created_at timestamp with time zone NOT NULL
-);
-
-ALTER TABLE public.connection_alias OWNER TO postgres;
-ALTER TABLE public.connection_alias ADD CONSTRAINT connection_alias_user_id_alias_pk PRIMARY KEY (user_id, alias);
-
-
--- Conversations: chat sessions linking users to Mastra threads
-CREATE TABLE IF NOT EXISTS public.conversation (
-    id text NOT NULL,
-    user_id text NOT NULL,
-    org_id text,
-    mastra_thread_id text,
-    title text,
-    created_at timestamp with time zone NOT NULL,
-    updated_at timestamp with time zone NOT NULL
-);
-
-ALTER TABLE public.conversation OWNER TO postgres;
-ALTER TABLE public.conversation ADD CONSTRAINT conversation_pkey PRIMARY KEY (id);
-
-
--- Workflows: saved automation sequences
-CREATE TABLE IF NOT EXISTS public.workflow (
-    id text NOT NULL,
-    user_id text NOT NULL,
-    name text NOT NULL,
-    source_conversation_id text,
-    parameters text NOT NULL,
-    created_at timestamp with time zone NOT NULL,
-    updated_at timestamp with time zone NOT NULL,
-    is_template boolean DEFAULT false NOT NULL,
-    cloned_from text
-);
-
-ALTER TABLE public.workflow OWNER TO postgres;
-ALTER TABLE public.workflow ADD CONSTRAINT workflow_pkey PRIMARY KEY (id);
-
-
--- Workflow runs: execution instances of a workflow
-CREATE TABLE IF NOT EXISTS public.workflow_run (
-    id text NOT NULL,
-    workflow_id text NOT NULL,
-    inputs text NOT NULL,
-    status text NOT NULL,
-    created_at timestamp with time zone NOT NULL,
-    completed_at timestamp with time zone
-);
-
-ALTER TABLE public.workflow_run OWNER TO postgres;
-ALTER TABLE public.workflow_run ADD CONSTRAINT workflow_run_pkey PRIMARY KEY (id);
-
-
--- Workflow steps: ordered action templates within a workflow
-CREATE TABLE IF NOT EXISTS public.workflow_step (
-    id text NOT NULL,
-    workflow_id text NOT NULL,
-    "order" integer NOT NULL,
-    proposal_template text NOT NULL
-);
-
-ALTER TABLE public.workflow_step OWNER TO postgres;
-ALTER TABLE public.workflow_step ADD CONSTRAINT workflow_step_pkey PRIMARY KEY (id);
-
-
--- Zapier identities: OAuth tokens per user
-CREATE TABLE IF NOT EXISTS public.zapier_identity (
-    id text NOT NULL,
-    user_id text NOT NULL,
-    org_id text,
-    access_token text NOT NULL,
-    refresh_token text NOT NULL,
-    expires_at timestamp with time zone,
-    scopes text NOT NULL,
-    created_at timestamp with time zone NOT NULL,
-    updated_at timestamp with time zone NOT NULL
-);
-
-ALTER TABLE public.zapier_identity OWNER TO postgres;
-ALTER TABLE public.zapier_identity ADD CONSTRAINT zapier_identity_pkey PRIMARY KEY (id);
-ALTER TABLE public.zapier_identity ADD CONSTRAINT zapier_identity_user_id_unique UNIQUE (user_id);
-
-
--- Foreign keys
-ALTER TABLE public.action_proposal
-    ADD CONSTRAINT action_proposal_conversation_id_conversation_id_fk
-    FOREIGN KEY (conversation_id) REFERENCES public.conversation(id);
-
-ALTER TABLE public.action_run
-    ADD CONSTRAINT action_run_proposal_id_action_proposal_id_fk
-    FOREIGN KEY (proposal_id) REFERENCES public.action_proposal(id);
-
-ALTER TABLE public.api_key
-    ADD CONSTRAINT api_key_user_id_user_id_fk
-    FOREIGN KEY (user_id) REFERENCES public."user"(id);
-
-ALTER TABLE public.capability_flag
-    ADD CONSTRAINT capability_flag_user_id_user_id_fk
-    FOREIGN KEY (user_id) REFERENCES public."user"(id);
-
-ALTER TABLE public.channel_identity
-    ADD CONSTRAINT channel_identity_user_id_user_id_fk
-    FOREIGN KEY (user_id) REFERENCES public."user"(id);
-
-ALTER TABLE public.connection_alias
-    ADD CONSTRAINT connection_alias_user_id_user_id_fk
-    FOREIGN KEY (user_id) REFERENCES public."user"(id);
-
-ALTER TABLE public.conversation
-    ADD CONSTRAINT conversation_user_id_user_id_fk
-    FOREIGN KEY (user_id) REFERENCES public."user"(id);
-
-ALTER TABLE public.workflow
-    ADD CONSTRAINT workflow_user_id_user_id_fk
-    FOREIGN KEY (user_id) REFERENCES public."user"(id);
-
-ALTER TABLE public.workflow
-    ADD CONSTRAINT workflow_source_conversation_id_conversation_id_fk
-    FOREIGN KEY (source_conversation_id) REFERENCES public.conversation(id);
-
-ALTER TABLE public.workflow_run
-    ADD CONSTRAINT workflow_run_workflow_id_workflow_id_fk
-    FOREIGN KEY (workflow_id) REFERENCES public.workflow(id);
-
-ALTER TABLE public.workflow_step
-    ADD CONSTRAINT workflow_step_workflow_id_workflow_id_fk
-    FOREIGN KEY (workflow_id) REFERENCES public.workflow(id);
-
-ALTER TABLE public.zapier_identity
-    ADD CONSTRAINT zapier_identity_user_id_user_id_fk
-    FOREIGN KEY (user_id) REFERENCES public."user"(id);
diff --git a/supabase/migrations/20260426000001_enums.sql b/supabase/migrations/20260426000001_enums.sql
index 8a2ae824..4dd7e533 100644
--- a/supabase/migrations/20260426000001_enums.sql
+++ b/supabase/migrations/20260426000001_enums.sql
@@ -30,31 +30,3 @@ CREATE TYPE public.subscription_status AS ENUM (
 );
 
 CREATE TYPE public.pricing_plan_interval AS ENUM ('day', 'week', 'month', 'year');
-
--- Marketing feedback
-CREATE TYPE public.marketing_blog_post_status AS ENUM ('draft', 'published', 'archived');
-CREATE TYPE public.marketing_changelog_status AS ENUM ('draft', 'published', 'archived');
-CREATE TYPE public.marketing_feedback_thread_priority AS ENUM ('low', 'medium', 'high', 'urgent');
-CREATE TYPE public.marketing_feedback_thread_status AS ENUM (
-  'open',
-  'under_review',
-  'planned',
-  'in_progress',
-  'completed',
-  'closed'
-);
-CREATE TYPE public.marketing_feedback_thread_type AS ENUM (
-  'feature_request',
-  'bug',
-  'improvement',
-  'question',
-  'other'
-);
-CREATE TYPE public.marketing_feedback_moderator_hold_category AS ENUM (
-  'spam',
-  'duplicate',
-  'off_topic',
-  'inappropriate',
-  'other'
-);
-CREATE TYPE public.marketing_feedback_reaction_type AS ENUM ('like', 'heart', 'celebrate', 'upvote');
diff --git a/supabase/migrations/20260426000006_marketing.sql b/supabase/migrations/20260426000006_marketing.sql
deleted file mode 100644
index 76309315..00000000
--- a/supabase/migrations/20260426000006_marketing.sql
+++ /dev/null
@@ -1,41 +0,0 @@
--- Marketing base tables: author profiles and tags
--- Shared by blog, changelog, and feedback features
-
-CREATE TABLE IF NOT EXISTS public.marketing_author_profiles (
-  id UUID PRIMARY KEY DEFAULT extensions.uuid_generate_v4() NOT NULL,
-  user_id UUID REFERENCES public.user_profiles(id) ON DELETE SET NULL,
-  slug TEXT UNIQUE NOT NULL,
-  display_name TEXT NOT NULL,
-  bio TEXT,
-  avatar_url TEXT,
-  twitter_handle TEXT,
-  github_handle TEXT,
-  website_url TEXT,
-  created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP NOT NULL
-);
-
-ALTER TABLE public.marketing_author_profiles OWNER TO postgres;
-ALTER TABLE public.marketing_author_profiles ENABLE ROW LEVEL SECURITY;
-
-CREATE POLICY "Anyone can view author profiles" ON public.marketing_author_profiles
-  FOR SELECT USING (TRUE);
-
-CREATE POLICY "Admins can manage author profiles" ON public.marketing_author_profiles
-  FOR ALL USING (public.is_application_admin(auth.uid()));
-
-
-CREATE TABLE IF NOT EXISTS public.marketing_tags (
-  id UUID PRIMARY KEY DEFAULT extensions.uuid_generate_v4() NOT NULL,
-  slug TEXT UNIQUE NOT NULL,
-  name TEXT NOT NULL,
-  created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP NOT NULL
-);
-
-ALTER TABLE public.marketing_tags OWNER TO postgres;
-ALTER TABLE public.marketing_tags ENABLE ROW LEVEL SECURITY;
-
-CREATE POLICY "Anyone can view tags" ON public.marketing_tags
-  FOR SELECT USING (TRUE);
-
-CREATE POLICY "Admins can manage tags" ON public.marketing_tags
-  FOR ALL USING (public.is_application_admin(auth.uid()));
diff --git a/supabase/migrations/20260426000007_marketing_blog.sql b/supabase/migrations/20260426000007_marketing_blog.sql
deleted file mode 100644
index 5605fdfd..00000000
--- a/supabase/migrations/20260426000007_marketing_blog.sql
+++ /dev/null
@@ -1,64 +0,0 @@
--- Marketing: blog posts with TipTap JSON content, tags, and author relationships
-
-CREATE TABLE IF NOT EXISTS public.marketing_blog_posts (
-  id UUID PRIMARY KEY DEFAULT extensions.uuid_generate_v4() NOT NULL,
-  slug TEXT UNIQUE NOT NULL,
-  title TEXT NOT NULL,
-  summary TEXT,
-  content TEXT,
-  json_content JSONB,
-  status public.marketing_blog_post_status DEFAULT 'draft' NOT NULL,
-  cover_image TEXT,
-  media_type VARCHAR CHECK (media_type IS NULL OR media_type IN ('image', 'video', 'gif')),
-  seo_data JSONB DEFAULT '{}'::jsonb,
-  is_featured BOOLEAN DEFAULT FALSE NOT NULL,
-  published_at TIMESTAMP WITH TIME ZONE,
-  created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP NOT NULL,
-  updated_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP NOT NULL
-);
-
-ALTER TABLE public.marketing_blog_posts OWNER TO postgres;
-ALTER TABLE public.marketing_blog_posts ENABLE ROW LEVEL SECURITY;
-
-CREATE INDEX idx_marketing_blog_posts_status ON public.marketing_blog_posts(status);
-CREATE INDEX idx_marketing_blog_posts_slug ON public.marketing_blog_posts(slug);
-
-CREATE POLICY "Anyone can view published blog posts" ON public.marketing_blog_posts
-  FOR SELECT USING (status = 'published');
-
-CREATE POLICY "Admins can manage all blog posts" ON public.marketing_blog_posts
-  FOR ALL USING (public.is_application_admin(auth.uid()));
-
-
--- Blog post ↔ tag relationship
-CREATE TABLE IF NOT EXISTS public.marketing_blog_post_tags_relationship (
-  blog_post_id UUID NOT NULL REFERENCES public.marketing_blog_posts(id) ON DELETE CASCADE,
-  tag_id UUID NOT NULL REFERENCES public.marketing_tags(id) ON DELETE CASCADE,
-  PRIMARY KEY (blog_post_id, tag_id)
-);
-
-ALTER TABLE public.marketing_blog_post_tags_relationship OWNER TO postgres;
-ALTER TABLE public.marketing_blog_post_tags_relationship ENABLE ROW LEVEL SECURITY;
-
-CREATE POLICY "Anyone can view blog post tags" ON public.marketing_blog_post_tags_relationship
-  FOR SELECT USING (TRUE);
-
-CREATE POLICY "Admins can manage blog post tags" ON public.marketing_blog_post_tags_relationship
-  FOR ALL USING (public.is_application_admin(auth.uid()));
-
-
--- Blog post ↔ author relationship
-CREATE TABLE IF NOT EXISTS public.marketing_blog_author_posts (
-  blog_post_id UUID NOT NULL REFERENCES public.marketing_blog_posts(id) ON DELETE CASCADE,
-  author_id UUID NOT NULL REFERENCES public.marketing_author_profiles(id) ON DELETE CASCADE,
-  PRIMARY KEY (blog_post_id, author_id)
-);
-
-ALTER TABLE public.marketing_blog_author_posts OWNER TO postgres;
-ALTER TABLE public.marketing_blog_author_posts ENABLE ROW LEVEL SECURITY;
-
-CREATE POLICY "Anyone can view blog post authors" ON public.marketing_blog_author_posts
-  FOR SELECT USING (TRUE);
-
-CREATE POLICY "Admins can manage blog post authors" ON public.marketing_blog_author_posts
-  FOR ALL USING (public.is_application_admin(auth.uid()));
diff --git a/supabase/migrations/20260426000008_marketing_changelog.sql b/supabase/migrations/20260426000008_marketing_changelog.sql
deleted file mode 100644
index 1697f551..00000000
--- a/supabase/migrations/20260426000008_marketing_changelog.sql
+++ /dev/null
@@ -1,50 +0,0 @@
--- Marketing: changelog with TipTap JSON content, versioning, media, and author relationships
-
-CREATE TABLE IF NOT EXISTS public.marketing_changelog (
-  id UUID PRIMARY KEY DEFAULT extensions.uuid_generate_v4() NOT NULL,
-  title TEXT NOT NULL,
-  content TEXT,
-  json_content JSONB,
-  cover_image TEXT,
-  media_type VARCHAR(20) CHECK (media_type IS NULL OR media_type IN ('image', 'video', 'gif')),
-  media_url TEXT,
-  media_alt TEXT,
-  video_poster TEXT,
-  version VARCHAR(20),
-  tags TEXT[] DEFAULT '{}',
-  technical_details TEXT,
-  status public.marketing_changelog_status DEFAULT 'draft' NOT NULL,
-  published_at TIMESTAMP WITH TIME ZONE,
-  created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP NOT NULL,
-  updated_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP NOT NULL
-);
-
-ALTER TABLE public.marketing_changelog OWNER TO postgres;
-ALTER TABLE public.marketing_changelog ENABLE ROW LEVEL SECURITY;
-
-CREATE INDEX idx_marketing_changelog_status ON public.marketing_changelog(status);
-CREATE INDEX idx_marketing_changelog_tags ON public.marketing_changelog USING GIN (tags);
-CREATE INDEX idx_marketing_changelog_version ON public.marketing_changelog(version);
-
-CREATE POLICY "Anyone can view published changelog entries" ON public.marketing_changelog
-  FOR SELECT USING (status = 'published');
-
-CREATE POLICY "Admins can manage all changelog entries" ON public.marketing_changelog
-  FOR ALL USING (public.is_application_admin(auth.uid()));
-
-
--- Changelog ↔ author relationship
-CREATE TABLE IF NOT EXISTS public.marketing_changelog_author_relationship (
-  changelog_id UUID NOT NULL REFERENCES public.marketing_changelog(id) ON DELETE CASCADE,
-  author_id UUID NOT NULL REFERENCES public.marketing_author_profiles(id) ON DELETE CASCADE,
-  PRIMARY KEY (changelog_id, author_id)
-);
-
-ALTER TABLE public.marketing_changelog_author_relationship OWNER TO postgres;
-ALTER TABLE public.marketing_changelog_author_relationship ENABLE ROW LEVEL SECURITY;
-
-CREATE POLICY "Anyone can view changelog authors" ON public.marketing_changelog_author_relationship
-  FOR SELECT USING (TRUE);
-
-CREATE POLICY "Admins can manage changelog authors" ON public.marketing_changelog_author_relationship
-  FOR ALL USING (public.is_application_admin(auth.uid()));
diff --git a/supabase/migrations/20260426000009_marketing_feedback.sql b/supabase/migrations/20260426000009_marketing_feedback.sql
deleted file mode 100644
index 09fa9b1b..00000000
--- a/supabase/migrations/20260426000009_marketing_feedback.sql
+++ /dev/null
@@ -1,65 +0,0 @@
--- Marketing: feedback threads and comments
--- Boards, reactions, and subscriptions are added in subsequent migrations
-
-CREATE TABLE IF NOT EXISTS public.marketing_feedback_threads (
-  id UUID PRIMARY KEY DEFAULT extensions.uuid_generate_v4() NOT NULL,
-  title TEXT NOT NULL,
-  content TEXT,
-  user_id UUID NOT NULL REFERENCES public.user_profiles(id) ON DELETE CASCADE,
-  priority public.marketing_feedback_thread_priority DEFAULT 'medium' NOT NULL,
-  type public.marketing_feedback_thread_type DEFAULT 'feature_request' NOT NULL,
-  status public.marketing_feedback_thread_status DEFAULT 'open' NOT NULL,
-  added_to_roadmap BOOLEAN DEFAULT FALSE NOT NULL,
-  open_for_public_discussion BOOLEAN DEFAULT TRUE NOT NULL,
-  is_publicly_visible BOOLEAN DEFAULT TRUE NOT NULL,
-  moderator_hold_category public.marketing_feedback_moderator_hold_category DEFAULT NULL,
-  created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP NOT NULL,
-  updated_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP NOT NULL
-);
-
-ALTER TABLE public.marketing_feedback_threads OWNER TO postgres;
-ALTER TABLE public.marketing_feedback_threads ENABLE ROW LEVEL SECURITY;
-
-CREATE INDEX idx_marketing_feedback_threads_user_id ON public.marketing_feedback_threads(user_id);
-CREATE INDEX idx_marketing_feedback_threads_status ON public.marketing_feedback_threads(status);
-
-CREATE POLICY "Anyone can view public feedback threads" ON public.marketing_feedback_threads
-  FOR SELECT USING (is_publicly_visible = TRUE);
-
-CREATE POLICY "Users can submit feedback" ON public.marketing_feedback_threads
-  FOR INSERT WITH CHECK (auth.uid() = user_id);
-
-CREATE POLICY "Users can update their own feedback" ON public.marketing_feedback_threads
-  FOR UPDATE USING (auth.uid() = user_id);
-
-CREATE POLICY "Admins can manage all feedback threads" ON public.marketing_feedback_threads
-  FOR ALL USING (public.is_application_admin(auth.uid()));
-
-
-CREATE TABLE IF NOT EXISTS public.marketing_feedback_comments (
-  id UUID PRIMARY KEY DEFAULT extensions.uuid_generate_v4() NOT NULL,
-  thread_id UUID NOT NULL REFERENCES public.marketing_feedback_threads(id) ON DELETE CASCADE,
-  user_id UUID NOT NULL REFERENCES public.user_profiles(id) ON DELETE CASCADE,
-  content TEXT NOT NULL,
-  is_publicly_visible BOOLEAN DEFAULT TRUE NOT NULL,
-  created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP NOT NULL,
-  updated_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP NOT NULL
-);
-
-ALTER TABLE public.marketing_feedback_comments OWNER TO postgres;
-ALTER TABLE public.marketing_feedback_comments ENABLE ROW LEVEL SECURITY;
-
-CREATE INDEX idx_marketing_feedback_comments_thread_id ON public.marketing_feedback_comments(thread_id);
-CREATE INDEX idx_marketing_feedback_comments_user_id ON public.marketing_feedback_comments(user_id);
-
-CREATE POLICY "Anyone can view public feedback comments" ON public.marketing_feedback_comments
-  FOR SELECT USING (is_publicly_visible = TRUE);
-
-CREATE POLICY "Users can add comments" ON public.marketing_feedback_comments
-  FOR INSERT WITH CHECK (auth.uid() = user_id);
-
-CREATE POLICY "Users can update their own comments" ON public.marketing_feedback_comments
-  FOR UPDATE USING (auth.uid() = user_id);
-
-CREATE POLICY "Admins can manage all comments" ON public.marketing_feedback_comments
-  FOR ALL USING (public.is_application_admin(auth.uid()));
diff --git a/supabase/migrations/20260426000013_feedback_boards.sql b/supabase/migrations/20260426000013_feedback_boards.sql
deleted file mode 100644
index 2bc53cfe..00000000
--- a/supabase/migrations/20260426000013_feedback_boards.sql
+++ /dev/null
@@ -1,93 +0,0 @@
--- Feedback boards: organize threads into named boards
--- Also adds board_id column to marketing_feedback_threads
--- and reaction tables for threads and comments
-
--- Boards
-CREATE TABLE IF NOT EXISTS public.marketing_feedback_boards (
-  id UUID PRIMARY KEY DEFAULT extensions.uuid_generate_v4() NOT NULL,
-  slug TEXT UNIQUE NOT NULL,
-  title TEXT NOT NULL,
-  description TEXT,
-  color TEXT DEFAULT NULL,
-  is_active BOOLEAN DEFAULT TRUE NOT NULL,
-  created_by UUID NOT NULL REFERENCES public.user_profiles(id) ON DELETE CASCADE,
-  settings JSONB DEFAULT '{}'::jsonb NOT NULL,
-  created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP NOT NULL,
-  updated_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP NOT NULL
-);
-
-ALTER TABLE public.marketing_feedback_boards OWNER TO postgres;
-ALTER TABLE public.marketing_feedback_boards ENABLE ROW LEVEL SECURITY;
-
-CREATE INDEX idx_marketing_feedback_boards_created_by ON public.marketing_feedback_boards(created_by);
-
-CREATE POLICY "Public boards are viewable by everyone" ON public.marketing_feedback_boards
-  FOR SELECT USING (is_active = TRUE);
-
-CREATE POLICY "Admins can manage boards" ON public.marketing_feedback_boards
-  FOR ALL USING (public.is_application_admin(auth.uid()));
-
-
--- Add board reference to existing feedback threads table
-ALTER TABLE public.marketing_feedback_threads
-  ADD COLUMN board_id UUID DEFAULT NULL REFERENCES public.marketing_feedback_boards(id) ON DELETE CASCADE;
-
-CREATE INDEX idx_marketing_feedback_threads_board_id ON public.marketing_feedback_threads(board_id);
-
-
--- Thread reactions
-CREATE TABLE IF NOT EXISTS public.marketing_feedback_thread_reactions (
-  id UUID PRIMARY KEY DEFAULT extensions.uuid_generate_v4() NOT NULL,
-  thread_id UUID NOT NULL REFERENCES public.marketing_feedback_threads(id) ON DELETE CASCADE,
-  user_id UUID NOT NULL REFERENCES public.user_profiles(id) ON DELETE CASCADE,
-  reaction_type public.marketing_feedback_reaction_type NOT NULL,
-  created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP NOT NULL
-);
-
-ALTER TABLE public.marketing_feedback_thread_reactions OWNER TO postgres;
-ALTER TABLE public.marketing_feedback_thread_reactions ENABLE ROW LEVEL SECURITY;
-
-CREATE UNIQUE INDEX idx_unique_thread_user_reaction
-  ON public.marketing_feedback_thread_reactions(thread_id, user_id, reaction_type);
-CREATE INDEX idx_marketing_feedback_thread_reactions_thread_id
-  ON public.marketing_feedback_thread_reactions(thread_id);
-CREATE INDEX idx_marketing_feedback_thread_reactions_user_id
-  ON public.marketing_feedback_thread_reactions(user_id);
-
-CREATE POLICY "Users can view all thread reactions" ON public.marketing_feedback_thread_reactions
-  FOR SELECT USING (TRUE);
-
-CREATE POLICY "Users can add their own reactions" ON public.marketing_feedback_thread_reactions
-  FOR INSERT WITH CHECK (auth.uid() = user_id);
-
-CREATE POLICY "Users can remove their own reactions" ON public.marketing_feedback_thread_reactions
-  FOR DELETE USING (auth.uid() = user_id);
-
-
--- Comment reactions
-CREATE TABLE IF NOT EXISTS public.marketing_feedback_comment_reactions (
-  id UUID PRIMARY KEY DEFAULT extensions.uuid_generate_v4() NOT NULL,
-  comment_id UUID NOT NULL REFERENCES public.marketing_feedback_comments(id) ON DELETE CASCADE,
-  user_id UUID NOT NULL REFERENCES public.user_profiles(id) ON DELETE CASCADE,
-  reaction_type public.marketing_feedback_reaction_type NOT NULL,
-  created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP NOT NULL
-);
-
-ALTER TABLE public.marketing_feedback_comment_reactions OWNER TO postgres;
-ALTER TABLE public.marketing_feedback_comment_reactions ENABLE ROW LEVEL SECURITY;
-
-CREATE UNIQUE INDEX idx_unique_comment_user_reaction
-  ON public.marketing_feedback_comment_reactions(comment_id, user_id, reaction_type);
-CREATE INDEX idx_marketing_feedback_comment_reactions_comment_id
-  ON public.marketing_feedback_comment_reactions(comment_id);
-CREATE INDEX idx_marketing_feedback_comment_reactions_user_id
-  ON public.marketing_feedback_comment_reactions(user_id);
-
-CREATE POLICY "Users can view all comment reactions" ON public.marketing_feedback_comment_reactions
-  FOR SELECT USING (TRUE);
-
-CREATE POLICY "Users can add their own comment reactions" ON public.marketing_feedback_comment_reactions
-  FOR INSERT WITH CHECK (auth.uid() = user_id);
-
-CREATE POLICY "Users can remove their own comment reactions" ON public.marketing_feedback_comment_reactions
-  FOR DELETE USING (auth.uid() = user_id);
diff --git a/supabase/migrations/20260426000014_feedback_subscriptions.sql b/supabase/migrations/20260426000014_feedback_subscriptions.sql
deleted file mode 100644
index 50467faf..00000000
--- a/supabase/migrations/20260426000014_feedback_subscriptions.sql
+++ /dev/null
@@ -1,48 +0,0 @@
--- Feedback subscriptions: users can follow boards and individual threads
-
-CREATE TABLE IF NOT EXISTS public.marketing_feedback_board_subscriptions (
-  id UUID PRIMARY KEY DEFAULT extensions.uuid_generate_v4() NOT NULL,
-  user_id UUID NOT NULL REFERENCES public.user_profiles(id) ON DELETE CASCADE,
-  board_id UUID NOT NULL REFERENCES public.marketing_feedback_boards(id) ON DELETE CASCADE,
-  created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP NOT NULL
-);
-
-ALTER TABLE public.marketing_feedback_board_subscriptions OWNER TO postgres;
-ALTER TABLE public.marketing_feedback_board_subscriptions ENABLE ROW LEVEL SECURITY;
-
-CREATE UNIQUE INDEX idx_unique_board_subscription
-  ON public.marketing_feedback_board_subscriptions(user_id, board_id);
-CREATE INDEX idx_marketing_feedback_board_subscriptions_user_id
-  ON public.marketing_feedback_board_subscriptions(user_id);
-CREATE INDEX idx_marketing_feedback_board_subscriptions_board_id
-  ON public.marketing_feedback_board_subscriptions(board_id);
-
-CREATE POLICY "Users can view their own board subscriptions" ON public.marketing_feedback_board_subscriptions
-  FOR SELECT USING (auth.uid() = user_id);
-
-CREATE POLICY "Users can manage their own board subscriptions" ON public.marketing_feedback_board_subscriptions
-  FOR ALL USING (auth.uid() = user_id) WITH CHECK (auth.uid() = user_id);
-
-
-CREATE TABLE IF NOT EXISTS public.marketing_feedback_thread_subscriptions (
-  id UUID PRIMARY KEY DEFAULT extensions.uuid_generate_v4() NOT NULL,
-  user_id UUID NOT NULL REFERENCES public.user_profiles(id) ON DELETE CASCADE,
-  thread_id UUID NOT NULL REFERENCES public.marketing_feedback_threads(id) ON DELETE CASCADE,
-  created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP NOT NULL
-);
-
-ALTER TABLE public.marketing_feedback_thread_subscriptions OWNER TO postgres;
-ALTER TABLE public.marketing_feedback_thread_subscriptions ENABLE ROW LEVEL SECURITY;
-
-CREATE UNIQUE INDEX idx_unique_thread_subscription
-  ON public.marketing_feedback_thread_subscriptions(user_id, thread_id);
-CREATE INDEX idx_marketing_feedback_thread_subscriptions_user_id
-  ON public.marketing_feedback_thread_subscriptions(user_id);
-CREATE INDEX idx_marketing_feedback_thread_subscriptions_thread_id
-  ON public.marketing_feedback_thread_subscriptions(thread_id);
-
-CREATE POLICY "Users can view their own thread subscriptions" ON public.marketing_feedback_thread_subscriptions
-  FOR SELECT USING (auth.uid() = user_id);
-
-CREATE POLICY "Users can manage their own thread subscriptions" ON public.marketing_feedback_thread_subscriptions
-  FOR ALL USING (auth.uid() = user_id) WITH CHECK (auth.uid() = user_id);
diff --git a/supabase/migrations/20260426000020_rls.sql b/supabase/migrations/20260426000020_rls.sql
index eef43ddb..0b2da5c7 100644
--- a/supabase/migrations/20260426000020_rls.sql
+++ b/supabase/migrations/20260426000020_rls.sql
@@ -13,9 +13,6 @@ ALTER TABLE public.capability_flag ENABLE ROW LEVEL SECURITY;
 ALTER TABLE public.channel_identity ENABLE ROW LEVEL SECURITY;
 ALTER TABLE public.connection_alias ENABLE ROW LEVEL SECURITY;
 ALTER TABLE public.zapier_identity ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.workflow ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.workflow_run ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.workflow_step ENABLE ROW LEVEL SECURITY;
 
 -- App catalog: read-only reference data; allow authenticated users to query directly
 -- (used by the frontend to show available Zapier apps)
diff --git a/supabase/migrations/20260428000000_revoke_anon_grants.sql b/supabase/migrations/20260428000000_revoke_anon_grants.sql
index 0f474bcc..7e56e1d3 100644
--- a/supabase/migrations/20260428000000_revoke_anon_grants.sql
+++ b/supabase/migrations/20260428000000_revoke_anon_grants.sql
@@ -1,6 +1,5 @@
 -- Revoke anon SELECT from all non-public tables
--- marketing_* tables remain readable by anon (public blog, changelog, feedback)
--- All other tables should require authentication
+-- All tables require authentication (the unused marketing/feedback CMS was removed)
 
 REVOKE SELECT ON TABLE public.account_delete_tokens FROM anon;
 REVOKE SELECT ON TABLE public.action_proposal FROM anon;
@@ -54,9 +53,6 @@ REVOKE SELECT ON TABLE public.user_application_settings FROM anon;
 REVOKE SELECT ON TABLE public.user_notifications FROM anon;
 REVOKE SELECT ON TABLE public.user_profiles FROM anon;
 REVOKE SELECT ON TABLE public.user_settings FROM anon;
-REVOKE SELECT ON TABLE public.workflow FROM anon;
-REVOKE SELECT ON TABLE public.workflow_run FROM anon;
-REVOKE SELECT ON TABLE public.workflow_step FROM anon;
 REVOKE SELECT ON TABLE public.workspace_admin_settings FROM anon;
 REVOKE SELECT ON TABLE public.workspace_application_settings FROM anon;
 REVOKE SELECT ON TABLE public.workspace_credits FROM anon;
diff --git a/supabase/migrations/20260510000000_workflow_trigger.sql b/supabase/migrations/20260510000000_workflow_trigger.sql
deleted file mode 100644
index 1527f6ba..00000000
--- a/supabase/migrations/20260510000000_workflow_trigger.sql
+++ /dev/null
@@ -1,38 +0,0 @@
--- workflow_trigger: binds a saved workflow to an external event source.
---
--- Three trigger types are supported by the agent / engine:
---   cron     — fires on a schedule (config: { schedule, timezone? })
---   channel  — fires when a matching message arrives on a chat channel
---              (config: { channel, match: {...} })
---   poll     — fires when a Zapier read action returns a new dedupeKey
---              (config: { app, action, connection, inputs, dedupeKey, intervalMinutes })
---
--- Cron + poll are driven by a worker process that polls this table.
--- Channel triggers are matched in-line by the channel webhook handlers.
-
-CREATE TABLE IF NOT EXISTS public.workflow_trigger (
-    id text NOT NULL,
-    workflow_id text NOT NULL,
-    type text NOT NULL,
-    config text NOT NULL,
-    enabled boolean NOT NULL DEFAULT true,
-    last_fired_at timestamp with time zone,
-    last_dedupe_key text,
-    created_at timestamp with time zone NOT NULL,
-    updated_at timestamp with time zone NOT NULL
-);
-
-ALTER TABLE public.workflow_trigger OWNER TO postgres;
-ALTER TABLE public.workflow_trigger
-    ADD CONSTRAINT workflow_trigger_pkey PRIMARY KEY (id);
-ALTER TABLE public.workflow_trigger
-    ADD CONSTRAINT workflow_trigger_workflow_id_fk
-    FOREIGN KEY (workflow_id) REFERENCES public.workflow(id) ON DELETE CASCADE;
-ALTER TABLE public.workflow_trigger
-    ADD CONSTRAINT workflow_trigger_type_check
-    CHECK (type IN ('cron', 'channel', 'poll'));
-
-CREATE INDEX IF NOT EXISTS workflow_trigger_workflow_id_idx
-    ON public.workflow_trigger(workflow_id);
-CREATE INDEX IF NOT EXISTS workflow_trigger_enabled_type_idx
-    ON public.workflow_trigger(type, enabled);
diff --git a/supabase/migrations/20260612000000_workflow_run_observability.sql b/supabase/migrations/20260612000000_workflow_run_observability.sql
deleted file mode 100644
index 77da845b..00000000
--- a/supabase/migrations/20260612000000_workflow_run_observability.sql
+++ /dev/null
@@ -1,17 +0,0 @@
--- workflow_run observability (foreman-2afc)
---
--- Persist WHY a run fired and WHY it failed, so trigger-fired runs carry context
--- in run history (previously they only console.warn'd) and failures surface
--- their error instead of just flipping status to 'failed'.
---
---   error_message — the failure reason when status='failed'
---   fired_by      — how the run started: 'manual' | 'cron' | 'channel' | 'poll'
---   trigger_id    — the workflow_trigger row that fired it (null for manual runs)
-
-ALTER TABLE public.workflow_run
-    ADD COLUMN IF NOT EXISTS error_message text,
-    ADD COLUMN IF NOT EXISTS fired_by text,
-    ADD COLUMN IF NOT EXISTS trigger_id text;
-
-CREATE INDEX IF NOT EXISTS workflow_run_trigger_id_idx
-    ON public.workflow_run(trigger_id);
diff --git a/supabase/migrations/20260619000000_app_data_snapshot.sql b/supabase/migrations/20260619000000_app_data_snapshot.sql
new file mode 100644
index 00000000..62d572a1
--- /dev/null
+++ b/supabase/migrations/20260619000000_app_data_snapshot.sql
@@ -0,0 +1,39 @@
+-- app_data_snapshot: append-only snapshots of data pulled from a user's
+-- connected apps (e.g. HubSpot contacts, Airtable records) to back dashboards.
+--
+-- APPEND-ONLY: one row per refresh (NOT an upsert) so we keep version history
+-- and can render time-series/trend charts. The latest snapshot for a source is
+-- `ORDER BY refreshed_at DESC LIMIT 1`. A retention/prune policy is a follow-up.
+--
+-- Populated via saveSnapshot (lib/dashboards/snapshot.ts) and read by the
+-- /dashboards data endpoints. Service_role access only, like the
+-- other Foreman core tables. user_id is TEXT (Better Auth IDs), matching
+-- conversation/workflow; JSON payloads are stored as text and parsed in app code.
+
+CREATE TABLE IF NOT EXISTS public.app_data_snapshot (
+    id text NOT NULL,
+    user_id text NOT NULL,
+    workspace_id uuid,
+    app_key text NOT NULL,
+    source_config text NOT NULL,
+    records text NOT NULL,
+    row_count integer NOT NULL DEFAULT 0,
+    trigger_id text,
+    refreshed_at timestamp with time zone NOT NULL,
+    created_at timestamp with time zone NOT NULL
+);
+
+ALTER TABLE public.app_data_snapshot OWNER TO postgres;
+ALTER TABLE public.app_data_snapshot
+    ADD CONSTRAINT app_data_snapshot_pkey PRIMARY KEY (id);
+-- Snapshots back SHARED workspace dashboards (user_id records who pulled them).
+ALTER TABLE public.app_data_snapshot
+    ADD CONSTRAINT app_data_snapshot_workspace_id_fk
+    FOREIGN KEY (workspace_id) REFERENCES public.workspaces(id) ON DELETE SET NULL;
+
+-- Latest + history + prune reads are scoped by (workspace_id, app_key) ordered by refreshed_at.
+CREATE INDEX IF NOT EXISTS app_data_snapshot_workspace_app_refreshed_idx
+    ON public.app_data_snapshot(workspace_id, app_key, refreshed_at DESC);
+
+-- Service_role access only — match the other Foreman core tables (RLS not used here).
+REVOKE SELECT ON TABLE public.app_data_snapshot FROM anon;
diff --git a/supabase/migrations/20260619010000_artifact.sql b/supabase/migrations/20260619010000_artifact.sql
new file mode 100644
index 00000000..985e5928
--- /dev/null
+++ b/supabase/migrations/20260619010000_artifact.sql
@@ -0,0 +1,41 @@
+-- artifact: agent-generated, stored, viewable outputs. Dashboards are the first
+-- `kind`; reports/mini-sites can follow without new tables (artifact-shaped
+-- foundation, per the 2026-06-19 design decision).
+--
+-- A dashboard artifact = a constrained JSON `spec` (validated by zod server-side
+-- before render) + a reference to the data it was built from (snapshot_id +
+-- source_config provenance). The spec is the safety boundary that makes the
+-- output safe to render in-app and (later) on public share pages.
+--
+-- Conventions match the other Foreman core tables: text ids, user_id is TEXT
+-- (Better Auth IDs), JSON payloads stored as text and parsed in app code,
+-- service_role access only (no RLS), app-set timestamps.
+
+CREATE TABLE IF NOT EXISTS public.artifact (
+    id text NOT NULL,
+    user_id text NOT NULL,
+    workspace_id uuid,
+    kind text NOT NULL DEFAULT 'dashboard',
+    title text NOT NULL,
+    spec text NOT NULL,
+    snapshot_id text,
+    source_config text,
+    visibility text NOT NULL DEFAULT 'private',
+    version integer NOT NULL DEFAULT 1,
+    created_at timestamp with time zone NOT NULL,
+    updated_at timestamp with time zone NOT NULL
+);
+
+ALTER TABLE public.artifact OWNER TO postgres;
+ALTER TABLE public.artifact ADD CONSTRAINT artifact_pkey PRIMARY KEY (id);
+-- Dashboards are a SHARED workspace resource (user_id is creator attribution).
+ALTER TABLE public.artifact
+    ADD CONSTRAINT artifact_workspace_id_fk
+    FOREIGN KEY (workspace_id) REFERENCES public.workspaces(id) ON DELETE SET NULL;
+
+-- List/most-recent reads are scoped by (workspace_id, kind) ordered by updated_at.
+CREATE INDEX IF NOT EXISTS artifact_workspace_kind_updated_idx
+    ON public.artifact(workspace_id, kind, updated_at DESC);
+
+-- Service_role access only — match the other Foreman core tables (RLS not used).
+REVOKE SELECT ON TABLE public.artifact FROM anon;
diff --git a/supabase/migrations/20260620000000_conversation_archive.sql b/supabase/migrations/20260620000000_conversation_archive.sql
new file mode 100644
index 00000000..aee73ead
--- /dev/null
+++ b/supabase/migrations/20260620000000_conversation_archive.sql
@@ -0,0 +1,18 @@
+-- Archive support for conversations.
+--
+-- Archiving is a non-destructive hide: the conversation row (and its Mastra
+-- Memory thread) stay intact, but the sidebar history excludes it from the
+-- default list. `archived_at` doubles as the flag (NULL = active) and the
+-- timestamp it was archived, so an "Archived" view can sort by it.
+--
+-- Conventions match the other Foreman core tables: nullable app-set timestamp,
+-- service_role access only (no RLS).
+
+ALTER TABLE public.conversation
+    ADD COLUMN IF NOT EXISTS archived_at timestamp with time zone;
+
+-- The default sidebar query is "this user's active conversations, newest first".
+-- A partial index on the active rows keeps that read fast as archives accumulate.
+CREATE INDEX IF NOT EXISTS conversation_user_active_idx
+    ON public.conversation(user_id, updated_at DESC)
+    WHERE archived_at IS NULL;
diff --git a/supabase/migrations/20260620010000_dashboard_share.sql b/supabase/migrations/20260620010000_dashboard_share.sql
new file mode 100644
index 00000000..bc2be478
--- /dev/null
+++ b/supabase/migrations/20260620010000_dashboard_share.sql
@@ -0,0 +1,43 @@
+-- dashboard_share: a capability token that makes one artifact (dashboard)
+-- viewable on a public, logged-out share page (Phase 3 of the dashboards epic).
+--
+-- The token IS the grant: possessing a valid, unexpired `share_token` lets the
+-- public endpoint return that artifact's spec + records — no auth, no account.
+-- It carries the owner's `user_id` so the public read can resolve the records
+-- (which are scoped to the owner) without the viewer being authenticated.
+-- `expires_at` is nullable (NULL = never expires). Revoking a share = delete the
+-- row. The artifact's own `visibility` stays the owner's setting; access here is
+-- gated purely on the token, so a leaked token can be cut without touching the
+-- artifact.
+--
+-- Conventions match the other Foreman core tables: text ids, user_id is TEXT,
+-- service_role access only (no RLS), app-set timestamps.
+
+CREATE TABLE IF NOT EXISTS public.dashboard_share (
+    id text NOT NULL,
+    artifact_id text NOT NULL,
+    workspace_id uuid,
+    user_id text NOT NULL,
+    share_token text NOT NULL,
+    expires_at timestamp with time zone,
+    created_at timestamp with time zone NOT NULL
+);
+
+ALTER TABLE public.dashboard_share OWNER TO postgres;
+ALTER TABLE public.dashboard_share ADD CONSTRAINT dashboard_share_pkey PRIMARY KEY (id);
+-- Shares belong to a workspace dashboard (SHARED); user_id is the share creator.
+-- workspace_id is what the public read uses to resolve the workspace-scoped data.
+ALTER TABLE public.dashboard_share
+    ADD CONSTRAINT dashboard_share_workspace_id_fk
+    FOREIGN KEY (workspace_id) REFERENCES public.workspaces(id) ON DELETE SET NULL;
+
+-- Public reads look up by token — must be unique and fast.
+CREATE UNIQUE INDEX IF NOT EXISTS dashboard_share_token_key
+    ON public.dashboard_share(share_token);
+
+-- Workspace-scoped reads (list/revoke a workspace's shares) + FK covering index.
+CREATE INDEX IF NOT EXISTS dashboard_share_workspace_idx
+    ON public.dashboard_share(workspace_id, artifact_id);
+
+-- Service_role access only — match the other Foreman core tables (RLS not used).
+REVOKE SELECT ON TABLE public.dashboard_share FROM anon;
diff --git a/supabase/migrations/20260621000000_fk_covering_indexes.sql b/supabase/migrations/20260621000000_fk_covering_indexes.sql
new file mode 100644
index 00000000..d04e7451
--- /dev/null
+++ b/supabase/migrations/20260621000000_fk_covering_indexes.sql
@@ -0,0 +1,31 @@
+-- Covering indexes for foreign-key columns.
+--
+-- Postgres does not auto-index FK columns; without these, JOINs and ON DELETE
+-- CASCADE / SET NULL do full table scans (schema-foreign-key-indexes, HIGH).
+-- One index per unindexed FK column, surfaced by the supabase-postgres
+-- best-practices audit (foreman-qhbp). Idempotent (IF NOT EXISTS).
+
+-- Foreman runtime
+CREATE INDEX IF NOT EXISTS action_proposal_conversation_id_idx ON public.action_proposal(conversation_id);
+CREATE INDEX IF NOT EXISTS action_run_proposal_id_idx ON public.action_run(proposal_id);
+CREATE INDEX IF NOT EXISTS api_key_user_id_idx ON public.api_key(user_id);
+CREATE INDEX IF NOT EXISTS channel_identity_user_id_idx ON public.channel_identity(user_id);
+CREATE INDEX IF NOT EXISTS stored_agent_current_version_id_idx ON public.stored_agent(current_version_id);
+
+-- Billing (multi-tenant monetization foundation)
+CREATE INDEX IF NOT EXISTS billing_invoices_gateway_customer_id_idx ON public.billing_invoices(gateway_customer_id);
+CREATE INDEX IF NOT EXISTS billing_invoices_subscription_id_idx ON public.billing_invoices(subscription_id);
+CREATE INDEX IF NOT EXISTS billing_one_time_payments_gateway_customer_id_idx ON public.billing_one_time_payments(gateway_customer_id);
+CREATE INDEX IF NOT EXISTS billing_payment_methods_gateway_customer_id_idx ON public.billing_payment_methods(gateway_customer_id);
+CREATE INDEX IF NOT EXISTS billing_prices_product_id_idx ON public.billing_prices(product_id);
+CREATE INDEX IF NOT EXISTS billing_subscriptions_gateway_customer_id_idx ON public.billing_subscriptions(gateway_customer_id);
+CREATE INDEX IF NOT EXISTS billing_subscriptions_price_id_idx ON public.billing_subscriptions(price_id);
+CREATE INDEX IF NOT EXISTS billing_usage_logs_subscription_id_idx ON public.billing_usage_logs(subscription_id);
+CREATE INDEX IF NOT EXISTS billing_volume_tiers_price_id_idx ON public.billing_volume_tiers(price_id);
+
+-- Workspace multi-tenant
+CREATE INDEX IF NOT EXISTS user_settings_default_workspace_idx ON public.user_settings(default_workspace);
+CREATE INDEX IF NOT EXISTS workspace_credits_logs_workspace_credits_id_idx ON public.workspace_credits_logs(workspace_credits_id);
+CREATE INDEX IF NOT EXISTS workspace_credits_logs_workspace_id_idx ON public.workspace_credits_logs(workspace_id);
+CREATE INDEX IF NOT EXISTS workspace_invitations_invitee_user_id_idx ON public.workspace_invitations(invitee_user_id);
+CREATE INDEX IF NOT EXISTS workspace_invitations_inviter_user_id_idx ON public.workspace_invitations(inviter_user_id);
diff --git a/supabase/migrations/20260621000001_rls_consistency.sql b/supabase/migrations/20260621000001_rls_consistency.sql
new file mode 100644
index 00000000..7653e82a
--- /dev/null
+++ b/supabase/migrations/20260621000001_rls_consistency.sql
@@ -0,0 +1,21 @@
+-- RLS consistency: enable row-level security on the service-role-only tables that
+-- were created after rls.sql and never had it enabled (security-rls-basics).
+--
+-- The app accesses these exclusively via the service_role client, which BYPASSES
+-- RLS — so this is a no-op for the app. Enabling RLS with no policies denies the
+-- authenticated/anon roles by default (defense-in-depth: closes the gap where an
+-- authenticated JWT could otherwise read these tables directly via PostgREST) and
+-- makes RLS coverage uniform across the schema. Workspace-scoped policies, if we
+-- ever expose direct client reads, are added in Phase 2b.
+
+ALTER TABLE public.app_data_snapshot ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.artifact ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.channel_link_code ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.dashboard_share ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.stored_agent ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.stored_agent_version ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.slack_installation ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.mastra_channel_config ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.mastra_channel_installations ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.mastra_schedule_triggers ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.mastra_schedules ENABLE ROW LEVEL SECURITY;
diff --git a/supabase/migrations/20260621000002_workspace_wiring.sql b/supabase/migrations/20260621000002_workspace_wiring.sql
new file mode 100644
index 00000000..37e8b124
--- /dev/null
+++ b/supabase/migrations/20260621000002_workspace_wiring.sql
@@ -0,0 +1,24 @@
+-- Workspace wiring (Phase 2b, foreman-qhbp): give Foreman's workspace-scoped
+-- runtime tables a workspace tenant so the platform's multi-tenant model actually
+-- scopes shared data.
+--
+-- public.user (the principal) gains default_workspace_id — the active workspace a
+-- principal operates in. Web users: initialized from their auto-provisioned
+-- user_settings.default_workspace (handle_auth_user_created trigger). Channel-only
+-- principals: a solo workspace created at registerChannelUser. Resolution reads
+-- this single field uniformly (lib/identity.ts resolveActiveWorkspace).
+--
+-- Scoping model — "shared resources, private chats":
+--   • SHARED (workspace-scoped): stored_agent (here) + the dashboard tables
+--     (artifact, app_data_snapshot, dashboard_share — workspace_id lives in their
+--     own migrations) + zapier_identity (shared connections, via ...018).
+--   • PRIVATE (user-scoped, NO workspace_id): conversation, api_key,
+--     capability_flag, channel_identity, channel_link_code, connection_alias.
+
+ALTER TABLE public."user"
+  ADD COLUMN IF NOT EXISTS default_workspace_id UUID REFERENCES public.workspaces(id) ON DELETE SET NULL;
+CREATE INDEX IF NOT EXISTS user_default_workspace_id_idx ON public."user"(default_workspace_id);
+
+ALTER TABLE public.stored_agent
+  ADD COLUMN IF NOT EXISTS workspace_id UUID REFERENCES public.workspaces(id) ON DELETE SET NULL;
+CREATE INDEX IF NOT EXISTS stored_agent_workspace_id_idx ON public.stored_agent(workspace_id);
diff --git a/supabase/migrations/20260621000003_workspace_connection_mode.sql b/supabase/migrations/20260621000003_workspace_connection_mode.sql
new file mode 100644
index 00000000..7fbdf840
--- /dev/null
+++ b/supabase/migrations/20260621000003_workspace_connection_mode.sql
@@ -0,0 +1,16 @@
+-- Per-workspace Zapier connection-resolution policy (foreman-qhbp, step 4).
+--
+-- How a workspace member's Zapier SDK resolves a connection when they act:
+--   • member-first (DEFAULT) — use the member's own connection if they have one,
+--     else fall back to the workspace's shared (designated) connection.
+--   • shared   — always use the workspace's designated connection (a zapier_identity
+--                row tagged with this workspace_id), regardless of personal links.
+--   • personal — use only the member's own connection; never the shared one.
+--
+-- Lives on workspace_settings (members view, admins set — RLS already in place).
+-- An absent row ⇒ the member-first default (lib/zapier/sdk.ts
+-- resolveWorkspaceConnectionMode reads this column).
+
+ALTER TABLE public.workspace_settings
+  ADD COLUMN IF NOT EXISTS zapier_connection_mode text NOT NULL DEFAULT 'member-first'
+  CHECK (zapier_connection_mode IN ('member-first', 'shared', 'personal'));
diff --git a/supabase/migrations/20260626000000_automations.sql b/supabase/migrations/20260626000000_automations.sql
new file mode 100644
index 00000000..19c4a8e2
--- /dev/null
+++ b/supabase/migrations/20260626000000_automations.sql
@@ -0,0 +1,104 @@
+-- automation: a deployed durable automation = a Zapier durable workflow (the
+-- execution substrate) + an optional trigger-inbox (the trigger substrate).
+-- Built on the experimental Zapier SDK (foreman-l7xq M2). A SHARED workspace
+-- resource ("shared resources, private chats"): any workspace member sees and
+-- manages the workspace's automations; user_id is creator attribution.
+--
+-- Conventions match artifact / the Foreman core tables: text ids (app-set via
+-- randomUUID), user_id TEXT, workspace_id uuid FK ON DELETE SET NULL, JSON
+-- payloads as jsonb, service_role access only, app-set timestamps. RLS is enabled
+-- with no policies (service_role bypasses it; defense-in-depth) per the
+-- rls_consistency convention.
+
+CREATE TABLE IF NOT EXISTS public.automation (
+    id text NOT NULL,
+    user_id text NOT NULL,
+    workspace_id uuid,
+    name text NOT NULL,
+    description text,
+    -- The Zapier durable workflow this automation deploys to. Zapier IS the
+    -- execution store; this links Foreman's record to it.
+    zapier_workflow_id text NOT NULL,
+    zapier_version_id text,
+    -- The durable workflow.ts source, kept so the automation can be re-deployed.
+    source text NOT NULL,
+    -- Connection alias -> connection id map used at deploy/run.
+    connections jsonb NOT NULL DEFAULT '{}'::jsonb,
+    -- The Zapier app trigger spec (selected_api/action/params); null = manual/webhook.
+    trigger jsonb,
+    -- The trigger-inbox backing this automation's trigger (M3), when inbox-driven.
+    trigger_inbox_id text,
+    enabled boolean NOT NULL DEFAULT false,
+    -- active | disabled | trigger_claim_failed
+    status text NOT NULL DEFAULT 'active',
+    editor_url text,
+    trigger_url text,
+    created_at timestamp with time zone NOT NULL,
+    updated_at timestamp with time zone NOT NULL
+);
+
+ALTER TABLE public.automation OWNER TO postgres;
+ALTER TABLE public.automation ADD CONSTRAINT automation_pkey PRIMARY KEY (id);
+ALTER TABLE public.automation
+    ADD CONSTRAINT automation_workspace_id_fk
+    FOREIGN KEY (workspace_id) REFERENCES public.workspaces(id) ON DELETE SET NULL;
+
+-- List reads are scoped by workspace_id, newest-first.
+CREATE INDEX IF NOT EXISTS automation_workspace_updated_idx
+    ON public.automation(workspace_id, updated_at DESC);
+-- Reverse lookup from a Zapier workflow id (e.g. the inbox worker resolving a run).
+CREATE INDEX IF NOT EXISTS automation_zapier_workflow_idx
+    ON public.automation(zapier_workflow_id);
+
+ALTER TABLE public.automation ENABLE ROW LEVEL SECURITY;
+REVOKE SELECT ON TABLE public.automation FROM anon;
+GRANT ALL ON TABLE public.automation TO service_role;
+
+
+-- automation_run: run history + the idempotency store for the trigger-inbox
+-- worker (M3). Each inbox message dispatched to a durable run is recorded here;
+-- UNIQUE(automation_id, inbox_message_id) makes the dedup a DB constraint so a
+-- redelivery (at-least-once delivery) can't double-dispatch.
+
+CREATE TABLE IF NOT EXISTS public.automation_run (
+    id text NOT NULL,
+    automation_id text NOT NULL,
+    workspace_id uuid,
+    -- The trigger-inbox message id (dedup key); null for manual runs.
+    inbox_message_id text,
+    -- Zapier ids bridging trigger -> durable run.
+    trigger_id text,
+    durable_run_id text,
+    workflow_version_id text,
+    -- initialized | running | finished | failed | skipped
+    status text NOT NULL DEFAULT 'initialized',
+    input jsonb,
+    output jsonb,
+    error jsonb,
+    created_at timestamp with time zone NOT NULL,
+    updated_at timestamp with time zone NOT NULL
+);
+
+ALTER TABLE public.automation_run OWNER TO postgres;
+ALTER TABLE public.automation_run ADD CONSTRAINT automation_run_pkey PRIMARY KEY (id);
+ALTER TABLE public.automation_run
+    ADD CONSTRAINT automation_run_automation_id_fk
+    FOREIGN KEY (automation_id) REFERENCES public.automation(id) ON DELETE CASCADE;
+ALTER TABLE public.automation_run
+    ADD CONSTRAINT automation_run_workspace_id_fk
+    FOREIGN KEY (workspace_id) REFERENCES public.workspaces(id) ON DELETE SET NULL;
+
+-- Idempotency: one run per (automation, inbox message). The worker inserts on
+-- claim; a duplicate delivery violates this and is skipped.
+CREATE UNIQUE INDEX IF NOT EXISTS automation_run_inbox_msg_uniq
+    ON public.automation_run(automation_id, inbox_message_id)
+    WHERE inbox_message_id IS NOT NULL;
+
+CREATE INDEX IF NOT EXISTS automation_run_automation_created_idx
+    ON public.automation_run(automation_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS automation_run_workspace_created_idx
+    ON public.automation_run(workspace_id, created_at DESC);
+
+ALTER TABLE public.automation_run ENABLE ROW LEVEL SECURITY;
+REVOKE SELECT ON TABLE public.automation_run FROM anon;
+GRANT ALL ON TABLE public.automation_run TO service_role;
diff --git a/supabase/migrations/20260626000001_service_role_grants.sql b/supabase/migrations/20260626000001_service_role_grants.sql
new file mode 100644
index 00000000..311cea13
--- /dev/null
+++ b/supabase/migrations/20260626000001_service_role_grants.sql
@@ -0,0 +1,32 @@
+-- service_role table/sequence/function grants (foreman-usoj)
+--
+-- BUG: the service-role Supabase client (getSupabase(), used by every agent-server
+-- read/write that is NOT a direct Mastra PostgresStore connection) talks to PostgREST,
+-- which enforces table-level grants for the `service_role` Postgres role. Our migrations
+-- only ever granted service_role on a handful of tables (automation, automation_run via
+-- 20260626000000_automations.sql / f1cd64a; user_roles) -- never on the ~20 other tables
+-- it actually reads/writes: conversation, zapier_identity, workspace_members,
+-- action_proposal, action_run, api_key, artifact, capability_flag, channel_identity,
+-- channel_link_code, connection_alias, app_catalog, app_data_snapshot, dashboard_share,
+-- slack_installation, stored_agent, stored_agent_version, workspace_invitations,
+-- workspace_settings, workspaces, user, user_settings.
+--
+-- A fresh `supabase db reset` can mask this via Supabase's base default privileges, but a
+-- production `migration up` does not, so resolveActiveWorkspace / ensureUserExists /
+-- resolveFromApiKey and many other service-role reads fail with `42501 permission denied`.
+-- (Mastra's mastra_* tables were unaffected because PostgresStore connects directly as
+-- `postgres`, bypassing PostgREST grants.)
+--
+-- FIX: restore service_role's intended Supabase semantics -- it is the trusted backend
+-- role that bypasses RLS by design, so it gets full DML on every public table plus
+-- default privileges for tables created by later migrations. RLS remains the security
+-- boundary for anon / authenticated (untouched here); this migration is purely additive
+-- for service_role and is idempotent.
+
+GRANT ALL ON ALL TABLES IN SCHEMA public TO service_role;
+GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO service_role;
+GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO service_role;
+
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO service_role;
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role;
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT EXECUTE ON FUNCTIONS TO service_role;
diff --git a/supabase/migrations/20260627000000_document_share.sql b/supabase/migrations/20260627000000_document_share.sql
new file mode 100644
index 00000000..62753d18
--- /dev/null
+++ b/supabase/migrations/20260627000000_document_share.sql
@@ -0,0 +1,47 @@
+-- document_share: a capability token that makes one knowledge document
+-- viewable on a public, logged-out share page (foreman-jz14, knowledge layer
+-- foreman-aqjx). Mirrors dashboard_share (20260620010000) — same capability
+-- model, conventions, and grants.
+--
+-- The token IS the grant: possessing a valid, unexpired `share_token` lets the
+-- public endpoint return that document's markdown — no auth, no account. The row
+-- carries the owner's `workspace_id` so the public read can resolve the document
+-- from the owner's per-tenant Workspace filesystem without the viewer being
+-- authenticated. `doc_path` is the workspace-relative path (e.g.
+-- documents/q3-plan.md); `title` is snapshotted for display. `expires_at` is
+-- nullable (NULL = never expires). Revoking a share = delete the row; the
+-- document itself is untouched, so a leaked token can be cut independently.
+--
+-- Conventions match the other Foreman core tables: text ids, user_id is TEXT,
+-- service_role access only (no RLS; service_role grants are default-privileged by
+-- 20260626000001), app-set timestamps.
+
+CREATE TABLE IF NOT EXISTS public.document_share (
+    id text NOT NULL,
+    doc_path text NOT NULL,
+    title text,
+    workspace_id uuid,
+    user_id text NOT NULL,
+    share_token text NOT NULL,
+    expires_at timestamp with time zone,
+    created_at timestamp with time zone NOT NULL
+);
+
+ALTER TABLE public.document_share OWNER TO postgres;
+ALTER TABLE public.document_share ADD CONSTRAINT document_share_pkey PRIMARY KEY (id);
+-- Shares belong to a workspace document; user_id is the share creator.
+-- workspace_id is what the public read uses to resolve the owner's filesystem.
+ALTER TABLE public.document_share
+    ADD CONSTRAINT document_share_workspace_id_fk
+    FOREIGN KEY (workspace_id) REFERENCES public.workspaces(id) ON DELETE SET NULL;
+
+-- Public reads look up by token — must be unique and fast.
+CREATE UNIQUE INDEX IF NOT EXISTS document_share_token_key
+    ON public.document_share(share_token);
+
+-- Workspace-scoped reads (list/revoke a workspace's shares) + FK covering index.
+CREATE INDEX IF NOT EXISTS document_share_workspace_idx
+    ON public.document_share(workspace_id, doc_path);
+
+-- Service_role access only — match the other Foreman core tables (RLS not used).
+REVOKE SELECT ON TABLE public.document_share FROM anon;
diff --git a/supabase/migrations/20260627000001_conversation_visibility.sql b/supabase/migrations/20260627000001_conversation_visibility.sql
new file mode 100644
index 00000000..cb743616
--- /dev/null
+++ b/supabase/migrations/20260627000001_conversation_visibility.sql
@@ -0,0 +1,23 @@
+-- Chat visibility (foreman-28cz, collaboration epic foreman-wl54).
+--
+-- Conversations are private to their owner by default. 'workspace' makes a chat
+-- READ-ONLY visible to other members of the conversation's workspace (a teammate
+-- can view it but not continue it — messages are owner-keyed by Mastra resourceId,
+-- so collaborative writing is a separate, future problem). 'public' is reserved
+-- for a future public share link. App-layer guards enforce access; the column +
+-- check keep the value sane and the partial index makes the teammate listing fast.
+
+ALTER TABLE public.conversation
+  ADD COLUMN IF NOT EXISTS visibility text NOT NULL DEFAULT 'private';
+
+ALTER TABLE public.conversation
+  DROP CONSTRAINT IF EXISTS conversation_visibility_check;
+ALTER TABLE public.conversation
+  ADD CONSTRAINT conversation_visibility_check
+  CHECK (visibility IN ('private', 'workspace', 'public'));
+
+-- Teammate listing reads workspace-visible chats by (workspace_id, visibility);
+-- partial index since the vast majority of rows stay 'private'.
+CREATE INDEX IF NOT EXISTS conversation_workspace_visibility_idx
+  ON public.conversation(workspace_id, visibility)
+  WHERE visibility <> 'private';
diff --git a/supabase/migrations/20260627000002_workspace_rls_policies.sql b/supabase/migrations/20260627000002_workspace_rls_policies.sql
new file mode 100644
index 00000000..6d5b27a9
--- /dev/null
+++ b/supabase/migrations/20260627000002_workspace_rls_policies.sql
@@ -0,0 +1,77 @@
+-- Workspace-scoped RLS policies (foreman-5e6p, collaboration epic foreman-wl54).
+--
+-- The Foreman runtime tables had RLS ENABLED but NO policies. Combined with the
+-- house posture that the `authenticated`/`anon` roles hold no table-level grant on
+-- them (all data access is via the service_role agent server, which BYPASSES RLS),
+-- that is a hard deny-all for any direct client — verified: even the existing
+-- policy-bearing tables (workspaces, app_catalog) grant authenticated no table
+-- SELECT. These policies declare the workspace_id boundary in the database itself
+-- so workspace_id becomes a true security boundary the moment any direct
+-- authenticated read is ever exposed (Phase 2b, per 20260621000001_rls_consistency).
+--
+-- They add NO new access today: authenticated still has no table SELECT grant, so
+-- the deny-all posture is unchanged. The policies are the latent, defense-in-depth
+-- boundary BEHIND the app-layer workspace scoping already shipped + verified live in
+-- swfe (membership) and 28cz (chat visibility).
+--
+-- Posture, matching the existing workspaces/workspace_settings policies:
+--   * SHARED workspace resources (artifact, app_data_snapshot, dashboard_share,
+--     document_share, automation, automation_run): any workspace MEMBER may read
+--     the workspace's rows. "Shared resources, private chats."
+--   * conversation (chat) is PRIVATE by default: only the owner reads it; a
+--     'workspace'/'public' chat is additionally readable by workspace members
+--     (read-only — mirrors the app-layer GET /conversations/:id from 28cz).
+--
+-- SELECT only: every mutation must continue to route through the agent server's
+-- validated app logic (proposals, dedup, snapshots, versioning) — never a direct
+-- client write. Rows with a NULL workspace_id are invisible to the membership
+-- branch (membership of a NULL workspace is never true); the conversation owner
+-- clause still covers the owner's own workspace-less chats, and service_role
+-- continues to see everything. Idempotent: DROP IF EXISTS + CREATE.
+
+-- document_share was created (20260627000000) after the rls_consistency sweep, so
+-- RLS was never enabled on it — close that gap to match its sibling dashboard_share.
+ALTER TABLE public.document_share ENABLE ROW LEVEL SECURITY;
+
+-- conversation (chat): owner-or-workspace-visible (read-only for teammates).
+DROP POLICY IF EXISTS "Members read own or workspace-shared chats" ON public.conversation;
+CREATE POLICY "Members read own or workspace-shared chats" ON public.conversation
+  FOR SELECT TO authenticated
+  USING (
+    user_id = (auth.uid())::text
+    OR (
+      visibility IN ('workspace', 'public')
+      AND public.is_workspace_member(auth.uid(), workspace_id)
+    )
+  );
+
+-- SHARED workspace resources: any member reads the workspace's rows.
+DROP POLICY IF EXISTS "Members read workspace artifacts" ON public.artifact;
+CREATE POLICY "Members read workspace artifacts" ON public.artifact
+  FOR SELECT TO authenticated
+  USING (public.is_workspace_member(auth.uid(), workspace_id));
+
+DROP POLICY IF EXISTS "Members read workspace snapshots" ON public.app_data_snapshot;
+CREATE POLICY "Members read workspace snapshots" ON public.app_data_snapshot
+  FOR SELECT TO authenticated
+  USING (public.is_workspace_member(auth.uid(), workspace_id));
+
+DROP POLICY IF EXISTS "Members read workspace dashboard shares" ON public.dashboard_share;
+CREATE POLICY "Members read workspace dashboard shares" ON public.dashboard_share
+  FOR SELECT TO authenticated
+  USING (public.is_workspace_member(auth.uid(), workspace_id));
+
+DROP POLICY IF EXISTS "Members read workspace document shares" ON public.document_share;
+CREATE POLICY "Members read workspace document shares" ON public.document_share
+  FOR SELECT TO authenticated
+  USING (public.is_workspace_member(auth.uid(), workspace_id));
+
+DROP POLICY IF EXISTS "Members read workspace automations" ON public.automation;
+CREATE POLICY "Members read workspace automations" ON public.automation
+  FOR SELECT TO authenticated
+  USING (public.is_workspace_member(auth.uid(), workspace_id));
+
+DROP POLICY IF EXISTS "Members read workspace automation runs" ON public.automation_run;
+CREATE POLICY "Members read workspace automation runs" ON public.automation_run
+  FOR SELECT TO authenticated
+  USING (public.is_workspace_member(auth.uid(), workspace_id));
diff --git a/supabase/migrations/20260627000003_conversation_share.sql b/supabase/migrations/20260627000003_conversation_share.sql
new file mode 100644
index 00000000..9910cbbd
--- /dev/null
+++ b/supabase/migrations/20260627000003_conversation_share.sql
@@ -0,0 +1,52 @@
+-- conversation_share: a capability token that makes one chat viewable on a
+-- public, logged-out share page (foreman-mk25, collaboration epic foreman-wl54).
+-- Mirrors dashboard_share (20260620010000) and document_share (20260627000000) —
+-- same capability model, conventions, and grants.
+--
+-- The token IS the grant: possessing a valid, unexpired `share_token` lets the
+-- public endpoint return that chat's messages — no auth, no account. Unlike
+-- dashboards/documents (SHARED workspace resources), a chat is OWNER-scoped: only
+-- the owner mints/revokes a link for their own chat, so the lib gates create/revoke
+-- on user_id (not workspace membership) — a solo user with no teammates can still
+-- share their chat. `workspace_id` is carried only for reference/auditing (the
+-- public read resolves messages from Mastra Memory by the conversation's
+-- mastra_thread_id, not by workspace). `expires_at` is nullable (NULL = never
+-- expires). Revoking a share = delete the row; the chat itself is untouched, so a
+-- leaked token can be cut independently of the chat's private/workspace visibility.
+--
+-- Conventions match the other Foreman core tables: text ids, user_id is TEXT,
+-- service_role access only (auto-granted by 20260626000001 default privileges),
+-- app-set timestamps. RLS is enabled at creation (no policies → deny-all for
+-- anon/authenticated; service_role bypasses) to avoid the gap that document_share
+-- left until 20260627000002.
+
+CREATE TABLE IF NOT EXISTS public.conversation_share (
+    id text NOT NULL,
+    conversation_id text NOT NULL,
+    workspace_id uuid,
+    user_id text NOT NULL,
+    share_token text NOT NULL,
+    expires_at timestamp with time zone,
+    created_at timestamp with time zone NOT NULL
+);
+
+ALTER TABLE public.conversation_share OWNER TO postgres;
+ALTER TABLE public.conversation_share ADD CONSTRAINT conversation_share_pkey PRIMARY KEY (id);
+-- The chat the token shares; user_id is the owner who created the link.
+ALTER TABLE public.conversation_share
+    ADD CONSTRAINT conversation_share_conversation_id_fk
+    FOREIGN KEY (conversation_id) REFERENCES public.conversation(id) ON DELETE CASCADE;
+ALTER TABLE public.conversation_share
+    ADD CONSTRAINT conversation_share_workspace_id_fk
+    FOREIGN KEY (workspace_id) REFERENCES public.workspaces(id) ON DELETE SET NULL;
+
+-- Public reads look up by token — must be unique and fast.
+CREATE UNIQUE INDEX IF NOT EXISTS conversation_share_token_key
+    ON public.conversation_share(share_token);
+
+-- Owner-scoped reads (does this chat have a link? revoke it) + FK covering index.
+CREATE INDEX IF NOT EXISTS conversation_share_owner_idx
+    ON public.conversation_share(user_id, conversation_id);
+
+ALTER TABLE public.conversation_share ENABLE ROW LEVEL SECURITY;
+REVOKE SELECT ON TABLE public.conversation_share FROM anon;